mirror of
https://github.com/KhronosGroup/SPIRV-Tools
synced 2024-10-20 03:50:05 +00:00
fcb22ecf0f
Adds a virtual method, GetFreshIds(), to Transformation. Every transformation uses this to indicate which ids in its protobuf message are fresh ids. This means that when replaying a sequence of transformations the replayer can obtain a smallest id that is not in use by the module already and that will not be used by any transformation by necessity. Ids greater than or equal to this id can be used as overflow ids. Fixes #3851.
324 lines
12 KiB
C++
324 lines
12 KiB
C++
// Copyright (c) 2020 Vasyl Teliman
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
#include "source/fuzz/transformation_mutate_pointer.h"
|
|
|
|
#include "source/fuzz/fuzzer_util.h"
|
|
#include "source/fuzz/instruction_descriptor.h"
|
|
#include "test/fuzz/fuzz_test_util.h"
|
|
|
|
namespace spvtools {
|
|
namespace fuzz {
|
|
namespace {
|
|
|
|
TEST(TransformationMutatePointerTest, BasicTest) {
|
|
std::string shader = R"(
|
|
OpCapability Shader
|
|
%1 = OpExtInstImport "GLSL.std.450"
|
|
OpMemoryModel Logical GLSL450
|
|
OpEntryPoint Fragment %4 "main"
|
|
OpExecutionMode %4 OriginUpperLeft
|
|
OpSource ESSL 310
|
|
%2 = OpTypeVoid
|
|
%3 = OpTypeFunction %2
|
|
%6 = OpTypeInt 32 1
|
|
%7 = OpTypeFloat 32
|
|
%34 = OpConstant %7 0
|
|
%36 = OpConstant %6 0
|
|
%14 = OpTypeVector %7 3
|
|
%35 = OpConstantComposite %14 %34 %34 %34
|
|
%15 = OpTypeMatrix %14 2
|
|
%8 = OpConstant %6 5
|
|
%9 = OpTypeArray %7 %8
|
|
%37 = OpConstantComposite %9 %34 %34 %34 %34 %34
|
|
%11 = OpTypeStruct
|
|
%38 = OpConstantComposite %11
|
|
%39 = OpConstantComposite %15 %35 %35
|
|
%31 = OpTypePointer Function %14
|
|
%10 = OpTypeStruct %7 %6 %9 %11 %15 %14
|
|
%40 = OpConstantComposite %10 %34 %36 %37 %38 %39 %35
|
|
%13 = OpTypePointer Function %10
|
|
%16 = OpTypePointer Private %10
|
|
%17 = OpTypePointer Workgroup %10
|
|
%18 = OpTypeStruct %16
|
|
%19 = OpTypePointer Private %18
|
|
%20 = OpVariable %16 Private
|
|
%21 = OpVariable %17 Workgroup
|
|
%22 = OpVariable %19 Private
|
|
%23 = OpTypePointer Output %6
|
|
%24 = OpVariable %23 Output
|
|
%27 = OpTypeFunction %2 %13
|
|
%32 = OpUndef %16
|
|
%33 = OpConstantNull %16
|
|
%4 = OpFunction %2 None %3
|
|
%5 = OpLabel
|
|
OpReturn
|
|
OpFunctionEnd
|
|
%28 = OpFunction %2 None %27
|
|
%29 = OpFunctionParameter %13
|
|
%30 = OpLabel
|
|
%25 = OpVariable %13 Function
|
|
%26 = OpAccessChain %31 %25 %8
|
|
OpReturn
|
|
OpFunctionEnd
|
|
)";
|
|
|
|
const auto env = SPV_ENV_UNIVERSAL_1_3;
|
|
const auto consumer = nullptr;
|
|
const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
|
|
spvtools::ValidatorOptions validator_options;
|
|
TransformationContext transformation_context(
|
|
MakeUnique<FactManager>(context.get()), validator_options);
|
|
transformation_context.GetFactManager()->AddFactIdIsIrrelevant(35);
|
|
transformation_context.GetFactManager()->AddFactIdIsIrrelevant(39);
|
|
|
|
const auto insert_before = MakeInstructionDescriptor(26, SpvOpReturn, 0);
|
|
|
|
// 20 is not a fresh id.
|
|
ASSERT_FALSE(TransformationMutatePointer(20, 20, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |insert_before| instruction descriptor is invalid.
|
|
ASSERT_FALSE(TransformationMutatePointer(
|
|
20, 70, MakeInstructionDescriptor(26, SpvOpStore, 0))
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// Can't insert OpLoad before OpVariable.
|
|
ASSERT_FALSE(TransformationMutatePointer(
|
|
20, 70, MakeInstructionDescriptor(26, SpvOpVariable, 0))
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| doesn't exist in the module.
|
|
ASSERT_FALSE(TransformationMutatePointer(70, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| doesn't have a type id.
|
|
ASSERT_FALSE(TransformationMutatePointer(11, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| is a result id of OpUndef.
|
|
ASSERT_FALSE(TransformationMutatePointer(32, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| is a result id of OpConstantNull.
|
|
ASSERT_FALSE(TransformationMutatePointer(33, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| is not a pointer instruction.
|
|
ASSERT_FALSE(TransformationMutatePointer(8, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| has invalid storage class
|
|
ASSERT_FALSE(TransformationMutatePointer(24, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id|'s pointee contains non-scalar and non-composite constituents.
|
|
ASSERT_FALSE(TransformationMutatePointer(22, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// There is no irrelevant zero constant to insert into the |pointer_id|.
|
|
ASSERT_FALSE(TransformationMutatePointer(20, 70, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// |pointer_id| is not available before |insert_before|.
|
|
ASSERT_FALSE(TransformationMutatePointer(
|
|
26, 70, MakeInstructionDescriptor(26, SpvOpAccessChain, 0))
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
transformation_context.GetFactManager()->AddFactIdIsIrrelevant(40);
|
|
|
|
uint32_t fresh_id = 70;
|
|
uint32_t pointer_ids[] = {
|
|
20, // Mutate Private variable.
|
|
21, // Mutate Workgroup variable.
|
|
25, // Mutate Function variable.
|
|
29, // Mutate function parameter.
|
|
26, // Mutate OpAccessChain.
|
|
};
|
|
|
|
for (auto pointer_id : pointer_ids) {
|
|
TransformationMutatePointer transformation(pointer_id, fresh_id++,
|
|
insert_before);
|
|
ASSERT_TRUE(
|
|
transformation.IsApplicable(context.get(), transformation_context));
|
|
ApplyAndCheckFreshIds(transformation, context.get(),
|
|
&transformation_context);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
}
|
|
|
|
std::string after_transformation = R"(
|
|
OpCapability Shader
|
|
%1 = OpExtInstImport "GLSL.std.450"
|
|
OpMemoryModel Logical GLSL450
|
|
OpEntryPoint Fragment %4 "main"
|
|
OpExecutionMode %4 OriginUpperLeft
|
|
OpSource ESSL 310
|
|
%2 = OpTypeVoid
|
|
%3 = OpTypeFunction %2
|
|
%6 = OpTypeInt 32 1
|
|
%7 = OpTypeFloat 32
|
|
%34 = OpConstant %7 0
|
|
%36 = OpConstant %6 0
|
|
%14 = OpTypeVector %7 3
|
|
%35 = OpConstantComposite %14 %34 %34 %34
|
|
%15 = OpTypeMatrix %14 2
|
|
%8 = OpConstant %6 5
|
|
%9 = OpTypeArray %7 %8
|
|
%37 = OpConstantComposite %9 %34 %34 %34 %34 %34
|
|
%11 = OpTypeStruct
|
|
%38 = OpConstantComposite %11
|
|
%39 = OpConstantComposite %15 %35 %35
|
|
%31 = OpTypePointer Function %14
|
|
%10 = OpTypeStruct %7 %6 %9 %11 %15 %14
|
|
%40 = OpConstantComposite %10 %34 %36 %37 %38 %39 %35
|
|
%13 = OpTypePointer Function %10
|
|
%16 = OpTypePointer Private %10
|
|
%17 = OpTypePointer Workgroup %10
|
|
%18 = OpTypeStruct %16
|
|
%19 = OpTypePointer Private %18
|
|
%20 = OpVariable %16 Private
|
|
%21 = OpVariable %17 Workgroup
|
|
%22 = OpVariable %19 Private
|
|
%23 = OpTypePointer Output %6
|
|
%24 = OpVariable %23 Output
|
|
%27 = OpTypeFunction %2 %13
|
|
%32 = OpUndef %16
|
|
%33 = OpConstantNull %16
|
|
%4 = OpFunction %2 None %3
|
|
%5 = OpLabel
|
|
OpReturn
|
|
OpFunctionEnd
|
|
%28 = OpFunction %2 None %27
|
|
%29 = OpFunctionParameter %13
|
|
%30 = OpLabel
|
|
%25 = OpVariable %13 Function
|
|
%26 = OpAccessChain %31 %25 %8
|
|
|
|
; modified Private variable
|
|
%70 = OpLoad %10 %20
|
|
OpStore %20 %40
|
|
OpStore %20 %70
|
|
|
|
; modified Workgroup variable
|
|
%71 = OpLoad %10 %21
|
|
OpStore %21 %40
|
|
OpStore %21 %71
|
|
|
|
; modified Function variable
|
|
%72 = OpLoad %10 %25
|
|
OpStore %25 %40
|
|
OpStore %25 %72
|
|
|
|
; modified function parameter
|
|
%73 = OpLoad %10 %29
|
|
OpStore %29 %40
|
|
OpStore %29 %73
|
|
|
|
; modified OpAccessChain
|
|
%74 = OpLoad %14 %26
|
|
OpStore %26 %35
|
|
OpStore %26 %74
|
|
|
|
OpReturn
|
|
OpFunctionEnd
|
|
)";
|
|
|
|
ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
|
|
}
|
|
|
|
TEST(TransformationMutatePointerTest, HandlesUnreachableBlocks) {
|
|
std::string shader = R"(
|
|
OpCapability Shader
|
|
%1 = OpExtInstImport "GLSL.std.450"
|
|
OpMemoryModel Logical GLSL450
|
|
OpEntryPoint Fragment %4 "main"
|
|
OpExecutionMode %4 OriginUpperLeft
|
|
OpSource ESSL 310
|
|
%2 = OpTypeVoid
|
|
%3 = OpTypeFunction %2
|
|
%6 = OpTypeInt 32 1
|
|
%7 = OpConstant %6 0
|
|
%8 = OpTypePointer Function %6
|
|
%11 = OpTypePointer Private %6
|
|
%12 = OpVariable %11 Private
|
|
%4 = OpFunction %2 None %3
|
|
%5 = OpLabel
|
|
%9 = OpVariable %8 Function
|
|
OpReturn
|
|
%10 = OpLabel
|
|
OpReturn
|
|
OpFunctionEnd
|
|
)";
|
|
|
|
const auto env = SPV_ENV_UNIVERSAL_1_3;
|
|
const auto consumer = nullptr;
|
|
const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
|
|
spvtools::ValidatorOptions validator_options;
|
|
TransformationContext transformation_context(
|
|
MakeUnique<FactManager>(context.get()), validator_options);
|
|
transformation_context.GetFactManager()->AddFactIdIsIrrelevant(7);
|
|
|
|
ASSERT_FALSE(
|
|
context->GetDominatorAnalysis(context->GetFunction(4))->IsReachable(10));
|
|
|
|
const auto insert_before = MakeInstructionDescriptor(10, SpvOpReturn, 0);
|
|
|
|
// Local variable doesn't dominate an unreachable block.
|
|
ASSERT_FALSE(TransformationMutatePointer(9, 50, insert_before)
|
|
.IsApplicable(context.get(), transformation_context));
|
|
|
|
// Can mutate a global variable in an unreachable block.
|
|
TransformationMutatePointer transformation(12, 50, insert_before);
|
|
ASSERT_TRUE(
|
|
transformation.IsApplicable(context.get(), transformation_context));
|
|
ApplyAndCheckFreshIds(transformation, context.get(), &transformation_context);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
|
|
std::string after_transformation = R"(
|
|
OpCapability Shader
|
|
%1 = OpExtInstImport "GLSL.std.450"
|
|
OpMemoryModel Logical GLSL450
|
|
OpEntryPoint Fragment %4 "main"
|
|
OpExecutionMode %4 OriginUpperLeft
|
|
OpSource ESSL 310
|
|
%2 = OpTypeVoid
|
|
%3 = OpTypeFunction %2
|
|
%6 = OpTypeInt 32 1
|
|
%7 = OpConstant %6 0
|
|
%8 = OpTypePointer Function %6
|
|
%11 = OpTypePointer Private %6
|
|
%12 = OpVariable %11 Private
|
|
%4 = OpFunction %2 None %3
|
|
%5 = OpLabel
|
|
%9 = OpVariable %8 Function
|
|
OpReturn
|
|
%10 = OpLabel
|
|
%50 = OpLoad %6 %12
|
|
OpStore %12 %7
|
|
OpStore %12 %50
|
|
OpReturn
|
|
OpFunctionEnd
|
|
)";
|
|
|
|
ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
|
|
}
|
|
|
|
} // namespace
|
|
} // namespace fuzz
|
|
} // namespace spvtools
|