1 // Copyright (c) 2020 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "fuzzer_pass_interchange_signedness_of_integer_operands.h"
16
17 #include "source/fuzz/fuzzer_util.h"
18 #include "source/fuzz/id_use_descriptor.h"
19 #include "source/fuzz/transformation_record_synonymous_constants.h"
20 #include "source/fuzz/transformation_replace_id_with_synonym.h"
21
22 namespace spvtools {
23 namespace fuzz {
24
25 FuzzerPassInterchangeSignednessOfIntegerOperands::
FuzzerPassInterchangeSignednessOfIntegerOperands(opt::IRContext * ir_context,TransformationContext * transformation_context,FuzzerContext * fuzzer_context,protobufs::TransformationSequence * transformations)26 FuzzerPassInterchangeSignednessOfIntegerOperands(
27 opt::IRContext* ir_context,
28 TransformationContext* transformation_context,
29 FuzzerContext* fuzzer_context,
30 protobufs::TransformationSequence* transformations)
31 : FuzzerPass(ir_context, transformation_context, fuzzer_context,
32 transformations) {}
33
Apply()34 void FuzzerPassInterchangeSignednessOfIntegerOperands::Apply() {
35 assert(!GetFuzzerContext()->IsWgslCompatible() &&
36 "Cannot interchange signedness in WGSL");
37
38 // Make vector keeping track of all the uses we want to replace.
39 // This is a vector of pairs, where the first element is an id use descriptor
40 // identifying the use of a constant id and the second is the id that should
41 // be used to replace it.
42 std::vector<std::pair<protobufs::IdUseDescriptor, uint32_t>> uses_to_replace;
43
44 for (auto constant : GetIRContext()->GetConstants()) {
45 uint32_t constant_id = constant->result_id();
46
47 // We want to record the synonymity of an integer constant with another
48 // constant with opposite signedness, and this can only be done if they are
49 // not irrelevant.
50 if (GetTransformationContext()->GetFactManager()->IdIsIrrelevant(
51 constant_id)) {
52 continue;
53 }
54
55 uint32_t toggled_id =
56 FindOrCreateToggledIntegerConstant(constant->result_id());
57 if (!toggled_id) {
58 // Not an integer constant
59 continue;
60 }
61
62 assert(!GetTransformationContext()->GetFactManager()->IdIsIrrelevant(
63 toggled_id) &&
64 "FindOrCreateToggledConstant can't produce an irrelevant id");
65
66 // Record synonymous constants
67 ApplyTransformation(
68 TransformationRecordSynonymousConstants(constant_id, toggled_id));
69
70 // Find all the uses of the constant and, for each, probabilistically
71 // decide whether to replace it.
72 GetIRContext()->get_def_use_mgr()->ForEachUse(
73 constant_id,
74 [this, toggled_id, &uses_to_replace](opt::Instruction* use_inst,
75 uint32_t use_index) -> void {
76 if (GetFuzzerContext()->ChoosePercentage(
77 GetFuzzerContext()
78 ->GetChanceOfInterchangingSignednessOfIntegerOperands())) {
79 MaybeAddUseToReplace(use_inst, use_index, toggled_id,
80 &uses_to_replace);
81 }
82 });
83 }
84
85 // Replace the ids if it is allowed.
86 for (auto use_to_replace : uses_to_replace) {
87 MaybeApplyTransformation(TransformationReplaceIdWithSynonym(
88 use_to_replace.first, use_to_replace.second));
89 }
90 }
91
92 uint32_t FuzzerPassInterchangeSignednessOfIntegerOperands::
FindOrCreateToggledIntegerConstant(uint32_t id)93 FindOrCreateToggledIntegerConstant(uint32_t id) {
94 // |id| must not be a specialization constant because we do not know the value
95 // of specialization constants.
96 if (opt::IsSpecConstantInst(
97 GetIRContext()->get_def_use_mgr()->GetDef(id)->opcode())) {
98 return 0;
99 }
100
101 auto constant = GetIRContext()->get_constant_mgr()->FindDeclaredConstant(id);
102
103 // This pass only toggles integer constants.
104 if (!constant->AsIntConstant() &&
105 (!constant->AsVectorConstant() ||
106 !constant->AsVectorConstant()->component_type()->AsInteger())) {
107 return 0;
108 }
109
110 if (auto integer = constant->AsIntConstant()) {
111 auto type = integer->type()->AsInteger();
112
113 // Find or create and return the toggled constant.
114 return FindOrCreateIntegerConstant(std::vector<uint32_t>(integer->words()),
115 type->width(), !type->IsSigned(), false);
116 }
117
118 // The constant is an integer vector.
119
120 // Find the component type.
121 auto component_type =
122 constant->AsVectorConstant()->component_type()->AsInteger();
123
124 // Find or create the toggled component type.
125 uint32_t toggled_component_type = FindOrCreateIntegerType(
126 component_type->width(), !component_type->IsSigned());
127
128 // Get the information about the toggled components. We need to extract this
129 // information now because the analyses might be invalidated, which would make
130 // the constant and component_type variables invalid.
131 std::vector<std::vector<uint32_t>> component_words;
132
133 for (auto component : constant->AsVectorConstant()->GetComponents()) {
134 component_words.push_back(component->AsIntConstant()->words());
135 }
136 uint32_t width = component_type->width();
137 bool is_signed = !component_type->IsSigned();
138
139 std::vector<uint32_t> toggled_components;
140
141 // Find or create the toggled components.
142 for (auto words : component_words) {
143 toggled_components.push_back(
144 FindOrCreateIntegerConstant(words, width, is_signed, false));
145 }
146
147 // Find or create the required toggled vector type.
148 uint32_t toggled_type = FindOrCreateVectorType(
149 toggled_component_type, (uint32_t)toggled_components.size());
150
151 // Find or create and return the toggled vector constant.
152 return FindOrCreateCompositeConstant(toggled_components, toggled_type, false);
153 }
154
155 } // namespace fuzz
156 } // namespace spvtools
157