1 // Copyright (c) 2020 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "source/fuzz/transformation_store.h"
16
17 #include "source/fuzz/fuzzer_util.h"
18 #include "source/fuzz/instruction_descriptor.h"
19
20 namespace spvtools {
21 namespace fuzz {
22
TransformationStore(const spvtools::fuzz::protobufs::TransformationStore & message)23 TransformationStore::TransformationStore(
24 const spvtools::fuzz::protobufs::TransformationStore& message)
25 : message_(message) {}
26
TransformationStore(uint32_t pointer_id,uint32_t value_id,const protobufs::InstructionDescriptor & instruction_to_insert_before)27 TransformationStore::TransformationStore(
28 uint32_t pointer_id, uint32_t value_id,
29 const protobufs::InstructionDescriptor& instruction_to_insert_before) {
30 message_.set_pointer_id(pointer_id);
31 message_.set_value_id(value_id);
32 *message_.mutable_instruction_to_insert_before() =
33 instruction_to_insert_before;
34 }
35
IsApplicable(opt::IRContext * context,const spvtools::fuzz::FactManager & fact_manager) const36 bool TransformationStore::IsApplicable(
37 opt::IRContext* context,
38 const spvtools::fuzz::FactManager& fact_manager) const {
39 // The pointer must exist and have a type.
40 auto pointer = context->get_def_use_mgr()->GetDef(message_.pointer_id());
41 if (!pointer || !pointer->type_id()) {
42 return false;
43 }
44
45 // The pointer type must indeed be a pointer.
46 auto pointer_type = context->get_def_use_mgr()->GetDef(pointer->type_id());
47 assert(pointer_type && "Type id must be defined.");
48 if (pointer_type->opcode() != SpvOpTypePointer) {
49 return false;
50 }
51
52 // The pointer must not be read only.
53 if (pointer_type->GetSingleWordInOperand(0) == SpvStorageClassInput) {
54 return false;
55 }
56
57 // We do not want to allow storing to null or undefined pointers.
58 switch (pointer->opcode()) {
59 case SpvOpConstantNull:
60 case SpvOpUndef:
61 return false;
62 default:
63 break;
64 }
65
66 // Determine which instruction we should be inserting before.
67 auto insert_before =
68 FindInstruction(message_.instruction_to_insert_before(), context);
69 // It must exist, ...
70 if (!insert_before) {
71 return false;
72 }
73 // ... and it must be legitimate to insert a store before it.
74 if (!fuzzerutil::CanInsertOpcodeBeforeInstruction(SpvOpStore,
75 insert_before)) {
76 return false;
77 }
78
79 // The block we are inserting into needs to be dead, or else the pointee type
80 // of the pointer we are storing to needs to be irrelevant (otherwise the
81 // store could impact on the observable behaviour of the module).
82 if (!fact_manager.BlockIsDead(
83 context->get_instr_block(insert_before)->id()) &&
84 !fact_manager.PointeeValueIsIrrelevant(message_.pointer_id())) {
85 return false;
86 }
87
88 // The value being stored needs to exist and have a type.
89 auto value = context->get_def_use_mgr()->GetDef(message_.value_id());
90 if (!value || !value->type_id()) {
91 return false;
92 }
93
94 // The type of the value must match the pointee type.
95 if (pointer_type->GetSingleWordInOperand(1) != value->type_id()) {
96 return false;
97 }
98
99 // The pointer needs to be available at the insertion point.
100 if (!fuzzerutil::IdIsAvailableBeforeInstruction(context, insert_before,
101 message_.pointer_id())) {
102 return false;
103 }
104
105 // The value needs to be available at the insertion point.
106 return fuzzerutil::IdIsAvailableBeforeInstruction(context, insert_before,
107 message_.value_id());
108 }
109
Apply(opt::IRContext * context,spvtools::fuzz::FactManager *) const110 void TransformationStore::Apply(opt::IRContext* context,
111 spvtools::fuzz::FactManager* /*unused*/) const {
112 FindInstruction(message_.instruction_to_insert_before(), context)
113 ->InsertBefore(MakeUnique<opt::Instruction>(
114 context, SpvOpStore, 0, 0,
115 opt::Instruction::OperandList(
116 {{SPV_OPERAND_TYPE_ID, {message_.pointer_id()}},
117 {SPV_OPERAND_TYPE_ID, {message_.value_id()}}})));
118 context->InvalidateAnalysesExceptFor(opt::IRContext::kAnalysisNone);
119 }
120
ToMessage() const121 protobufs::Transformation TransformationStore::ToMessage() const {
122 protobufs::Transformation result;
123 *result.mutable_store() = message_;
124 return result;
125 }
126
127 } // namespace fuzz
128 } // namespace spvtools
129