blob: 516a0d616487a2b415e4da926917c9bfb1d0bf67 [file] [log] [blame] [edit]
// Copyright (c) 2020 Vasyl Teliman
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#include "source/fuzz/transformation_mutate_pointer.h"
#include "source/fuzz/fuzzer_util.h"
#include "source/fuzz/instruction_descriptor.h"
namespace spvtools {
namespace fuzz {
TransformationMutatePointer::TransformationMutatePointer(
protobufs::TransformationMutatePointer message)
: message_(std::move(message)) {}
TransformationMutatePointer::TransformationMutatePointer(
uint32_t pointer_id, uint32_t fresh_id,
const protobufs::InstructionDescriptor& insert_before) {
message_.set_pointer_id(pointer_id);
message_.set_fresh_id(fresh_id);
*message_.mutable_insert_before() = insert_before;
}
bool TransformationMutatePointer::IsApplicable(
opt::IRContext* ir_context,
const TransformationContext& transformation_context) const {
// Check that |fresh_id| is fresh.
if (!fuzzerutil::IsFreshId(ir_context, message_.fresh_id())) {
return false;
}
auto* insert_before_inst =
FindInstruction(message_.insert_before(), ir_context);
// Check that |insert_before| is a valid instruction descriptor.
if (!insert_before_inst) {
return false;
}
// Check that it is possible to insert OpLoad and OpStore before
// |insert_before_inst|. We are only using OpLoad here since the result does
// not depend on the opcode.
if (!fuzzerutil::CanInsertOpcodeBeforeInstruction(SpvOpLoad,
insert_before_inst)) {
return false;
}
const auto* pointer_inst =
ir_context->get_def_use_mgr()->GetDef(message_.pointer_id());
// Check that |pointer_id| is a result id of a valid pointer instruction.
if (!pointer_inst || !IsValidPointerInstruction(ir_context, *pointer_inst)) {
return false;
}
// Check that the module contains an irrelevant constant that will be used to
// mutate |pointer_inst|. The constant is irrelevant so that the latter
// transformation can change its value to something more interesting.
auto constant_id = fuzzerutil::MaybeGetZeroConstant(
ir_context, transformation_context,
fuzzerutil::GetPointeeTypeIdFromPointerType(ir_context,
pointer_inst->type_id()),
true);
if (!constant_id) {
return false;
}
assert(fuzzerutil::IdIsAvailableBeforeInstruction(
ir_context, insert_before_inst, constant_id) &&
"Global constant instruction is not available before "
"|insert_before_inst|");
// Check that |pointer_inst| is available before |insert_before_inst|.
return fuzzerutil::IdIsAvailableBeforeInstruction(
ir_context, insert_before_inst, pointer_inst->result_id());
}
void TransformationMutatePointer::Apply(
opt::IRContext* ir_context,
TransformationContext* transformation_context) const {
auto* insert_before_inst =
FindInstruction(message_.insert_before(), ir_context);
assert(insert_before_inst && "|insert_before| descriptor is invalid");
opt::BasicBlock* enclosing_block =
ir_context->get_instr_block(insert_before_inst);
auto pointee_type_id = fuzzerutil::GetPointeeTypeIdFromPointerType(
ir_context, fuzzerutil::GetTypeId(ir_context, message_.pointer_id()));
// Back up the original value.
auto backup_instruction = MakeUnique<opt::Instruction>(
ir_context, SpvOpLoad, pointee_type_id, message_.fresh_id(),
opt::Instruction::OperandList{
{SPV_OPERAND_TYPE_ID, {message_.pointer_id()}}});
auto backup_instruction_ptr = backup_instruction.get();
insert_before_inst->InsertBefore(std::move(backup_instruction));
ir_context->get_def_use_mgr()->AnalyzeInstDefUse(backup_instruction_ptr);
ir_context->set_instr_block(backup_instruction_ptr, enclosing_block);
// Insert a new value.
auto new_value_instruction = MakeUnique<opt::Instruction>(
ir_context, SpvOpStore, 0, 0,
opt::Instruction::OperandList{
{SPV_OPERAND_TYPE_ID, {message_.pointer_id()}},
{SPV_OPERAND_TYPE_ID,
{fuzzerutil::MaybeGetZeroConstant(
ir_context, *transformation_context, pointee_type_id, true)}}});
auto new_value_instruction_ptr = new_value_instruction.get();
insert_before_inst->InsertBefore(std::move(new_value_instruction));
ir_context->get_def_use_mgr()->AnalyzeInstDefUse(new_value_instruction_ptr);
ir_context->set_instr_block(new_value_instruction_ptr, enclosing_block);
// Restore the original value.
auto restore_instruction = MakeUnique<opt::Instruction>(
ir_context, SpvOpStore, 0, 0,
opt::Instruction::OperandList{
{SPV_OPERAND_TYPE_ID, {message_.pointer_id()}},
{SPV_OPERAND_TYPE_ID, {message_.fresh_id()}}});
auto restore_instruction_ptr = restore_instruction.get();
insert_before_inst->InsertBefore(std::move(restore_instruction));
ir_context->get_def_use_mgr()->AnalyzeInstDefUse(restore_instruction_ptr);
ir_context->set_instr_block(restore_instruction_ptr, enclosing_block);
fuzzerutil::UpdateModuleIdBound(ir_context, message_.fresh_id());
}
protobufs::Transformation TransformationMutatePointer::ToMessage() const {
protobufs::Transformation result;
*result.mutable_mutate_pointer() = message_;
return result;
}
bool TransformationMutatePointer::IsValidPointerInstruction(
opt::IRContext* ir_context, const opt::Instruction& inst) {
// |inst| must have both result id and type id and it may not cause undefined
// behaviour.
if (!inst.result_id() || !inst.type_id() || inst.opcode() == SpvOpUndef ||
inst.opcode() == SpvOpConstantNull) {
return false;
}
opt::Instruction* type_inst =
ir_context->get_def_use_mgr()->GetDef(inst.type_id());
assert(type_inst != nullptr && "|inst| has invalid type id");
// |inst| must be a pointer.
if (type_inst->opcode() != SpvOpTypePointer) {
return false;
}
// |inst| must have a supported storage class.
switch (static_cast<SpvStorageClass>(type_inst->GetSingleWordInOperand(0))) {
case SpvStorageClassFunction:
case SpvStorageClassPrivate:
case SpvStorageClassWorkgroup:
break;
default:
return false;
}
// |inst|'s pointee must consist of scalars and/or composites.
return fuzzerutil::CanCreateConstant(ir_context,
type_inst->GetSingleWordInOperand(1));
}
std::unordered_set<uint32_t> TransformationMutatePointer::GetFreshIds() const {
return {message_.fresh_id()};
}
} // namespace fuzz
} // namespace spvtools