1 // Copyright (c) 2020 André Perez Maselco
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "source/fuzz/fuzzer_pass_add_vector_shuffle_instructions.h"
16
17 #include "source/fuzz/fuzzer_util.h"
18 #include "source/fuzz/instruction_descriptor.h"
19 #include "source/fuzz/transformation_vector_shuffle.h"
20
21 namespace spvtools {
22 namespace fuzz {
23
FuzzerPassAddVectorShuffleInstructions(opt::IRContext * ir_context,TransformationContext * transformation_context,FuzzerContext * fuzzer_context,protobufs::TransformationSequence * transformations)24 FuzzerPassAddVectorShuffleInstructions::FuzzerPassAddVectorShuffleInstructions(
25 opt::IRContext* ir_context, TransformationContext* transformation_context,
26 FuzzerContext* fuzzer_context,
27 protobufs::TransformationSequence* transformations)
28 : FuzzerPass(ir_context, transformation_context, fuzzer_context,
29 transformations) {}
30
Apply()31 void FuzzerPassAddVectorShuffleInstructions::Apply() {
32 ForEachInstructionWithInstructionDescriptor(
33 [this](opt::Function* function, opt::BasicBlock* block,
34 opt::BasicBlock::iterator instruction_iterator,
35 const protobufs::InstructionDescriptor& instruction_descriptor)
36 -> void {
37 assert(instruction_iterator->opcode() ==
38 instruction_descriptor.target_instruction_opcode() &&
39 "The opcode of the instruction we might insert before must be "
40 "the same as the opcode in the descriptor for the instruction");
41
42 // Randomly decide whether to try adding an OpVectorShuffle instruction.
43 if (!GetFuzzerContext()->ChoosePercentage(
44 GetFuzzerContext()->GetChanceOfAddingVectorShuffle())) {
45 return;
46 }
47
48 // It must be valid to insert an OpVectorShuffle instruction
49 // before |instruction_iterator|.
50 if (!fuzzerutil::CanInsertOpcodeBeforeInstruction(
51 SpvOpVectorShuffle, instruction_iterator)) {
52 return;
53 }
54
55 // Looks for vectors that we might consider to use as OpVectorShuffle
56 // operands.
57 std::vector<opt::Instruction*> vector_instructions =
58 FindAvailableInstructions(
59 function, block, instruction_iterator,
60 [this, instruction_descriptor](
61 opt::IRContext* ir_context,
62 opt::Instruction* instruction) -> bool {
63 if (!instruction->result_id() || !instruction->type_id()) {
64 return false;
65 }
66
67 if (!ir_context->get_type_mgr()
68 ->GetType(instruction->type_id())
69 ->AsVector()) {
70 return false;
71 }
72
73 if (!GetTransformationContext()
74 ->GetFactManager()
75 ->IdIsIrrelevant(instruction->result_id()) &&
76 !fuzzerutil::CanMakeSynonymOf(ir_context,
77 *GetTransformationContext(),
78 instruction)) {
79 // If the id is irrelevant, we can use it since it will not
80 // participate in DataSynonym fact. Otherwise, we should be
81 // able to produce a synonym out of the id.
82 return false;
83 }
84
85 return fuzzerutil::IdIsAvailableBeforeInstruction(
86 ir_context,
87 FindInstruction(instruction_descriptor, ir_context),
88 instruction->result_id());
89 });
90
91 // If there are no vector instructions, then return.
92 if (vector_instructions.empty()) {
93 return;
94 }
95
96 auto vector_1_instruction =
97 vector_instructions[GetFuzzerContext()->RandomIndex(
98 vector_instructions)];
99 auto vector_1_type = GetIRContext()
100 ->get_type_mgr()
101 ->GetType(vector_1_instruction->type_id())
102 ->AsVector();
103
104 auto vector_2_instruction =
105 GetFuzzerContext()->RemoveAtRandomIndex(&vector_instructions);
106 auto vector_2_type = GetIRContext()
107 ->get_type_mgr()
108 ->GetType(vector_2_instruction->type_id())
109 ->AsVector();
110
111 // |vector_1| and |vector_2| must have the same element type as each
112 // other. The loop is guaranteed to terminate because each iteration
113 // removes on possible choice for |vector_2|, and there is at least one
114 // choice that will cause the loop to exit - namely |vector_1|.
115 while (vector_1_type->element_type() != vector_2_type->element_type()) {
116 vector_2_instruction =
117 GetFuzzerContext()->RemoveAtRandomIndex(&vector_instructions);
118 vector_2_type = GetIRContext()
119 ->get_type_mgr()
120 ->GetType(vector_2_instruction->type_id())
121 ->AsVector();
122 }
123
124 // Gets components and creates the appropriate result vector type.
125 std::vector<uint32_t> components =
126 GetFuzzerContext()->GetRandomComponentsForVectorShuffle(
127 vector_1_type->element_count() +
128 vector_2_type->element_count());
129 FindOrCreateVectorType(GetIRContext()->get_type_mgr()->GetId(
130 vector_1_type->element_type()),
131 static_cast<uint32_t>(components.size()));
132
133 // Applies the vector shuffle transformation.
134 ApplyTransformation(TransformationVectorShuffle(
135 instruction_descriptor, GetFuzzerContext()->GetFreshId(),
136 vector_1_instruction->result_id(),
137 vector_2_instruction->result_id(), components));
138 });
139 }
140
141 } // namespace fuzz
142 } // namespace spvtools
143