1 // Copyright (c) 2020 Vasyl Teliman
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "source/fuzz/fuzzer_pass_add_composite_extract.h"
16
17 #include "source/fuzz/available_instructions.h"
18 #include "source/fuzz/fuzzer_context.h"
19 #include "source/fuzz/fuzzer_util.h"
20 #include "source/fuzz/instruction_descriptor.h"
21 #include "source/fuzz/transformation_composite_extract.h"
22
23 namespace spvtools {
24 namespace fuzz {
25
FuzzerPassAddCompositeExtract(opt::IRContext * ir_context,TransformationContext * transformation_context,FuzzerContext * fuzzer_context,protobufs::TransformationSequence * transformations,bool ignore_inapplicable_transformations)26 FuzzerPassAddCompositeExtract::FuzzerPassAddCompositeExtract(
27 opt::IRContext* ir_context, TransformationContext* transformation_context,
28 FuzzerContext* fuzzer_context,
29 protobufs::TransformationSequence* transformations,
30 bool ignore_inapplicable_transformations)
31 : FuzzerPass(ir_context, transformation_context, fuzzer_context,
32 transformations, ignore_inapplicable_transformations) {}
33
Apply()34 void FuzzerPassAddCompositeExtract::Apply() {
35 std::vector<const protobufs::DataDescriptor*> composite_synonyms;
36 for (const auto* dd :
37 GetTransformationContext()->GetFactManager()->GetAllSynonyms()) {
38 // |dd| must describe a component of a composite.
39 if (!dd->index().empty()) {
40 composite_synonyms.push_back(dd);
41 }
42 }
43
44 AvailableInstructions available_composites(
45 GetIRContext(), [](opt::IRContext* ir_context, opt::Instruction* inst) {
46 return inst->type_id() && inst->result_id() &&
47 fuzzerutil::IsCompositeType(
48 ir_context->get_type_mgr()->GetType(inst->type_id()));
49 });
50
51 ForEachInstructionWithInstructionDescriptor(
52 [this, &available_composites, &composite_synonyms](
53 opt::Function* /*unused*/, opt::BasicBlock* /*unused*/,
54 opt::BasicBlock::iterator inst_it,
55 const protobufs::InstructionDescriptor& instruction_descriptor) {
56 if (!fuzzerutil::CanInsertOpcodeBeforeInstruction(
57 spv::Op::OpCompositeExtract, inst_it)) {
58 return;
59 }
60
61 if (!GetFuzzerContext()->ChoosePercentage(
62 GetFuzzerContext()->GetChanceOfAddingCompositeExtract())) {
63 return;
64 }
65
66 std::vector<const protobufs::DataDescriptor*> available_synonyms;
67 for (const auto* dd : composite_synonyms) {
68 if (fuzzerutil::IdIsAvailableBeforeInstruction(
69 GetIRContext(), &*inst_it, dd->object())) {
70 available_synonyms.push_back(dd);
71 }
72 }
73
74 auto candidate_composites =
75 available_composites.GetAvailableBeforeInstruction(&*inst_it);
76
77 if (available_synonyms.empty() && candidate_composites.empty()) {
78 return;
79 }
80
81 uint32_t composite_id = 0;
82 std::vector<uint32_t> indices;
83
84 if (available_synonyms.empty() || (!candidate_composites.empty() &&
85 GetFuzzerContext()->ChooseEven())) {
86 const auto* inst =
87 candidate_composites[GetFuzzerContext()->RandomIndex(
88 candidate_composites)];
89 composite_id = inst->result_id();
90
91 auto type_id = inst->type_id();
92 do {
93 uint32_t number_of_members = 0;
94
95 const auto* type_inst =
96 GetIRContext()->get_def_use_mgr()->GetDef(type_id);
97 assert(type_inst && "Composite instruction has invalid type id");
98
99 switch (type_inst->opcode()) {
100 case spv::Op::OpTypeArray:
101 number_of_members =
102 fuzzerutil::GetArraySize(*type_inst, GetIRContext());
103 break;
104 case spv::Op::OpTypeVector:
105 case spv::Op::OpTypeMatrix:
106 number_of_members = type_inst->GetSingleWordInOperand(1);
107 break;
108 case spv::Op::OpTypeStruct:
109 number_of_members = type_inst->NumInOperands();
110 break;
111 default:
112 assert(false && "|type_inst| is not a composite");
113 return;
114 }
115
116 if (number_of_members == 0) {
117 return;
118 }
119
120 indices.push_back(
121 GetFuzzerContext()->GetRandomCompositeExtractIndex(
122 number_of_members));
123
124 switch (type_inst->opcode()) {
125 case spv::Op::OpTypeArray:
126 case spv::Op::OpTypeVector:
127 case spv::Op::OpTypeMatrix:
128 type_id = type_inst->GetSingleWordInOperand(0);
129 break;
130 case spv::Op::OpTypeStruct:
131 type_id = type_inst->GetSingleWordInOperand(indices.back());
132 break;
133 default:
134 assert(false && "|type_inst| is not a composite");
135 return;
136 }
137 } while (fuzzerutil::IsCompositeType(
138 GetIRContext()->get_type_mgr()->GetType(type_id)) &&
139 GetFuzzerContext()->ChoosePercentage(
140 GetFuzzerContext()
141 ->GetChanceOfGoingDeeperToExtractComposite()));
142 } else {
143 const auto* dd = available_synonyms[GetFuzzerContext()->RandomIndex(
144 available_synonyms)];
145
146 composite_id = dd->object();
147 indices.assign(dd->index().begin(), dd->index().end());
148 }
149
150 assert(composite_id != 0 && !indices.empty() &&
151 "Composite object should have been chosen correctly");
152
153 ApplyTransformation(TransformationCompositeExtract(
154 instruction_descriptor, GetFuzzerContext()->GetFreshId(),
155 composite_id, indices));
156 });
157 }
158
159 } // namespace fuzz
160 } // namespace spvtools
161