1 // Copyright (c) 2019 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "source/fuzz/fuzzer_pass_adjust_loop_controls.h"
16
17 #include "source/fuzz/transformation_set_loop_control.h"
18
19 namespace spvtools {
20 namespace fuzz {
21
FuzzerPassAdjustLoopControls(opt::IRContext * ir_context,TransformationContext * transformation_context,FuzzerContext * fuzzer_context,protobufs::TransformationSequence * transformations,bool ignore_inapplicable_transformations)22 FuzzerPassAdjustLoopControls::FuzzerPassAdjustLoopControls(
23 opt::IRContext* ir_context, TransformationContext* transformation_context,
24 FuzzerContext* fuzzer_context,
25 protobufs::TransformationSequence* transformations,
26 bool ignore_inapplicable_transformations)
27 : FuzzerPass(ir_context, transformation_context, fuzzer_context,
28 transformations, ignore_inapplicable_transformations) {}
29
Apply()30 void FuzzerPassAdjustLoopControls::Apply() {
31 // Consider every merge instruction in the module (via looking through all
32 // functions and blocks).
33 for (auto& function : *GetIRContext()->module()) {
34 for (auto& block : function) {
35 if (auto merge_inst = block.GetMergeInst()) {
36 // Ignore the instruction if it is not a loop merge.
37 if (merge_inst->opcode() != spv::Op::OpLoopMerge) {
38 continue;
39 }
40
41 // Decide randomly whether to adjust this loop merge.
42 if (!GetFuzzerContext()->ChoosePercentage(
43 GetFuzzerContext()->GetChanceOfAdjustingLoopControl())) {
44 continue;
45 }
46
47 uint32_t existing_mask = merge_inst->GetSingleWordOperand(
48 TransformationSetLoopControl::kLoopControlMaskInOperandIndex);
49
50 // First, set the new mask to one of None, Unroll or DontUnroll.
51 std::vector<uint32_t> basic_masks = {
52 uint32_t(spv::LoopControlMask::MaskNone),
53 uint32_t(spv::LoopControlMask::Unroll),
54 uint32_t(spv::LoopControlMask::DontUnroll)};
55 uint32_t new_mask =
56 basic_masks[GetFuzzerContext()->RandomIndex(basic_masks)];
57
58 // For the loop controls that depend on guarantees about what the loop
59 // does, check which of these were present in the existing mask and
60 // randomly decide whether to keep them. They are just hints, so
61 // removing them should not change the semantics of the module.
62 for (auto mask_bit : {spv::LoopControlMask::DependencyInfinite,
63 spv::LoopControlMask::DependencyLength,
64 spv::LoopControlMask::MinIterations,
65 spv::LoopControlMask::MaxIterations,
66 spv::LoopControlMask::IterationMultiple}) {
67 if ((existing_mask & uint32_t(mask_bit)) &&
68 GetFuzzerContext()->ChooseEven()) {
69 // The mask bits we are considering are not available in all SPIR-V
70 // versions. However, we only include a mask bit if it was present
71 // in the original loop control mask, and we work under the
72 // assumption that we are transforming a valid module, thus we don't
73 // need to actually check whether the SPIR-V version being used
74 // supports these loop control mask bits.
75 new_mask |= uint32_t(mask_bit);
76 }
77 }
78
79 // We use 0 for peel count and partial count in the case that we choose
80 // not to set these controls.
81 uint32_t peel_count = 0;
82 uint32_t partial_count = 0;
83
84 // PeelCount and PartialCount are not compatible with DontUnroll, so
85 // we check whether DontUnroll is set.
86 if (!(new_mask & uint32_t(spv::LoopControlMask::DontUnroll))) {
87 // If PeelCount is supported by this SPIR-V version, randomly choose
88 // whether to set it. If it was set in the original mask and is not
89 // selected for setting here, that amounts to dropping it.
90 if (TransformationSetLoopControl::PeelCountIsSupported(
91 GetIRContext()) &&
92 GetFuzzerContext()->ChooseEven()) {
93 new_mask |= uint32_t(spv::LoopControlMask::PeelCount);
94 // The peel count is chosen randomly - if PeelCount was already set
95 // this will overwrite whatever peel count was previously used.
96 peel_count = GetFuzzerContext()->GetRandomLoopControlPeelCount();
97 }
98 // Similar, but for PartialCount.
99 if (TransformationSetLoopControl::PartialCountIsSupported(
100 GetIRContext()) &&
101 GetFuzzerContext()->ChooseEven()) {
102 new_mask |= uint32_t(spv::LoopControlMask::PartialCount);
103 partial_count =
104 GetFuzzerContext()->GetRandomLoopControlPartialCount();
105 }
106 }
107
108 // Apply the transformation and add it to the output transformation
109 // sequence.
110 TransformationSetLoopControl transformation(block.id(), new_mask,
111 peel_count, partial_count);
112 ApplyTransformation(transformation);
113 }
114 }
115 }
116 }
117
118 } // namespace fuzz
119 } // namespace spvtools
120