mirror of
https://github.com/KhronosGroup/SPIRV-Tools
synced 2024-10-20 03:50:05 +00:00
1e1c308ded
This PR changes the fact manager so that, when calling some of the functions in submanagers, passes references to other submanagers if necessary (e.g. to make consistency checks). In particular: - DataSynonymAndIdEquationFacts is passed to the AddFactIdIsIrrelevant function of IrrelevantValueFacts - IrrelevantValueFacts is passed to the AddFact functions of DataSynonymAndIdEquationFacts The IRContext is also passed when necessary and the calls to the corresponding functions in FactManager were updated to be valid and always use an updated context. Fixes #3550.
327 lines
12 KiB
C++
327 lines
12 KiB
C++
// Copyright (c) 2020 Vasyl Teliman
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
#include "source/fuzz/transformation_mutate_pointer.h"
|
|
|
|
#include "source/fuzz/fuzzer_util.h"
|
|
#include "source/fuzz/instruction_descriptor.h"
|
|
#include "test/fuzz/fuzz_test_util.h"
|
|
|
|
namespace spvtools {
|
|
namespace fuzz {
|
|
namespace {
|
|
|
|
TEST(TransformationMutatePointerTest, BasicTest) {
|
|
std::string shader = R"(
|
|
OpCapability Shader
|
|
%1 = OpExtInstImport "GLSL.std.450"
|
|
OpMemoryModel Logical GLSL450
|
|
OpEntryPoint Fragment %4 "main"
|
|
OpExecutionMode %4 OriginUpperLeft
|
|
OpSource ESSL 310
|
|
%2 = OpTypeVoid
|
|
%3 = OpTypeFunction %2
|
|
%6 = OpTypeInt 32 1
|
|
%7 = OpTypeFloat 32
|
|
%34 = OpConstant %7 0
|
|
%36 = OpConstant %6 0
|
|
%14 = OpTypeVector %7 3
|
|
%35 = OpConstantComposite %14 %34 %34 %34
|
|
%15 = OpTypeMatrix %14 2
|
|
%8 = OpConstant %6 5
|
|
%9 = OpTypeArray %7 %8
|
|
%37 = OpConstantComposite %9 %34 %34 %34 %34 %34
|
|
%11 = OpTypeStruct
|
|
%38 = OpConstantComposite %11
|
|
%39 = OpConstantComposite %15 %35 %35
|
|
%31 = OpTypePointer Function %14
|
|
%10 = OpTypeStruct %7 %6 %9 %11 %15 %14
|
|
%40 = OpConstantComposite %10 %34 %36 %37 %38 %39 %35
|
|
%13 = OpTypePointer Function %10
|
|
%16 = OpTypePointer Private %10
|
|
%17 = OpTypePointer Workgroup %10
|
|
%18 = OpTypeStruct %16
|
|
%19 = OpTypePointer Private %18
|
|
%20 = OpVariable %16 Private
|
|
%21 = OpVariable %17 Workgroup
|
|
%22 = OpVariable %19 Private
|
|
%23 = OpTypePointer Output %6
|
|
%24 = OpVariable %23 Output
|
|
%27 = OpTypeFunction %2 %13
|
|
%32 = OpUndef %16
|
|
%33 = OpConstantNull %16
|
|
%4 = OpFunction %2 None %3
|
|
%5 = OpLabel
|
|
OpReturn
|
|
OpFunctionEnd
|
|
%28 = OpFunction %2 None %27
|
|
%29 = OpFunctionParameter %13
|
|
%30 = OpLabel
|
|
%25 = OpVariable %13 Function
|
|
%26 = OpAccessChain %31 %25 %8
|
|
OpReturn
|
|
OpFunctionEnd
|
|
)";
|
|
|
|
const auto env = SPV_ENV_UNIVERSAL_1_3;
|
|
const auto consumer = nullptr;
|
|
const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
|
|
FactManager fact_manager;
|
|
spvtools::ValidatorOptions validator_options;
|
|
TransformationContext transformation_context(&fact_manager,
|
|
validator_options);
|
|
|
|
fact_manager.AddFactIdIsIrrelevant(35, context.get());
|
|
fact_manager.AddFactIdIsIrrelevant(39, context.get());
|
|
|
|
const auto insert_before = MakeInstructionDescriptor(26, SpvOpReturn, 0);
|
|
|
|
// 20 is not a fresh id.
|
|
ASSERT_FALSE(TransformationMutatePointer(20, 20, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |insert_before| instruction descriptor is invalid.
|
|
ASSERT_FALSE(TransformationMutatePointer(
|
|
20, 70, MakeInstructionDescriptor(26, SpvOpStore, 0))
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// Can't insert OpLoad before OpVariable.
|
|
ASSERT_FALSE(TransformationMutatePointer(
|
|
20, 70, MakeInstructionDescriptor(26, SpvOpVariable, 0))
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| doesn't exist in the module.
|
|
ASSERT_FALSE(TransformationMutatePointer(70, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| doesn't have a type id.
|
|
ASSERT_FALSE(TransformationMutatePointer(11, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| is a result id of OpUndef.
|
|
ASSERT_FALSE(TransformationMutatePointer(32, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| is a result id of OpConstantNull.
|
|
ASSERT_FALSE(TransformationMutatePointer(33, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| is not a pointer instruction.
|
|
ASSERT_FALSE(TransformationMutatePointer(8, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| has invalid storage class
|
|
ASSERT_FALSE(TransformationMutatePointer(24, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id|'s pointee contains non-scalar and non-composite constituents.
|
|
ASSERT_FALSE(TransformationMutatePointer(22, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// There is no irrelevant zero constant to insert into the |pointer_id|.
|
|
ASSERT_FALSE(TransformationMutatePointer(20, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| is not available before |insert_before|.
|
|
ASSERT_FALSE(TransformationMutatePointer(
|
|
26, 70, MakeInstructionDescriptor(26, SpvOpAccessChain, 0))
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
fact_manager.AddFactIdIsIrrelevant(40, context.get());
|
|
|
|
uint32_t fresh_id = 70;
|
|
uint32_t pointer_ids[] = {
|
|
20, // Mutate Private variable.
|
|
21, // Mutate Workgroup variable.
|
|
25, // Mutate Function variable.
|
|
29, // Mutate function parameter.
|
|
26, // Mutate OpAccessChain.
|
|
};
|
|
|
|
for (auto pointer_id : pointer_ids) {
|
|
TransformationMutatePointer transformation(pointer_id, fresh_id++,
|
|
insert_before);
|
|
ASSERT_TRUE(
|
|
transformation.IsApplicable(context.get(), transformation_context));
|
|
transformation.Apply(context.get(), &transformation_context);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
}
|
|
|
|
std::string after_transformation = R"(
|
|
OpCapability Shader
|
|
%1 = OpExtInstImport "GLSL.std.450"
|
|
OpMemoryModel Logical GLSL450
|
|
OpEntryPoint Fragment %4 "main"
|
|
OpExecutionMode %4 OriginUpperLeft
|
|
OpSource ESSL 310
|
|
%2 = OpTypeVoid
|
|
%3 = OpTypeFunction %2
|
|
%6 = OpTypeInt 32 1
|
|
%7 = OpTypeFloat 32
|
|
%34 = OpConstant %7 0
|
|
%36 = OpConstant %6 0
|
|
%14 = OpTypeVector %7 3
|
|
%35 = OpConstantComposite %14 %34 %34 %34
|
|
%15 = OpTypeMatrix %14 2
|
|
%8 = OpConstant %6 5
|
|
%9 = OpTypeArray %7 %8
|
|
%37 = OpConstantComposite %9 %34 %34 %34 %34 %34
|
|
%11 = OpTypeStruct
|
|
%38 = OpConstantComposite %11
|
|
%39 = OpConstantComposite %15 %35 %35
|
|
%31 = OpTypePointer Function %14
|
|
%10 = OpTypeStruct %7 %6 %9 %11 %15 %14
|
|
%40 = OpConstantComposite %10 %34 %36 %37 %38 %39 %35
|
|
%13 = OpTypePointer Function %10
|
|
%16 = OpTypePointer Private %10
|
|
%17 = OpTypePointer Workgroup %10
|
|
%18 = OpTypeStruct %16
|
|
%19 = OpTypePointer Private %18
|
|
%20 = OpVariable %16 Private
|
|
%21 = OpVariable %17 Workgroup
|
|
%22 = OpVariable %19 Private
|
|
%23 = OpTypePointer Output %6
|
|
%24 = OpVariable %23 Output
|
|
%27 = OpTypeFunction %2 %13
|
|
%32 = OpUndef %16
|
|
%33 = OpConstantNull %16
|
|
%4 = OpFunction %2 None %3
|
|
%5 = OpLabel
|
|
OpReturn
|
|
OpFunctionEnd
|
|
%28 = OpFunction %2 None %27
|
|
%29 = OpFunctionParameter %13
|
|
%30 = OpLabel
|
|
%25 = OpVariable %13 Function
|
|
%26 = OpAccessChain %31 %25 %8
|
|
|
|
; modified Private variable
|
|
%70 = OpLoad %10 %20
|
|
OpStore %20 %40
|
|
OpStore %20 %70
|
|
|
|
; modified Workgroup variable
|
|
%71 = OpLoad %10 %21
|
|
OpStore %21 %40
|
|
OpStore %21 %71
|
|
|
|
; modified Function variable
|
|
%72 = OpLoad %10 %25
|
|
OpStore %25 %40
|
|
OpStore %25 %72
|
|
|
|
; modified function parameter
|
|
%73 = OpLoad %10 %29
|
|
OpStore %29 %40
|
|
OpStore %29 %73
|
|
|
|
; modified OpAccessChain
|
|
%74 = OpLoad %14 %26
|
|
OpStore %26 %35
|
|
OpStore %26 %74
|
|
|
|
OpReturn
|
|
OpFunctionEnd
|
|
)";
|
|
|
|
ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
|
|
}
|
|
|
|
TEST(TransformationMutatePointerTest, HandlesUnreachableBlocks) {
|
|
std::string shader = R"(
|
|
OpCapability Shader
|
|
%1 = OpExtInstImport "GLSL.std.450"
|
|
OpMemoryModel Logical GLSL450
|
|
OpEntryPoint Fragment %4 "main"
|
|
OpExecutionMode %4 OriginUpperLeft
|
|
OpSource ESSL 310
|
|
%2 = OpTypeVoid
|
|
%3 = OpTypeFunction %2
|
|
%6 = OpTypeInt 32 1
|
|
%7 = OpConstant %6 0
|
|
%8 = OpTypePointer Function %6
|
|
%11 = OpTypePointer Private %6
|
|
%12 = OpVariable %11 Private
|
|
%4 = OpFunction %2 None %3
|
|
%5 = OpLabel
|
|
%9 = OpVariable %8 Function
|
|
OpReturn
|
|
%10 = OpLabel
|
|
OpReturn
|
|
OpFunctionEnd
|
|
)";
|
|
|
|
const auto env = SPV_ENV_UNIVERSAL_1_3;
|
|
const auto consumer = nullptr;
|
|
const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
|
|
FactManager fact_manager;
|
|
spvtools::ValidatorOptions validator_options;
|
|
TransformationContext transformation_context(&fact_manager,
|
|
validator_options);
|
|
|
|
fact_manager.AddFactIdIsIrrelevant(7, context.get());
|
|
|
|
ASSERT_FALSE(
|
|
context->GetDominatorAnalysis(context->GetFunction(4))->IsReachable(10));
|
|
|
|
const auto insert_before = MakeInstructionDescriptor(10, SpvOpReturn, 0);
|
|
|
|
// Local variable doesn't dominate an unreachable block.
|
|
ASSERT_FALSE(TransformationMutatePointer(9, 50, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// Can mutate a global variable in an unreachable block.
|
|
TransformationMutatePointer transformation(12, 50, insert_before);
|
|
ASSERT_TRUE(
|
|
transformation.IsApplicable(context.get(), transformation_context));
|
|
transformation.Apply(context.get(), &transformation_context);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
|
|
std::string after_transformation = R"(
|
|
OpCapability Shader
|
|
%1 = OpExtInstImport "GLSL.std.450"
|
|
OpMemoryModel Logical GLSL450
|
|
OpEntryPoint Fragment %4 "main"
|
|
OpExecutionMode %4 OriginUpperLeft
|
|
OpSource ESSL 310
|
|
%2 = OpTypeVoid
|
|
%3 = OpTypeFunction %2
|
|
%6 = OpTypeInt 32 1
|
|
%7 = OpConstant %6 0
|
|
%8 = OpTypePointer Function %6
|
|
%11 = OpTypePointer Private %6
|
|
%12 = OpVariable %11 Private
|
|
%4 = OpFunction %2 None %3
|
|
%5 = OpLabel
|
|
%9 = OpVariable %8 Function
|
|
OpReturn
|
|
%10 = OpLabel
|
|
%50 = OpLoad %6 %12
|
|
OpStore %12 %7
|
|
OpStore %12 %50
|
|
OpReturn
|
|
OpFunctionEnd
|
|
)";
|
|
|
|
ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
|
|
}
|
|
|
|
} // namespace
|
|
} // namespace fuzz
|
|
} // namespace spvtools
|