1 // Copyright (c) 2020 André Perez Maselco
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "source/fuzz/fuzzer_pass_push_ids_through_variables.h"
16
17 #include "source/fuzz/fuzzer_util.h"
18 #include "source/fuzz/instruction_descriptor.h"
19 #include "source/fuzz/transformation_push_id_through_variable.h"
20
21 namespace spvtools {
22 namespace fuzz {
23
FuzzerPassPushIdsThroughVariables(opt::IRContext * ir_context,TransformationContext * transformation_context,FuzzerContext * fuzzer_context,protobufs::TransformationSequence * transformations,bool ignore_inapplicable_transformations)24 FuzzerPassPushIdsThroughVariables::FuzzerPassPushIdsThroughVariables(
25 opt::IRContext* ir_context, TransformationContext* transformation_context,
26 FuzzerContext* fuzzer_context,
27 protobufs::TransformationSequence* transformations,
28 bool ignore_inapplicable_transformations)
29 : FuzzerPass(ir_context, transformation_context, fuzzer_context,
30 transformations, ignore_inapplicable_transformations) {}
31
Apply()32 void FuzzerPassPushIdsThroughVariables::Apply() {
33 ForEachInstructionWithInstructionDescriptor(
34 [this](opt::Function* function, opt::BasicBlock* block,
35 opt::BasicBlock::iterator instruction_iterator,
36 const protobufs::InstructionDescriptor& instruction_descriptor)
37 -> void {
38 assert(
39 instruction_iterator->opcode() ==
40 spv::Op(instruction_descriptor.target_instruction_opcode()) &&
41 "The opcode of the instruction we might insert before must be "
42 "the same as the opcode in the descriptor for the instruction");
43
44 // Randomly decide whether to try pushing an id through a variable.
45 if (!GetFuzzerContext()->ChoosePercentage(
46 GetFuzzerContext()->GetChanceOfPushingIdThroughVariable())) {
47 return;
48 }
49
50 // The block containing the instruction we are going to insert before
51 // must be reachable.
52 if (!GetIRContext()->IsReachable(*block)) {
53 return;
54 }
55
56 // It must be valid to insert OpStore and OpLoad instructions
57 // before the instruction to insert before.
58 if (!fuzzerutil::CanInsertOpcodeBeforeInstruction(
59 spv::Op::OpStore, instruction_iterator) ||
60 !fuzzerutil::CanInsertOpcodeBeforeInstruction(
61 spv::Op::OpLoad, instruction_iterator)) {
62 return;
63 }
64
65 // Randomly decides whether a global or local variable will be added.
66 auto variable_storage_class = GetFuzzerContext()->ChooseEven()
67 ? spv::StorageClass::Private
68 : spv::StorageClass::Function;
69
70 // Gets the available basic and pointer types.
71 auto basic_type_ids_and_pointers =
72 GetAvailableBasicTypesAndPointers(variable_storage_class);
73 auto& basic_types = basic_type_ids_and_pointers.first;
74
75 // There must be at least some basic types.
76 if (basic_types.empty()) {
77 return;
78 }
79
80 uint32_t basic_type_id =
81 basic_types[GetFuzzerContext()->RandomIndex(basic_types)];
82
83 // Looks for ids that we might wish to consider pushing through a
84 // variable.
85 std::vector<opt::Instruction*> value_instructions =
86 FindAvailableInstructions(
87 function, block, instruction_iterator,
88 [this, basic_type_id, instruction_descriptor](
89 opt::IRContext* ir_context,
90 opt::Instruction* instruction) -> bool {
91 if (!instruction->result_id() || !instruction->type_id()) {
92 return false;
93 }
94
95 if (instruction->type_id() != basic_type_id) {
96 return false;
97 }
98
99 // If the id is irrelevant, we can use it since it will not
100 // participate in DataSynonym fact. Otherwise, we should be
101 // able to produce a synonym out of the id.
102 if (!GetTransformationContext()
103 ->GetFactManager()
104 ->IdIsIrrelevant(instruction->result_id()) &&
105 !fuzzerutil::CanMakeSynonymOf(ir_context,
106 *GetTransformationContext(),
107 *instruction)) {
108 return false;
109 }
110
111 return fuzzerutil::IdIsAvailableBeforeInstruction(
112 ir_context,
113 FindInstruction(instruction_descriptor, ir_context),
114 instruction->result_id());
115 });
116
117 if (value_instructions.empty()) {
118 return;
119 }
120
121 // If the pointer type does not exist, then create it.
122 FindOrCreatePointerType(basic_type_id, variable_storage_class);
123
124 // TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/3403):
125 // type support here is limited by the FindOrCreateZeroConstant
126 // function.
127 const auto* type_inst =
128 GetIRContext()->get_def_use_mgr()->GetDef(basic_type_id);
129 assert(type_inst);
130 switch (type_inst->opcode()) {
131 case spv::Op::OpTypeBool:
132 case spv::Op::OpTypeFloat:
133 case spv::Op::OpTypeInt:
134 case spv::Op::OpTypeArray:
135 case spv::Op::OpTypeMatrix:
136 case spv::Op::OpTypeVector:
137 case spv::Op::OpTypeStruct:
138 break;
139 default:
140 return;
141 }
142
143 // Create a constant to initialize the variable from. This might update
144 // module's id bound so it must be done before any fresh ids are
145 // computed.
146 auto initializer_id = FindOrCreateZeroConstant(basic_type_id, false);
147
148 // Applies the push id through variable transformation.
149 ApplyTransformation(TransformationPushIdThroughVariable(
150 value_instructions[GetFuzzerContext()->RandomIndex(
151 value_instructions)]
152 ->result_id(),
153 GetFuzzerContext()->GetFreshId(), GetFuzzerContext()->GetFreshId(),
154 uint32_t(variable_storage_class), initializer_id,
155 instruction_descriptor));
156 });
157 }
158
159 } // namespace fuzz
160 } // namespace spvtools
161