fuzzer_pass_adjust_loop_controls.cpp 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119
  1. // Copyright (c) 2019 Google LLC
  2. //
  3. // Licensed under the Apache License, Version 2.0 (the "License");
  4. // you may not use this file except in compliance with the License.
  5. // You may obtain a copy of the License at
  6. //
  7. // http://www.apache.org/licenses/LICENSE-2.0
  8. //
  9. // Unless required by applicable law or agreed to in writing, software
  10. // distributed under the License is distributed on an "AS IS" BASIS,
  11. // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12. // See the License for the specific language governing permissions and
  13. // limitations under the License.
  14. #include "source/fuzz/fuzzer_pass_adjust_loop_controls.h"
  15. #include "source/fuzz/transformation_set_loop_control.h"
  16. namespace spvtools {
  17. namespace fuzz {
  18. FuzzerPassAdjustLoopControls::FuzzerPassAdjustLoopControls(
  19. opt::IRContext* ir_context, TransformationContext* transformation_context,
  20. FuzzerContext* fuzzer_context,
  21. protobufs::TransformationSequence* transformations,
  22. bool ignore_inapplicable_transformations)
  23. : FuzzerPass(ir_context, transformation_context, fuzzer_context,
  24. transformations, ignore_inapplicable_transformations) {}
  25. void FuzzerPassAdjustLoopControls::Apply() {
  26. // Consider every merge instruction in the module (via looking through all
  27. // functions and blocks).
  28. for (auto& function : *GetIRContext()->module()) {
  29. for (auto& block : function) {
  30. if (auto merge_inst = block.GetMergeInst()) {
  31. // Ignore the instruction if it is not a loop merge.
  32. if (merge_inst->opcode() != spv::Op::OpLoopMerge) {
  33. continue;
  34. }
  35. // Decide randomly whether to adjust this loop merge.
  36. if (!GetFuzzerContext()->ChoosePercentage(
  37. GetFuzzerContext()->GetChanceOfAdjustingLoopControl())) {
  38. continue;
  39. }
  40. uint32_t existing_mask = merge_inst->GetSingleWordOperand(
  41. TransformationSetLoopControl::kLoopControlMaskInOperandIndex);
  42. // First, set the new mask to one of None, Unroll or DontUnroll.
  43. std::vector<uint32_t> basic_masks = {
  44. uint32_t(spv::LoopControlMask::MaskNone),
  45. uint32_t(spv::LoopControlMask::Unroll),
  46. uint32_t(spv::LoopControlMask::DontUnroll)};
  47. uint32_t new_mask =
  48. basic_masks[GetFuzzerContext()->RandomIndex(basic_masks)];
  49. // For the loop controls that depend on guarantees about what the loop
  50. // does, check which of these were present in the existing mask and
  51. // randomly decide whether to keep them. They are just hints, so
  52. // removing them should not change the semantics of the module.
  53. for (auto mask_bit : {spv::LoopControlMask::DependencyInfinite,
  54. spv::LoopControlMask::DependencyLength,
  55. spv::LoopControlMask::MinIterations,
  56. spv::LoopControlMask::MaxIterations,
  57. spv::LoopControlMask::IterationMultiple}) {
  58. if ((existing_mask & uint32_t(mask_bit)) &&
  59. GetFuzzerContext()->ChooseEven()) {
  60. // The mask bits we are considering are not available in all SPIR-V
  61. // versions. However, we only include a mask bit if it was present
  62. // in the original loop control mask, and we work under the
  63. // assumption that we are transforming a valid module, thus we don't
  64. // need to actually check whether the SPIR-V version being used
  65. // supports these loop control mask bits.
  66. new_mask |= uint32_t(mask_bit);
  67. }
  68. }
  69. // We use 0 for peel count and partial count in the case that we choose
  70. // not to set these controls.
  71. uint32_t peel_count = 0;
  72. uint32_t partial_count = 0;
  73. // PeelCount and PartialCount are not compatible with DontUnroll, so
  74. // we check whether DontUnroll is set.
  75. if (!(new_mask & uint32_t(spv::LoopControlMask::DontUnroll))) {
  76. // If PeelCount is supported by this SPIR-V version, randomly choose
  77. // whether to set it. If it was set in the original mask and is not
  78. // selected for setting here, that amounts to dropping it.
  79. if (TransformationSetLoopControl::PeelCountIsSupported(
  80. GetIRContext()) &&
  81. GetFuzzerContext()->ChooseEven()) {
  82. new_mask |= uint32_t(spv::LoopControlMask::PeelCount);
  83. // The peel count is chosen randomly - if PeelCount was already set
  84. // this will overwrite whatever peel count was previously used.
  85. peel_count = GetFuzzerContext()->GetRandomLoopControlPeelCount();
  86. }
  87. // Similar, but for PartialCount.
  88. if (TransformationSetLoopControl::PartialCountIsSupported(
  89. GetIRContext()) &&
  90. GetFuzzerContext()->ChooseEven()) {
  91. new_mask |= uint32_t(spv::LoopControlMask::PartialCount);
  92. partial_count =
  93. GetFuzzerContext()->GetRandomLoopControlPartialCount();
  94. }
  95. }
  96. // Apply the transformation and add it to the output transformation
  97. // sequence.
  98. TransformationSetLoopControl transformation(block.id(), new_mask,
  99. peel_count, partial_count);
  100. ApplyTransformation(transformation);
  101. }
  102. }
  103. }
  104. }
  105. } // namespace fuzz
  106. } // namespace spvtools