1 // Copyright (c) 2020 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "source/fuzz/transformation_load.h"
16
17 #include "source/fuzz/fuzzer_util.h"
18 #include "source/fuzz/instruction_descriptor.h"
19
20 namespace spvtools {
21 namespace fuzz {
22
TransformationLoad(protobufs::TransformationLoad message)23 TransformationLoad::TransformationLoad(protobufs::TransformationLoad message)
24 : message_(std::move(message)) {}
25
TransformationLoad(uint32_t fresh_id,uint32_t pointer_id,const protobufs::InstructionDescriptor & instruction_to_insert_before)26 TransformationLoad::TransformationLoad(
27 uint32_t fresh_id, uint32_t pointer_id,
28 const protobufs::InstructionDescriptor& instruction_to_insert_before) {
29 message_.set_fresh_id(fresh_id);
30 message_.set_pointer_id(pointer_id);
31 *message_.mutable_instruction_to_insert_before() =
32 instruction_to_insert_before;
33 }
34
IsApplicable(opt::IRContext * ir_context,const TransformationContext &) const35 bool TransformationLoad::IsApplicable(
36 opt::IRContext* ir_context, const TransformationContext& /*unused*/) const {
37 // The result id must be fresh.
38 if (!fuzzerutil::IsFreshId(ir_context, message_.fresh_id())) {
39 return false;
40 }
41
42 // The pointer must exist and have a type.
43 auto pointer = ir_context->get_def_use_mgr()->GetDef(message_.pointer_id());
44 if (!pointer || !pointer->type_id()) {
45 return false;
46 }
47 // The type must indeed be a pointer type.
48 auto pointer_type = ir_context->get_def_use_mgr()->GetDef(pointer->type_id());
49 assert(pointer_type && "Type id must be defined.");
50 if (pointer_type->opcode() != SpvOpTypePointer) {
51 return false;
52 }
53 // We do not want to allow loading from null or undefined pointers, as it is
54 // not clear how punishing the consequences of doing so are from a semantics
55 // point of view.
56 switch (pointer->opcode()) {
57 case SpvOpConstantNull:
58 case SpvOpUndef:
59 return false;
60 default:
61 break;
62 }
63
64 // Determine which instruction we should be inserting before.
65 auto insert_before =
66 FindInstruction(message_.instruction_to_insert_before(), ir_context);
67 // It must exist, ...
68 if (!insert_before) {
69 return false;
70 }
71 // ... and it must be legitimate to insert a store before it.
72 if (!fuzzerutil::CanInsertOpcodeBeforeInstruction(SpvOpLoad, insert_before)) {
73 return false;
74 }
75
76 // The pointer needs to be available at the insertion point.
77 return fuzzerutil::IdIsAvailableBeforeInstruction(ir_context, insert_before,
78 message_.pointer_id());
79 }
80
Apply(opt::IRContext * ir_context,TransformationContext *) const81 void TransformationLoad::Apply(opt::IRContext* ir_context,
82 TransformationContext* /*unused*/) const {
83 uint32_t result_type = fuzzerutil::GetPointeeTypeIdFromPointerType(
84 ir_context, fuzzerutil::GetTypeId(ir_context, message_.pointer_id()));
85 fuzzerutil::UpdateModuleIdBound(ir_context, message_.fresh_id());
86 auto insert_before =
87 FindInstruction(message_.instruction_to_insert_before(), ir_context);
88 auto new_instruction = MakeUnique<opt::Instruction>(
89 ir_context, SpvOpLoad, result_type, message_.fresh_id(),
90 opt::Instruction::OperandList(
91 {{SPV_OPERAND_TYPE_ID, {message_.pointer_id()}}}));
92 auto new_instruction_ptr = new_instruction.get();
93 insert_before->InsertBefore(std::move(new_instruction));
94 // Inform the def-use manager about the new instruction and record its basic
95 // block.
96 ir_context->get_def_use_mgr()->AnalyzeInstDefUse(new_instruction_ptr);
97 ir_context->set_instr_block(new_instruction_ptr,
98 ir_context->get_instr_block(insert_before));
99 }
100
ToMessage() const101 protobufs::Transformation TransformationLoad::ToMessage() const {
102 protobufs::Transformation result;
103 *result.mutable_load() = message_;
104 return result;
105 }
106
GetFreshIds() const107 std::unordered_set<uint32_t> TransformationLoad::GetFreshIds() const {
108 return {message_.fresh_id()};
109 }
110
111 } // namespace fuzz
112 } // namespace spvtools
113