spirv-fuzz: Ignore specialization constants (#3664)
`FuzzerPassInterchangeSignednessOfIntegerOperands` and `FuzzerPassInterchangeZeroLikeConstants` both included specialization constants when trying to find integer constants with known values. However, this is incorrect behavior because we do not know the value of specialization constants. Furthermore, ConstantManager does not support them, and this led to crashes where we assumed we could look up specialization constants via the ConstantManager.
This change fixes both passes to ignore specialization constants.
Fixes #3663.
diff --git a/source/fuzz/fuzzer_pass_interchange_signedness_of_integer_operands.cpp b/source/fuzz/fuzzer_pass_interchange_signedness_of_integer_operands.cpp
index 6c3aa7b..0e40b49 100644
--- a/source/fuzz/fuzzer_pass_interchange_signedness_of_integer_operands.cpp
+++ b/source/fuzz/fuzzer_pass_interchange_signedness_of_integer_operands.cpp
@@ -91,6 +91,13 @@
uint32_t FuzzerPassInterchangeSignednessOfIntegerOperands::
FindOrCreateToggledIntegerConstant(uint32_t id) {
+ // |id| must not be a specialization constant because we do not know the value
+ // of specialization constants.
+ if (opt::IsSpecConstantInst(
+ GetIRContext()->get_def_use_mgr()->GetDef(id)->opcode())) {
+ return 0;
+ }
+
auto constant = GetIRContext()->get_constant_mgr()->FindDeclaredConstant(id);
// This pass only toggles integer constants.
diff --git a/source/fuzz/fuzzer_pass_interchange_zero_like_constants.cpp b/source/fuzz/fuzzer_pass_interchange_zero_like_constants.cpp
index 8bd670f..20575e1 100644
--- a/source/fuzz/fuzzer_pass_interchange_zero_like_constants.cpp
+++ b/source/fuzz/fuzzer_pass_interchange_zero_like_constants.cpp
@@ -34,6 +34,12 @@
uint32_t FuzzerPassInterchangeZeroLikeConstants::FindOrCreateToggledConstant(
opt::Instruction* declaration) {
+ // |declaration| must not be a specialization constant because we do not know
+ // the value of specialization constants.
+ if (opt::IsSpecConstantInst(declaration->opcode())) {
+ return 0;
+ }
+
auto constant = GetIRContext()->get_constant_mgr()->FindDeclaredConstant(
declaration->result_id());
@@ -107,4 +113,4 @@
}
}
} // namespace fuzz
-} // namespace spvtools
\ No newline at end of file
+} // namespace spvtools
