1 // Copyright (c) 2020 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "source/fuzz/fuzzer_pass_add_local_variables.h"
16
17 #include "source/fuzz/fuzzer_util.h"
18 #include "source/fuzz/transformation_add_local_variable.h"
19 #include "source/fuzz/transformation_add_type_pointer.h"
20
21 namespace spvtools {
22 namespace fuzz {
23
FuzzerPassAddLocalVariables(opt::IRContext * ir_context,TransformationContext * transformation_context,FuzzerContext * fuzzer_context,protobufs::TransformationSequence * transformations,bool ignore_inapplicable_transformations)24 FuzzerPassAddLocalVariables::FuzzerPassAddLocalVariables(
25 opt::IRContext* ir_context, TransformationContext* transformation_context,
26 FuzzerContext* fuzzer_context,
27 protobufs::TransformationSequence* transformations,
28 bool ignore_inapplicable_transformations)
29 : FuzzerPass(ir_context, transformation_context, fuzzer_context,
30 transformations, ignore_inapplicable_transformations) {}
31
Apply()32 void FuzzerPassAddLocalVariables::Apply() {
33 auto basic_type_ids_and_pointers =
34 GetAvailableBasicTypesAndPointers(SpvStorageClassFunction);
35
36 // These are the basic types that are available to this fuzzer pass.
37 auto& basic_types = basic_type_ids_and_pointers.first;
38 if (basic_types.empty()) {
39 // The pass cannot do anything if there are no basic types.
40 return;
41 }
42
43 // These are the pointers to those basic types that are *initially* available
44 // to the fuzzer pass. The fuzzer pass might add pointer types in cases where
45 // none are available for a given basic type.
46 auto& basic_type_to_pointers = basic_type_ids_and_pointers.second;
47
48 // Consider every function in the module.
49 for (auto& function : *GetIRContext()->module()) {
50 // Probabilistically keep adding random variables to this function.
51 while (GetFuzzerContext()->ChoosePercentage(
52 GetFuzzerContext()->GetChanceOfAddingLocalVariable())) {
53 // Choose a random basic type; the new variable's type will be a pointer
54 // to this basic type.
55 uint32_t basic_type =
56 basic_types[GetFuzzerContext()->RandomIndex(basic_types)];
57 uint32_t pointer_type;
58 std::vector<uint32_t>& available_pointers_to_basic_type =
59 basic_type_to_pointers.at(basic_type);
60 // Determine whether there is at least one pointer to this basic type.
61 if (available_pointers_to_basic_type.empty()) {
62 // There is not. Make one, to use here, and add it to the available
63 // pointers for the basic type so that future variables can potentially
64 // use it.
65 pointer_type = GetFuzzerContext()->GetFreshId();
66 ApplyTransformation(TransformationAddTypePointer(
67 pointer_type, SpvStorageClassFunction, basic_type));
68 available_pointers_to_basic_type.push_back(pointer_type);
69 } else {
70 // There is - grab one.
71 pointer_type =
72 available_pointers_to_basic_type[GetFuzzerContext()->RandomIndex(
73 available_pointers_to_basic_type)];
74 }
75 ApplyTransformation(TransformationAddLocalVariable(
76 GetFuzzerContext()->GetFreshId(), pointer_type, function.result_id(),
77 FindOrCreateZeroConstant(basic_type, false), true));
78 }
79 }
80 }
81
82 } // namespace fuzz
83 } // namespace spvtools
84