1 // Copyright (c) 2020 Vasyl Teliman
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "source/fuzz/fuzzer_pass_replace_params_with_struct.h"
16
17 #include <numeric>
18 #include <vector>
19
20 #include "source/fuzz/fuzzer_context.h"
21 #include "source/fuzz/fuzzer_util.h"
22 #include "source/fuzz/transformation_replace_params_with_struct.h"
23
24 namespace spvtools {
25 namespace fuzz {
26
FuzzerPassReplaceParamsWithStruct(opt::IRContext * ir_context,TransformationContext * transformation_context,FuzzerContext * fuzzer_context,protobufs::TransformationSequence * transformations)27 FuzzerPassReplaceParamsWithStruct::FuzzerPassReplaceParamsWithStruct(
28 opt::IRContext* ir_context, TransformationContext* transformation_context,
29 FuzzerContext* fuzzer_context,
30 protobufs::TransformationSequence* transformations)
31 : FuzzerPass(ir_context, transformation_context, fuzzer_context,
32 transformations) {}
33
Apply()34 void FuzzerPassReplaceParamsWithStruct::Apply() {
35 for (const auto& function : *GetIRContext()->module()) {
36 auto params =
37 fuzzerutil::GetParameters(GetIRContext(), function.result_id());
38
39 if (params.empty() || fuzzerutil::FunctionIsEntryPoint(
40 GetIRContext(), function.result_id())) {
41 continue;
42 }
43
44 if (!GetFuzzerContext()->ChoosePercentage(
45 GetFuzzerContext()->GetChanceOfReplacingParametersWithStruct())) {
46 continue;
47 }
48
49 std::vector<uint32_t> parameter_index(params.size());
50 std::iota(parameter_index.begin(), parameter_index.end(), 0);
51
52 // Remove the indices of unsupported parameters.
53 auto new_end =
54 std::remove_if(parameter_index.begin(), parameter_index.end(),
55 [this, ¶ms](uint32_t index) {
56 return !TransformationReplaceParamsWithStruct::
57 IsParameterTypeSupported(GetIRContext(),
58 params[index]->type_id());
59 });
60
61 // std::remove_if changes the vector so that removed elements are placed at
62 // the end (i.e. [new_end, parameter_index.end()) is a range of removed
63 // elements). However, the size of the vector is not changed so we need to
64 // change that explicitly by popping those elements from the vector.
65 parameter_index.erase(new_end, parameter_index.end());
66
67 if (parameter_index.empty()) {
68 continue;
69 }
70
71 // Select |num_replaced_params| parameters at random. We shuffle the vector
72 // of indices for randomization and shrink it to select first
73 // |num_replaced_params| parameters.
74 auto num_replaced_params = std::min<size_t>(
75 parameter_index.size(),
76 GetFuzzerContext()->GetRandomNumberOfParametersReplacedWithStruct(
77 static_cast<uint32_t>(params.size())));
78
79 GetFuzzerContext()->Shuffle(¶meter_index);
80 parameter_index.resize(num_replaced_params);
81
82 // Make sure OpTypeStruct exists in the module.
83 std::vector<uint32_t> component_type_ids;
84 for (auto index : parameter_index) {
85 component_type_ids.push_back(params[index]->type_id());
86 }
87
88 FindOrCreateStructType(component_type_ids);
89
90 // Map parameters' indices to parameters' ids.
91 std::vector<uint32_t> parameter_id;
92 for (auto index : parameter_index) {
93 parameter_id.push_back(params[index]->result_id());
94 }
95
96 std::map<uint32_t, uint32_t> caller_id_to_fresh_id;
97 for (const auto* inst :
98 fuzzerutil::GetCallers(GetIRContext(), function.result_id())) {
99 caller_id_to_fresh_id[inst->result_id()] =
100 GetFuzzerContext()->GetFreshId();
101 }
102
103 ApplyTransformation(TransformationReplaceParamsWithStruct(
104 parameter_id, GetFuzzerContext()->GetFreshId(),
105 GetFuzzerContext()->GetFreshId(), caller_id_to_fresh_id));
106 }
107 }
108
109 } // namespace fuzz
110 } // namespace spvtools
111