1 // Copyright (c) 2020 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "source/fuzz/transformation_load.h"
16
17 #include "source/fuzz/fuzzer_util.h"
18 #include "source/fuzz/instruction_descriptor.h"
19
20 namespace spvtools {
21 namespace fuzz {
22
TransformationLoad(const spvtools::fuzz::protobufs::TransformationLoad & message)23 TransformationLoad::TransformationLoad(
24 const spvtools::fuzz::protobufs::TransformationLoad& message)
25 : message_(message) {}
26
TransformationLoad(uint32_t fresh_id,uint32_t pointer_id,const protobufs::InstructionDescriptor & instruction_to_insert_before)27 TransformationLoad::TransformationLoad(
28 uint32_t fresh_id, uint32_t pointer_id,
29 const protobufs::InstructionDescriptor& instruction_to_insert_before) {
30 message_.set_fresh_id(fresh_id);
31 message_.set_pointer_id(pointer_id);
32 *message_.mutable_instruction_to_insert_before() =
33 instruction_to_insert_before;
34 }
35
IsApplicable(opt::IRContext * ir_context,const TransformationContext &) const36 bool TransformationLoad::IsApplicable(
37 opt::IRContext* ir_context, const TransformationContext& /*unused*/) const {
38 // The result id must be fresh.
39 if (!fuzzerutil::IsFreshId(ir_context, message_.fresh_id())) {
40 return false;
41 }
42
43 // The pointer must exist and have a type.
44 auto pointer = ir_context->get_def_use_mgr()->GetDef(message_.pointer_id());
45 if (!pointer || !pointer->type_id()) {
46 return false;
47 }
48 // The type must indeed be a pointer type.
49 auto pointer_type = ir_context->get_def_use_mgr()->GetDef(pointer->type_id());
50 assert(pointer_type && "Type id must be defined.");
51 if (pointer_type->opcode() != SpvOpTypePointer) {
52 return false;
53 }
54 // We do not want to allow loading from null or undefined pointers, as it is
55 // not clear how punishing the consequences of doing so are from a semantics
56 // point of view.
57 switch (pointer->opcode()) {
58 case SpvOpConstantNull:
59 case SpvOpUndef:
60 return false;
61 default:
62 break;
63 }
64
65 // Determine which instruction we should be inserting before.
66 auto insert_before =
67 FindInstruction(message_.instruction_to_insert_before(), ir_context);
68 // It must exist, ...
69 if (!insert_before) {
70 return false;
71 }
72 // ... and it must be legitimate to insert a store before it.
73 if (!fuzzerutil::CanInsertOpcodeBeforeInstruction(SpvOpLoad, insert_before)) {
74 return false;
75 }
76
77 // The pointer needs to be available at the insertion point.
78 return fuzzerutil::IdIsAvailableBeforeInstruction(ir_context, insert_before,
79 message_.pointer_id());
80 }
81
Apply(opt::IRContext * ir_context,TransformationContext *) const82 void TransformationLoad::Apply(opt::IRContext* ir_context,
83 TransformationContext* /*unused*/) const {
84 uint32_t result_type = fuzzerutil::GetPointeeTypeIdFromPointerType(
85 ir_context, fuzzerutil::GetTypeId(ir_context, message_.pointer_id()));
86 fuzzerutil::UpdateModuleIdBound(ir_context, message_.fresh_id());
87 FindInstruction(message_.instruction_to_insert_before(), ir_context)
88 ->InsertBefore(MakeUnique<opt::Instruction>(
89 ir_context, SpvOpLoad, result_type, message_.fresh_id(),
90 opt::Instruction::OperandList(
91 {{SPV_OPERAND_TYPE_ID, {message_.pointer_id()}}})));
92 ir_context->InvalidateAnalysesExceptFor(opt::IRContext::kAnalysisNone);
93 }
94
ToMessage() const95 protobufs::Transformation TransformationLoad::ToMessage() const {
96 protobufs::Transformation result;
97 *result.mutable_load() = message_;
98 return result;
99 }
100
101 } // namespace fuzz
102 } // namespace spvtools
103