summaryrefslogtreecommitdiffstatshomepage
path: root/3rdparty/bgfx/3rdparty/spirv-tools/source/fuzz/fuzzer_pass_copy_objects.cpp
diff options
context:
space:
mode:
Diffstat (limited to '3rdparty/bgfx/3rdparty/spirv-tools/source/fuzz/fuzzer_pass_copy_objects.cpp')
-rw-r--r--3rdparty/bgfx/3rdparty/spirv-tools/source/fuzz/fuzzer_pass_copy_objects.cpp134
1 files changed, 33 insertions, 101 deletions
diff --git a/3rdparty/bgfx/3rdparty/spirv-tools/source/fuzz/fuzzer_pass_copy_objects.cpp b/3rdparty/bgfx/3rdparty/spirv-tools/source/fuzz/fuzzer_pass_copy_objects.cpp
index a1b118a886b..35b15a38a32 100644
--- a/3rdparty/bgfx/3rdparty/spirv-tools/source/fuzz/fuzzer_pass_copy_objects.cpp
+++ b/3rdparty/bgfx/3rdparty/spirv-tools/source/fuzz/fuzzer_pass_copy_objects.cpp
@@ -14,6 +14,7 @@
#include "source/fuzz/fuzzer_pass_copy_objects.h"
+#include "source/fuzz/fuzzer_util.h"
#include "source/fuzz/transformation_copy_object.h"
namespace spvtools {
@@ -28,120 +29,51 @@ FuzzerPassCopyObjects::FuzzerPassCopyObjects(
FuzzerPassCopyObjects::~FuzzerPassCopyObjects() = default;
void FuzzerPassCopyObjects::Apply() {
- // Consider every block in every function.
- for (auto& function : *GetIRContext()->module()) {
- for (auto& block : function) {
- // We now consider every instruction in the block, randomly deciding
- // whether to add an object copy before the instruction.
-
- // In order to insert an object copy instruction, we need to be able to
- // identify the instruction a copy should be inserted before. We do this
- // by tracking a base instruction, which must generate a result id, and an
- // offset (to allow us to identify instructions that do not generate
- // result ids).
-
- // The initial base instruction is the block label.
- uint32_t base = block.id();
- uint32_t offset = 0;
- // Consider every instruction in the block.
- for (auto inst_it = block.begin(); inst_it != block.end(); ++inst_it) {
- if (inst_it->HasResultId()) {
- // In the case that the instruction has a result id, we use the
- // instruction as its own base, with zero offset.
- base = inst_it->result_id();
- offset = 0;
- } else {
- // The instruction does not have a result id, so we need to identify
- // it via the latest instruction that did have a result id (base), and
- // an incremented offset.
- offset++;
- }
+ MaybeAddTransformationBeforeEachInstruction(
+ [this](const opt::Function& function, opt::BasicBlock* block,
+ opt::BasicBlock::iterator inst_it,
+ const protobufs::InstructionDescriptor& instruction_descriptor)
+ -> void {
+ assert(inst_it->opcode() ==
+ instruction_descriptor.target_instruction_opcode() &&
+ "The opcode of the instruction we might insert before must be "
+ "the same as the opcode in the descriptor for the instruction");
// Check whether it is legitimate to insert a copy before this
// instruction.
- if (!TransformationCopyObject::CanInsertCopyBefore(inst_it)) {
- continue;
+ if (!fuzzerutil::CanInsertOpcodeBeforeInstruction(SpvOpCopyObject,
+ inst_it)) {
+ return;
}
// Randomly decide whether to try inserting an object copy here.
if (!GetFuzzerContext()->ChoosePercentage(
GetFuzzerContext()->GetChanceOfCopyingObject())) {
- continue;
- }
-
- // Populate list of potential instructions that can be copied.
- // TODO(afd) The following is (relatively) simple, but may end up being
- // prohibitively inefficient, as it walks the whole dominator tree for
- // every copy that is added.
- std::vector<opt::Instruction*> copyable_instructions;
-
- // Consider all global declarations
- for (auto& global : GetIRContext()->module()->types_values()) {
- if (TransformationCopyObject::IsCopyable(GetIRContext(), &global)) {
- copyable_instructions.push_back(&global);
- }
+ return;
}
- // Consider all previous instructions in this block
- for (auto prev_inst_it = block.begin(); prev_inst_it != inst_it;
- ++prev_inst_it) {
- if (TransformationCopyObject::IsCopyable(GetIRContext(),
- &*prev_inst_it)) {
- copyable_instructions.push_back(&*prev_inst_it);
- }
- }
-
- // Walk the dominator tree to consider all instructions from dominating
- // blocks
- auto dominator_analysis =
- GetIRContext()->GetDominatorAnalysis(&function);
- for (auto next_dominator =
- dominator_analysis->ImmediateDominator(&block);
- next_dominator != nullptr;
- next_dominator =
- dominator_analysis->ImmediateDominator(next_dominator)) {
- for (auto& dominating_inst : *next_dominator) {
- if (TransformationCopyObject::IsCopyable(GetIRContext(),
- &dominating_inst)) {
- copyable_instructions.push_back(&dominating_inst);
- }
- }
- }
+ std::vector<opt::Instruction*> relevant_instructions =
+ FindAvailableInstructions(function, block, inst_it,
+ fuzzerutil::CanMakeSynonymOf);
- // At this point, |copyable_instructions| contains all the instructions
+ // At this point, |relevant_instructions| contains all the instructions
// we might think of copying.
-
- if (!copyable_instructions.empty()) {
- // Choose a copyable instruction at random, and create and apply an
- // object copying transformation based on it.
- uint32_t index =
- GetFuzzerContext()->RandomIndex(copyable_instructions);
- TransformationCopyObject transformation(
- copyable_instructions[index]->result_id(), base, offset,
- GetFuzzerContext()->GetFreshId());
- assert(
- transformation.IsApplicable(GetIRContext(), *GetFactManager()) &&
- "This transformation should be applicable by construction.");
- transformation.Apply(GetIRContext(), GetFactManager());
- *GetTransformations()->add_transformation() =
- transformation.ToMessage();
-
- if (!inst_it->HasResultId()) {
- // We have inserted a new instruction before the current
- // instruction, and we are tracking the current id-less instruction
- // via an offset (offset) from a previous instruction (base) that
- // has an id. We increment |offset| to reflect the newly-inserted
- // instruction.
- //
- // This is slightly preferable to the alternative of setting |base|
- // to be the result id of the new instruction, since on replay we
- // might end up eliminating this copy but keeping a subsequent copy.
- offset++;
- }
+ if (relevant_instructions.empty()) {
+ return;
}
- }
- }
- }
+
+ // Choose a copyable instruction at random, and create and apply an
+ // object copying transformation based on it.
+ uint32_t index = GetFuzzerContext()->RandomIndex(relevant_instructions);
+ TransformationCopyObject transformation(
+ relevant_instructions[index]->result_id(), instruction_descriptor,
+ GetFuzzerContext()->GetFreshId());
+ assert(transformation.IsApplicable(GetIRContext(), *GetFactManager()) &&
+ "This transformation should be applicable by construction.");
+ transformation.Apply(GetIRContext(), GetFactManager());
+ *GetTransformations()->add_transformation() =
+ transformation.ToMessage();
+ });
}
} // namespace fuzz