mirror of
https://github.com/KhronosGroup/SPIRV-Tools
synced 2024-12-29 03:01:08 +00:00
fac166162f
At present, TransformationReplaceIdWithSynonym both extracts elements from composite objects and replaces uses of ids with synonyms. This new TransformationCompositeExtract class will allow that transformation to be broken into smaller transformations.
385 lines
16 KiB
C++
385 lines
16 KiB
C++
// Copyright (c) 2019 Google LLC
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
#include "source/fuzz/fuzzer_util.h"
|
|
|
|
namespace spvtools {
|
|
namespace fuzz {
|
|
|
|
namespace fuzzerutil {
|
|
|
|
bool IsFreshId(opt::IRContext* context, uint32_t id) {
|
|
return !context->get_def_use_mgr()->GetDef(id);
|
|
}
|
|
|
|
void UpdateModuleIdBound(opt::IRContext* context, uint32_t id) {
|
|
// TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/2541) consider the
|
|
// case where the maximum id bound is reached.
|
|
context->module()->SetIdBound(
|
|
std::max(context->module()->id_bound(), id + 1));
|
|
}
|
|
|
|
opt::BasicBlock* MaybeFindBlock(opt::IRContext* context,
|
|
uint32_t maybe_block_id) {
|
|
auto inst = context->get_def_use_mgr()->GetDef(maybe_block_id);
|
|
if (inst == nullptr) {
|
|
// No instruction defining this id was found.
|
|
return nullptr;
|
|
}
|
|
if (inst->opcode() != SpvOpLabel) {
|
|
// The instruction defining the id is not a label, so it cannot be a block
|
|
// id.
|
|
return nullptr;
|
|
}
|
|
return context->cfg()->block(maybe_block_id);
|
|
}
|
|
|
|
bool PhiIdsOkForNewEdge(
|
|
opt::IRContext* context, opt::BasicBlock* bb_from, opt::BasicBlock* bb_to,
|
|
const google::protobuf::RepeatedField<google::protobuf::uint32>& phi_ids) {
|
|
if (bb_from->IsSuccessor(bb_to)) {
|
|
// There is already an edge from |from_block| to |to_block|, so there is
|
|
// no need to extend OpPhi instructions. Do not allow phi ids to be
|
|
// present. This might turn out to be too strict; perhaps it would be OK
|
|
// just to ignore the ids in this case.
|
|
return phi_ids.empty();
|
|
}
|
|
// The edge would add a previously non-existent edge from |from_block| to
|
|
// |to_block|, so we go through the given phi ids and check that they exactly
|
|
// match the OpPhi instructions in |to_block|.
|
|
uint32_t phi_index = 0;
|
|
// An explicit loop, rather than applying a lambda to each OpPhi in |bb_to|,
|
|
// makes sense here because we need to increment |phi_index| for each OpPhi
|
|
// instruction.
|
|
for (auto& inst : *bb_to) {
|
|
if (inst.opcode() != SpvOpPhi) {
|
|
// The OpPhi instructions all occur at the start of the block; if we find
|
|
// a non-OpPhi then we have seen them all.
|
|
break;
|
|
}
|
|
if (phi_index == static_cast<uint32_t>(phi_ids.size())) {
|
|
// Not enough phi ids have been provided to account for the OpPhi
|
|
// instructions.
|
|
return false;
|
|
}
|
|
// Look for an instruction defining the next phi id.
|
|
opt::Instruction* phi_extension =
|
|
context->get_def_use_mgr()->GetDef(phi_ids[phi_index]);
|
|
if (!phi_extension) {
|
|
// The id given to extend this OpPhi does not exist.
|
|
return false;
|
|
}
|
|
if (phi_extension->type_id() != inst.type_id()) {
|
|
// The instruction given to extend this OpPhi either does not have a type
|
|
// or its type does not match that of the OpPhi.
|
|
return false;
|
|
}
|
|
|
|
if (context->get_instr_block(phi_extension)) {
|
|
// The instruction defining the phi id has an associated block (i.e., it
|
|
// is not a global value). Check whether its definition dominates the
|
|
// exit of |from_block|.
|
|
auto dominator_analysis =
|
|
context->GetDominatorAnalysis(bb_from->GetParent());
|
|
if (!dominator_analysis->Dominates(phi_extension,
|
|
bb_from->terminator())) {
|
|
// The given id is no good as its definition does not dominate the exit
|
|
// of |from_block|
|
|
return false;
|
|
}
|
|
}
|
|
phi_index++;
|
|
}
|
|
// Return false if not all of the ids for extending OpPhi instructions are
|
|
// needed. This might turn out to be stricter than necessary; perhaps it would
|
|
// be OK just to not use the ids in this case.
|
|
return phi_index == static_cast<uint32_t>(phi_ids.size());
|
|
}
|
|
|
|
void AddUnreachableEdgeAndUpdateOpPhis(
|
|
opt::IRContext* context, opt::BasicBlock* bb_from, opt::BasicBlock* bb_to,
|
|
bool condition_value,
|
|
const google::protobuf::RepeatedField<google::protobuf::uint32>& phi_ids) {
|
|
assert(PhiIdsOkForNewEdge(context, bb_from, bb_to, phi_ids) &&
|
|
"Precondition on phi_ids is not satisfied");
|
|
assert(bb_from->terminator()->opcode() == SpvOpBranch &&
|
|
"Precondition on terminator of bb_from is not satisfied");
|
|
|
|
// Get the id of the boolean constant to be used as the condition.
|
|
opt::analysis::Bool bool_type;
|
|
opt::analysis::BoolConstant bool_constant(
|
|
context->get_type_mgr()->GetRegisteredType(&bool_type)->AsBool(),
|
|
condition_value);
|
|
uint32_t bool_id = context->get_constant_mgr()->FindDeclaredConstant(
|
|
&bool_constant, context->get_type_mgr()->GetId(&bool_type));
|
|
|
|
const bool from_to_edge_already_exists = bb_from->IsSuccessor(bb_to);
|
|
auto successor = bb_from->terminator()->GetSingleWordInOperand(0);
|
|
|
|
// Add the dead branch, by turning OpBranch into OpBranchConditional, and
|
|
// ordering the targets depending on whether the given boolean corresponds to
|
|
// true or false.
|
|
bb_from->terminator()->SetOpcode(SpvOpBranchConditional);
|
|
bb_from->terminator()->SetInOperands(
|
|
{{SPV_OPERAND_TYPE_ID, {bool_id}},
|
|
{SPV_OPERAND_TYPE_ID, {condition_value ? successor : bb_to->id()}},
|
|
{SPV_OPERAND_TYPE_ID, {condition_value ? bb_to->id() : successor}}});
|
|
|
|
// Update OpPhi instructions in the target block if this branch adds a
|
|
// previously non-existent edge from source to target.
|
|
if (!from_to_edge_already_exists) {
|
|
uint32_t phi_index = 0;
|
|
for (auto& inst : *bb_to) {
|
|
if (inst.opcode() != SpvOpPhi) {
|
|
break;
|
|
}
|
|
assert(phi_index < static_cast<uint32_t>(phi_ids.size()) &&
|
|
"There should be exactly one phi id per OpPhi instruction.");
|
|
inst.AddOperand({SPV_OPERAND_TYPE_ID, {phi_ids[phi_index]}});
|
|
inst.AddOperand({SPV_OPERAND_TYPE_ID, {bb_from->id()}});
|
|
phi_index++;
|
|
}
|
|
assert(phi_index == static_cast<uint32_t>(phi_ids.size()) &&
|
|
"There should be exactly one phi id per OpPhi instruction.");
|
|
}
|
|
}
|
|
|
|
bool BlockIsInLoopContinueConstruct(opt::IRContext* context, uint32_t block_id,
|
|
uint32_t maybe_loop_header_id) {
|
|
// We deem a block to be part of a loop's continue construct if the loop's
|
|
// continue target dominates the block.
|
|
auto containing_construct_block = context->cfg()->block(maybe_loop_header_id);
|
|
if (containing_construct_block->IsLoopHeader()) {
|
|
auto continue_target = containing_construct_block->ContinueBlockId();
|
|
if (context->GetDominatorAnalysis(containing_construct_block->GetParent())
|
|
->Dominates(continue_target, block_id)) {
|
|
return true;
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
|
|
opt::BasicBlock::iterator GetIteratorForInstruction(
|
|
opt::BasicBlock* block, const opt::Instruction* inst) {
|
|
for (auto inst_it = block->begin(); inst_it != block->end(); ++inst_it) {
|
|
if (inst == &*inst_it) {
|
|
return inst_it;
|
|
}
|
|
}
|
|
return block->end();
|
|
}
|
|
|
|
bool NewEdgeRespectsUseDefDominance(opt::IRContext* context,
|
|
opt::BasicBlock* bb_from,
|
|
opt::BasicBlock* bb_to) {
|
|
assert(bb_from->terminator()->opcode() == SpvOpBranch);
|
|
|
|
// If there is *already* an edge from |bb_from| to |bb_to|, then adding
|
|
// another edge is fine from a dominance point of view.
|
|
if (bb_from->terminator()->GetSingleWordInOperand(0) == bb_to->id()) {
|
|
return true;
|
|
}
|
|
|
|
// TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/2919): the
|
|
// solution below to determining whether a new edge respects dominance
|
|
// rules is incomplete. Test
|
|
// TransformationAddDeadContinueTest::DISABLED_Miscellaneous6 exposes the
|
|
// problem. In practice, this limitation does not bite too often, and the
|
|
// worst it does is leads to SPIR-V that spirv-val rejects.
|
|
|
|
// Let us assume that the module being manipulated is valid according to the
|
|
// rules of the SPIR-V language.
|
|
//
|
|
// Suppose that some block Y is dominated by |bb_to| (which includes the case
|
|
// where Y = |bb_to|).
|
|
//
|
|
// Suppose that Y uses an id i that is defined in some other block X.
|
|
//
|
|
// Because the module is valid, X must dominate Y. We are concerned about
|
|
// whether an edge from |bb_from| to |bb_to| could *stop* X from dominating
|
|
// Y.
|
|
//
|
|
// Because |bb_to| dominates Y, a new edge from |bb_from| to |bb_to| can
|
|
// only affect whether X dominates Y if X dominates |bb_to|.
|
|
//
|
|
// So let us assume that X does dominate |bb_to|, so that we have:
|
|
//
|
|
// (X defines i) dominates |bb_to| dominates (Y uses i)
|
|
//
|
|
// The new edge from |bb_from| to |bb_to| will stop the definition of i in X
|
|
// from dominating the use of i in Y exactly when the new edge will stop X
|
|
// from dominating |bb_to|.
|
|
//
|
|
// Now, the block X that we are worried about cannot dominate |bb_from|,
|
|
// because in that case X would still dominate |bb_to| after we add an edge
|
|
// from |bb_from| to |bb_to|.
|
|
//
|
|
// Also, it cannot be that X = |bb_to|, because nothing can stop a block
|
|
// from dominating itself.
|
|
//
|
|
// So we are looking for a block X such that:
|
|
//
|
|
// - X strictly dominates |bb_to|
|
|
// - X does not dominate |bb_from|
|
|
// - X defines an id i
|
|
// - i is used in some block Y
|
|
// - |bb_to| dominates Y
|
|
|
|
// Walk the dominator tree backwards, starting from the immediate dominator
|
|
// of |bb_to|. We can stop when we find a block that also dominates
|
|
// |bb_from|.
|
|
auto dominator_analysis = context->GetDominatorAnalysis(bb_from->GetParent());
|
|
for (auto dominator = dominator_analysis->ImmediateDominator(bb_to);
|
|
dominator != nullptr &&
|
|
!dominator_analysis->Dominates(dominator, bb_from);
|
|
dominator = dominator_analysis->ImmediateDominator(dominator)) {
|
|
// |dominator| is a candidate for block X in the above description.
|
|
// We now look through the instructions for a candidate instruction i.
|
|
for (auto& inst : *dominator) {
|
|
// Consider all the uses of this instruction.
|
|
if (!context->get_def_use_mgr()->WhileEachUse(
|
|
&inst,
|
|
[bb_to, context, dominator_analysis](
|
|
opt::Instruction* user, uint32_t operand_index) -> bool {
|
|
// If this use is in an OpPhi, we need to check that dominance
|
|
// of the relevant *parent* block is not spoiled. Otherwise we
|
|
// need to check that dominance of the block containing the use
|
|
// is not spoiled.
|
|
opt::BasicBlock* use_block_or_phi_parent =
|
|
user->opcode() == SpvOpPhi
|
|
? context->cfg()->block(
|
|
user->GetSingleWordOperand(operand_index + 1))
|
|
: context->get_instr_block(user);
|
|
|
|
// There might not be any relevant block, e.g. if the use is in
|
|
// a decoration; in this case the new edge is unproblematic.
|
|
if (use_block_or_phi_parent == nullptr) {
|
|
return true;
|
|
}
|
|
|
|
// With reference to the above discussion,
|
|
// |use_block_or_phi_parent| is a candidate for the block Y.
|
|
// If |bb_to| dominates this block, the new edge would be
|
|
// problematic.
|
|
return !dominator_analysis->Dominates(bb_to,
|
|
use_block_or_phi_parent);
|
|
})) {
|
|
return false;
|
|
}
|
|
}
|
|
}
|
|
return true;
|
|
}
|
|
|
|
bool BlockIsReachableInItsFunction(opt::IRContext* context,
|
|
opt::BasicBlock* bb) {
|
|
auto enclosing_function = bb->GetParent();
|
|
return context->GetDominatorAnalysis(enclosing_function)
|
|
->Dominates(enclosing_function->entry().get(), bb);
|
|
}
|
|
|
|
bool CanInsertOpcodeBeforeInstruction(
|
|
SpvOp opcode, const opt::BasicBlock::iterator& instruction_in_block) {
|
|
if (instruction_in_block->PreviousNode() &&
|
|
(instruction_in_block->PreviousNode()->opcode() == SpvOpLoopMerge ||
|
|
instruction_in_block->PreviousNode()->opcode() == SpvOpSelectionMerge)) {
|
|
// We cannot insert directly after a merge instruction.
|
|
return false;
|
|
}
|
|
if (opcode != SpvOpVariable &&
|
|
instruction_in_block->opcode() == SpvOpVariable) {
|
|
// We cannot insert a non-OpVariable instruction directly before a
|
|
// variable; variables in a function must be contiguous in the entry block.
|
|
return false;
|
|
}
|
|
// We cannot insert a non-OpPhi instruction directly before an OpPhi, because
|
|
// OpPhi instructions need to be contiguous at the start of a block.
|
|
return opcode == SpvOpPhi || instruction_in_block->opcode() != SpvOpPhi;
|
|
}
|
|
|
|
bool CanMakeSynonymOf(opt::IRContext* ir_context, opt::Instruction* inst) {
|
|
if (!inst->HasResultId()) {
|
|
// We can only make a synonym of an instruction that generates an id.
|
|
return false;
|
|
}
|
|
if (!inst->type_id()) {
|
|
// We can only make a synonym of an instruction that has a type.
|
|
return false;
|
|
}
|
|
// We do not make synonyms of objects that have decorations: if the synonym is
|
|
// not decorated analogously, using the original object vs. its synonymous
|
|
// form may not be equivalent.
|
|
return ir_context->get_decoration_mgr()
|
|
->GetDecorationsFor(inst->result_id(), true)
|
|
.empty();
|
|
}
|
|
|
|
bool IsCompositeType(const opt::analysis::Type* type) {
|
|
return type && (type->AsArray() || type->AsMatrix() || type->AsStruct() ||
|
|
type->AsVector());
|
|
}
|
|
|
|
uint32_t WalkCompositeTypeIndices(
|
|
opt::IRContext* context, uint32_t base_object_type_id,
|
|
const google::protobuf::RepeatedField<google::protobuf::uint32>& indices) {
|
|
uint32_t sub_object_type_id = base_object_type_id;
|
|
for (auto index : indices) {
|
|
auto should_be_composite_type =
|
|
context->get_def_use_mgr()->GetDef(sub_object_type_id);
|
|
assert(should_be_composite_type && "The type should exist.");
|
|
if (SpvOpTypeStruct == should_be_composite_type->opcode()) {
|
|
if (index >= should_be_composite_type->NumInOperands()) {
|
|
return 0;
|
|
}
|
|
sub_object_type_id =
|
|
should_be_composite_type->GetSingleWordInOperand(index);
|
|
} else if (SpvOpTypeArray == should_be_composite_type->opcode()) {
|
|
auto array_length_constant =
|
|
context->get_constant_mgr()
|
|
->GetConstantFromInst(context->get_def_use_mgr()->GetDef(
|
|
should_be_composite_type->GetSingleWordInOperand(1)))
|
|
->AsIntConstant();
|
|
if (array_length_constant->words().size() != 1) {
|
|
return 0;
|
|
}
|
|
auto array_length = array_length_constant->GetU32();
|
|
if (index >= array_length) {
|
|
return 0;
|
|
}
|
|
sub_object_type_id = should_be_composite_type->GetSingleWordInOperand(0);
|
|
} else if (SpvOpTypeVector == should_be_composite_type->opcode()) {
|
|
auto vector_length = should_be_composite_type->GetSingleWordInOperand(1);
|
|
if (index >= vector_length) {
|
|
return 0;
|
|
}
|
|
sub_object_type_id = should_be_composite_type->GetSingleWordInOperand(0);
|
|
} else if (SpvOpTypeMatrix == should_be_composite_type->opcode()) {
|
|
auto matrix_column_count =
|
|
should_be_composite_type->GetSingleWordInOperand(1);
|
|
if (index >= matrix_column_count) {
|
|
return 0;
|
|
}
|
|
sub_object_type_id = should_be_composite_type->GetSingleWordInOperand(0);
|
|
} else {
|
|
return 0;
|
|
}
|
|
}
|
|
return sub_object_type_id;
|
|
}
|
|
|
|
} // namespace fuzzerutil
|
|
|
|
} // namespace fuzz
|
|
} // namespace spvtools
|