mirror of
https://github.com/KhronosGroup/SPIRV-Tools
synced 2024-10-19 11:30:15 +00:00
6c218ec60b
This change adds a fuzzer pass that sprinkles access chain instructions into a module at random. This allows other passes to have a richer set of pointers available to them, in particular the passes that add loads and stores.
449 lines
16 KiB
C++
449 lines
16 KiB
C++
// Copyright (c) 2020 Google LLC
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
#include "source/fuzz/transformation_access_chain.h"
|
|
#include "source/fuzz/instruction_descriptor.h"
|
|
#include "test/fuzz/fuzz_test_util.h"
|
|
|
|
namespace spvtools {
|
|
namespace fuzz {
|
|
namespace {
|
|
|
|
TEST(TransformationAccessChainTest, BasicTest) {
|
|
std::string shader = R"(
|
|
OpCapability Shader
|
|
%1 = OpExtInstImport "GLSL.std.450"
|
|
OpMemoryModel Logical GLSL450
|
|
OpEntryPoint Fragment %4 "main" %48 %54
|
|
OpExecutionMode %4 OriginUpperLeft
|
|
OpSource ESSL 310
|
|
%2 = OpTypeVoid
|
|
%3 = OpTypeFunction %2
|
|
%6 = OpTypeFloat 32
|
|
%7 = OpTypeVector %6 2
|
|
%50 = OpTypeMatrix %7 2
|
|
%70 = OpTypePointer Function %7
|
|
%71 = OpTypePointer Function %50
|
|
%8 = OpTypeStruct %7 %6
|
|
%9 = OpTypePointer Function %8
|
|
%10 = OpTypeInt 32 1
|
|
%11 = OpTypePointer Function %10
|
|
%12 = OpTypeFunction %10 %9 %11
|
|
%17 = OpConstant %10 0
|
|
%18 = OpTypeInt 32 0
|
|
%19 = OpConstant %18 0
|
|
%20 = OpTypePointer Function %6
|
|
%99 = OpTypePointer Private %6
|
|
%29 = OpConstant %6 0
|
|
%30 = OpConstant %6 1
|
|
%31 = OpConstantComposite %7 %29 %30
|
|
%32 = OpConstant %6 2
|
|
%33 = OpConstantComposite %8 %31 %32
|
|
%35 = OpConstant %10 10
|
|
%51 = OpConstant %18 10
|
|
%80 = OpConstant %18 0
|
|
%81 = OpConstant %10 1
|
|
%82 = OpConstant %18 2
|
|
%83 = OpConstant %10 3
|
|
%84 = OpConstant %18 4
|
|
%85 = OpConstant %10 5
|
|
%52 = OpTypeArray %50 %51
|
|
%53 = OpTypePointer Private %52
|
|
%45 = OpUndef %9
|
|
%46 = OpConstantNull %9
|
|
%47 = OpTypePointer Private %8
|
|
%48 = OpVariable %47 Private
|
|
%54 = OpVariable %53 Private
|
|
%4 = OpFunction %2 None %3
|
|
%5 = OpLabel
|
|
%28 = OpVariable %9 Function
|
|
%34 = OpVariable %11 Function
|
|
%36 = OpVariable %9 Function
|
|
%38 = OpVariable %11 Function
|
|
%44 = OpCopyObject %9 %36
|
|
OpStore %28 %33
|
|
OpStore %34 %35
|
|
%37 = OpLoad %8 %28
|
|
OpStore %36 %37
|
|
%39 = OpLoad %10 %34
|
|
OpStore %38 %39
|
|
%40 = OpFunctionCall %10 %15 %36 %38
|
|
%41 = OpLoad %10 %34
|
|
%42 = OpIAdd %10 %41 %40
|
|
OpStore %34 %42
|
|
OpReturn
|
|
OpFunctionEnd
|
|
%15 = OpFunction %10 None %12
|
|
%13 = OpFunctionParameter %9
|
|
%14 = OpFunctionParameter %11
|
|
%16 = OpLabel
|
|
%21 = OpAccessChain %20 %13 %17 %19
|
|
%43 = OpCopyObject %9 %13
|
|
%22 = OpLoad %6 %21
|
|
%23 = OpConvertFToS %10 %22
|
|
%24 = OpLoad %10 %14
|
|
%25 = OpIAdd %10 %23 %24
|
|
OpReturnValue %25
|
|
OpFunctionEnd
|
|
)";
|
|
|
|
const auto env = SPV_ENV_UNIVERSAL_1_4;
|
|
const auto consumer = nullptr;
|
|
const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
|
|
// Types:
|
|
// Ptr | Pointee | Storage class | GLSL for pointee | Ids of this type
|
|
// ----+---------+---------------+---------------------+------------------
|
|
// 9 | 8 | Function | struct(vec2, float) | 28, 36, 44, 13, 43
|
|
// 11 | 10 | Function | int | 34, 38, 14
|
|
// 20 | 6 | Function | float | -
|
|
// 99 | 6 | Private | float | -
|
|
// 53 | 52 | Private | mat2x2[10] | 54
|
|
// 47 | 8 | Private | struct(vec2, float) | 48
|
|
// 70 | 7 | Function | vec2 | -
|
|
// 71 | 59 | Function | mat2x2 | -
|
|
|
|
// Indices 0-5 are in ids 80-85
|
|
|
|
FactManager fact_manager;
|
|
fact_manager.AddFactValueOfPointeeIsIrrelevant(54);
|
|
|
|
// Bad: id is not fresh
|
|
ASSERT_FALSE(TransformationAccessChain(
|
|
43, 43, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
// Bad: pointer id does not exist
|
|
ASSERT_FALSE(TransformationAccessChain(
|
|
100, 1000, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
// Bad: pointer id is not a type
|
|
ASSERT_FALSE(TransformationAccessChain(
|
|
100, 5, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
// Bad: pointer id is not a pointer
|
|
ASSERT_FALSE(TransformationAccessChain(
|
|
100, 23, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
// Bad: index id does not exist
|
|
ASSERT_FALSE(TransformationAccessChain(
|
|
100, 43, {1000}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
// Bad: index id is not a constant
|
|
ASSERT_FALSE(TransformationAccessChain(
|
|
100, 43, {24}, MakeInstructionDescriptor(25, SpvOpIAdd, 0))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
// Bad: too many indices
|
|
ASSERT_FALSE(
|
|
TransformationAccessChain(100, 43, {80, 80, 80},
|
|
MakeInstructionDescriptor(24, SpvOpLoad, 0))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
// Bad: index id is out of bounds
|
|
ASSERT_FALSE(
|
|
TransformationAccessChain(100, 43, {80, 83},
|
|
MakeInstructionDescriptor(24, SpvOpLoad, 0))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
// Bad: attempt to insert before variable
|
|
ASSERT_FALSE(TransformationAccessChain(
|
|
100, 34, {}, MakeInstructionDescriptor(36, SpvOpVariable, 0))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
// Bad: pointer not available
|
|
ASSERT_FALSE(
|
|
TransformationAccessChain(
|
|
100, 43, {80}, MakeInstructionDescriptor(21, SpvOpAccessChain, 0))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
// Bad: instruction descriptor does not identify anything
|
|
ASSERT_FALSE(TransformationAccessChain(
|
|
100, 43, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 100))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
// Bad: pointer is null
|
|
ASSERT_FALSE(TransformationAccessChain(
|
|
100, 45, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
// Bad: pointer is undef
|
|
ASSERT_FALSE(TransformationAccessChain(
|
|
100, 46, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
// Bad: pointer to result type does not exist
|
|
ASSERT_FALSE(TransformationAccessChain(
|
|
100, 52, {0}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
|
|
.IsApplicable(context.get(), fact_manager));
|
|
|
|
{
|
|
TransformationAccessChain transformation(
|
|
100, 43, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0));
|
|
ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
|
|
transformation.Apply(context.get(), &fact_manager);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(100));
|
|
}
|
|
|
|
{
|
|
TransformationAccessChain transformation(
|
|
101, 28, {81}, MakeInstructionDescriptor(42, SpvOpReturn, 0));
|
|
ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
|
|
transformation.Apply(context.get(), &fact_manager);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(101));
|
|
}
|
|
|
|
{
|
|
TransformationAccessChain transformation(
|
|
102, 36, {80, 81}, MakeInstructionDescriptor(37, SpvOpStore, 0));
|
|
ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
|
|
transformation.Apply(context.get(), &fact_manager);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(102));
|
|
}
|
|
|
|
{
|
|
TransformationAccessChain transformation(
|
|
103, 44, {}, MakeInstructionDescriptor(44, SpvOpStore, 0));
|
|
ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
|
|
transformation.Apply(context.get(), &fact_manager);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(103));
|
|
}
|
|
|
|
{
|
|
TransformationAccessChain transformation(
|
|
104, 13, {80}, MakeInstructionDescriptor(21, SpvOpAccessChain, 0));
|
|
ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
|
|
transformation.Apply(context.get(), &fact_manager);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(104));
|
|
}
|
|
|
|
{
|
|
TransformationAccessChain transformation(
|
|
105, 34, {}, MakeInstructionDescriptor(44, SpvOpStore, 1));
|
|
ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
|
|
transformation.Apply(context.get(), &fact_manager);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(105));
|
|
}
|
|
|
|
{
|
|
TransformationAccessChain transformation(
|
|
106, 38, {}, MakeInstructionDescriptor(40, SpvOpFunctionCall, 0));
|
|
ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
|
|
transformation.Apply(context.get(), &fact_manager);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(106));
|
|
}
|
|
|
|
{
|
|
TransformationAccessChain transformation(
|
|
107, 14, {}, MakeInstructionDescriptor(24, SpvOpLoad, 0));
|
|
ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
|
|
transformation.Apply(context.get(), &fact_manager);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(107));
|
|
}
|
|
|
|
{
|
|
TransformationAccessChain transformation(
|
|
108, 54, {85, 81, 81}, MakeInstructionDescriptor(24, SpvOpLoad, 0));
|
|
ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
|
|
transformation.Apply(context.get(), &fact_manager);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
ASSERT_TRUE(fact_manager.PointeeValueIsIrrelevant(108));
|
|
}
|
|
|
|
{
|
|
TransformationAccessChain transformation(
|
|
109, 48, {80, 80}, MakeInstructionDescriptor(24, SpvOpLoad, 0));
|
|
ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
|
|
transformation.Apply(context.get(), &fact_manager);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(109));
|
|
}
|
|
|
|
std::string after_transformation = R"(
|
|
OpCapability Shader
|
|
%1 = OpExtInstImport "GLSL.std.450"
|
|
OpMemoryModel Logical GLSL450
|
|
OpEntryPoint Fragment %4 "main" %48 %54
|
|
OpExecutionMode %4 OriginUpperLeft
|
|
OpSource ESSL 310
|
|
%2 = OpTypeVoid
|
|
%3 = OpTypeFunction %2
|
|
%6 = OpTypeFloat 32
|
|
%7 = OpTypeVector %6 2
|
|
%50 = OpTypeMatrix %7 2
|
|
%70 = OpTypePointer Function %7
|
|
%71 = OpTypePointer Function %50
|
|
%8 = OpTypeStruct %7 %6
|
|
%9 = OpTypePointer Function %8
|
|
%10 = OpTypeInt 32 1
|
|
%11 = OpTypePointer Function %10
|
|
%12 = OpTypeFunction %10 %9 %11
|
|
%17 = OpConstant %10 0
|
|
%18 = OpTypeInt 32 0
|
|
%19 = OpConstant %18 0
|
|
%20 = OpTypePointer Function %6
|
|
%99 = OpTypePointer Private %6
|
|
%29 = OpConstant %6 0
|
|
%30 = OpConstant %6 1
|
|
%31 = OpConstantComposite %7 %29 %30
|
|
%32 = OpConstant %6 2
|
|
%33 = OpConstantComposite %8 %31 %32
|
|
%35 = OpConstant %10 10
|
|
%51 = OpConstant %18 10
|
|
%80 = OpConstant %18 0
|
|
%81 = OpConstant %10 1
|
|
%82 = OpConstant %18 2
|
|
%83 = OpConstant %10 3
|
|
%84 = OpConstant %18 4
|
|
%85 = OpConstant %10 5
|
|
%52 = OpTypeArray %50 %51
|
|
%53 = OpTypePointer Private %52
|
|
%45 = OpUndef %9
|
|
%46 = OpConstantNull %9
|
|
%47 = OpTypePointer Private %8
|
|
%48 = OpVariable %47 Private
|
|
%54 = OpVariable %53 Private
|
|
%4 = OpFunction %2 None %3
|
|
%5 = OpLabel
|
|
%28 = OpVariable %9 Function
|
|
%34 = OpVariable %11 Function
|
|
%36 = OpVariable %9 Function
|
|
%38 = OpVariable %11 Function
|
|
%44 = OpCopyObject %9 %36
|
|
%103 = OpAccessChain %9 %44
|
|
OpStore %28 %33
|
|
%105 = OpAccessChain %11 %34
|
|
OpStore %34 %35
|
|
%37 = OpLoad %8 %28
|
|
%102 = OpAccessChain %20 %36 %80 %81
|
|
OpStore %36 %37
|
|
%39 = OpLoad %10 %34
|
|
OpStore %38 %39
|
|
%106 = OpAccessChain %11 %38
|
|
%40 = OpFunctionCall %10 %15 %36 %38
|
|
%41 = OpLoad %10 %34
|
|
%42 = OpIAdd %10 %41 %40
|
|
OpStore %34 %42
|
|
%101 = OpAccessChain %20 %28 %81
|
|
OpReturn
|
|
OpFunctionEnd
|
|
%15 = OpFunction %10 None %12
|
|
%13 = OpFunctionParameter %9
|
|
%14 = OpFunctionParameter %11
|
|
%16 = OpLabel
|
|
%104 = OpAccessChain %70 %13 %80
|
|
%21 = OpAccessChain %20 %13 %17 %19
|
|
%43 = OpCopyObject %9 %13
|
|
%22 = OpLoad %6 %21
|
|
%23 = OpConvertFToS %10 %22
|
|
%100 = OpAccessChain %70 %43 %80
|
|
%107 = OpAccessChain %11 %14
|
|
%108 = OpAccessChain %99 %54 %85 %81 %81
|
|
%109 = OpAccessChain %99 %48 %80 %80
|
|
%24 = OpLoad %10 %14
|
|
%25 = OpIAdd %10 %23 %24
|
|
OpReturnValue %25
|
|
OpFunctionEnd
|
|
)";
|
|
ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
|
|
}
|
|
|
|
TEST(TransformationAccessChainTest, IsomorphicStructs) {
|
|
std::string shader = R"(
|
|
OpCapability Shader
|
|
%1 = OpExtInstImport "GLSL.std.450"
|
|
OpMemoryModel Logical GLSL450
|
|
OpEntryPoint Fragment %4 "main" %11 %12
|
|
OpExecutionMode %4 OriginUpperLeft
|
|
OpSource ESSL 310
|
|
%2 = OpTypeVoid
|
|
%3 = OpTypeFunction %2
|
|
%6 = OpTypeFloat 32
|
|
%7 = OpTypeStruct %6
|
|
%8 = OpTypePointer Private %7
|
|
%9 = OpTypeStruct %6
|
|
%10 = OpTypePointer Private %9
|
|
%11 = OpVariable %8 Private
|
|
%12 = OpVariable %10 Private
|
|
%4 = OpFunction %2 None %3
|
|
%5 = OpLabel
|
|
OpReturn
|
|
OpFunctionEnd
|
|
)";
|
|
|
|
const auto env = SPV_ENV_UNIVERSAL_1_4;
|
|
const auto consumer = nullptr;
|
|
const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
|
|
FactManager fact_manager;
|
|
|
|
{
|
|
TransformationAccessChain transformation(
|
|
100, 11, {}, MakeInstructionDescriptor(5, SpvOpReturn, 0));
|
|
ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
|
|
transformation.Apply(context.get(), &fact_manager);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
}
|
|
{
|
|
TransformationAccessChain transformation(
|
|
101, 12, {}, MakeInstructionDescriptor(5, SpvOpReturn, 0));
|
|
ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
|
|
transformation.Apply(context.get(), &fact_manager);
|
|
ASSERT_TRUE(IsValid(env, context.get()));
|
|
}
|
|
|
|
std::string after_transformation = R"(
|
|
OpCapability Shader
|
|
%1 = OpExtInstImport "GLSL.std.450"
|
|
OpMemoryModel Logical GLSL450
|
|
OpEntryPoint Fragment %4 "main" %11 %12
|
|
OpExecutionMode %4 OriginUpperLeft
|
|
OpSource ESSL 310
|
|
%2 = OpTypeVoid
|
|
%3 = OpTypeFunction %2
|
|
%6 = OpTypeFloat 32
|
|
%7 = OpTypeStruct %6
|
|
%8 = OpTypePointer Private %7
|
|
%9 = OpTypeStruct %6
|
|
%10 = OpTypePointer Private %9
|
|
%11 = OpVariable %8 Private
|
|
%12 = OpVariable %10 Private
|
|
%4 = OpFunction %2 None %3
|
|
%5 = OpLabel
|
|
%100 = OpAccessChain %8 %11
|
|
%101 = OpAccessChain %10 %12
|
|
OpReturn
|
|
OpFunctionEnd
|
|
)";
|
|
ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
|
|
}
|
|
|
|
} // namespace
|
|
} // namespace fuzz
|
|
} // namespace spvtools
|