1 // Copyright (c) 2020 Vasyl Teliman
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "source/fuzz/fuzzer_pass_replace_params_with_struct.h"
16
17 #include <numeric>
18 #include <vector>
19
20 #include "source/fuzz/fuzzer_context.h"
21 #include "source/fuzz/fuzzer_util.h"
22 #include "source/fuzz/transformation_replace_params_with_struct.h"
23
24 namespace spvtools {
25 namespace fuzz {
26
FuzzerPassReplaceParamsWithStruct(opt::IRContext * ir_context,TransformationContext * transformation_context,FuzzerContext * fuzzer_context,protobufs::TransformationSequence * transformations,bool ignore_inapplicable_transformations)27 FuzzerPassReplaceParamsWithStruct::FuzzerPassReplaceParamsWithStruct(
28 opt::IRContext* ir_context, TransformationContext* transformation_context,
29 FuzzerContext* fuzzer_context,
30 protobufs::TransformationSequence* transformations,
31 bool ignore_inapplicable_transformations)
32 : FuzzerPass(ir_context, transformation_context, fuzzer_context,
33 transformations, ignore_inapplicable_transformations) {}
34
Apply()35 void FuzzerPassReplaceParamsWithStruct::Apply() {
36 for (const auto& function : *GetIRContext()->module()) {
37 auto params =
38 fuzzerutil::GetParameters(GetIRContext(), function.result_id());
39
40 if (params.empty() || fuzzerutil::FunctionIsEntryPoint(
41 GetIRContext(), function.result_id())) {
42 continue;
43 }
44
45 if (!GetFuzzerContext()->ChoosePercentage(
46 GetFuzzerContext()->GetChanceOfReplacingParametersWithStruct())) {
47 continue;
48 }
49
50 std::vector<uint32_t> parameter_index(params.size());
51 std::iota(parameter_index.begin(), parameter_index.end(), 0);
52
53 // Remove the indices of unsupported parameters.
54 auto new_end =
55 std::remove_if(parameter_index.begin(), parameter_index.end(),
56 [this, ¶ms](uint32_t index) {
57 return !TransformationReplaceParamsWithStruct::
58 IsParameterTypeSupported(GetIRContext(),
59 params[index]->type_id());
60 });
61
62 // std::remove_if changes the vector so that removed elements are placed at
63 // the end (i.e. [new_end, parameter_index.end()) is a range of removed
64 // elements). However, the size of the vector is not changed so we need to
65 // change that explicitly by popping those elements from the vector.
66 parameter_index.erase(new_end, parameter_index.end());
67
68 if (parameter_index.empty()) {
69 continue;
70 }
71
72 // Select |num_replaced_params| parameters at random. We shuffle the vector
73 // of indices for randomization and shrink it to select first
74 // |num_replaced_params| parameters.
75 auto num_replaced_params = std::min<size_t>(
76 parameter_index.size(),
77 GetFuzzerContext()->GetRandomNumberOfParametersReplacedWithStruct(
78 static_cast<uint32_t>(params.size())));
79
80 GetFuzzerContext()->Shuffle(¶meter_index);
81 parameter_index.resize(num_replaced_params);
82
83 // Make sure OpTypeStruct exists in the module.
84 std::vector<uint32_t> component_type_ids;
85 for (auto index : parameter_index) {
86 component_type_ids.push_back(params[index]->type_id());
87 }
88
89 FindOrCreateStructType(component_type_ids);
90
91 // Map parameters' indices to parameters' ids.
92 std::vector<uint32_t> parameter_id;
93 for (auto index : parameter_index) {
94 parameter_id.push_back(params[index]->result_id());
95 }
96
97 std::map<uint32_t, uint32_t> caller_id_to_fresh_id;
98 for (const auto* inst :
99 fuzzerutil::GetCallers(GetIRContext(), function.result_id())) {
100 caller_id_to_fresh_id[inst->result_id()] =
101 GetFuzzerContext()->GetFreshId();
102 }
103
104 ApplyTransformation(TransformationReplaceParamsWithStruct(
105 parameter_id, GetFuzzerContext()->GetFreshId(),
106 GetFuzzerContext()->GetFreshId(), caller_id_to_fresh_id));
107 }
108 }
109
110 } // namespace fuzz
111 } // namespace spvtools
112