fuzzer_util.cpp 77 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119
  1. // Copyright (c) 2019 Google LLC
  2. //
  3. // Licensed under the Apache License, Version 2.0 (the "License");
  4. // you may not use this file except in compliance with the License.
  5. // You may obtain a copy of the License at
  6. //
  7. // http://www.apache.org/licenses/LICENSE-2.0
  8. //
  9. // Unless required by applicable law or agreed to in writing, software
  10. // distributed under the License is distributed on an "AS IS" BASIS,
  11. // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12. // See the License for the specific language governing permissions and
  13. // limitations under the License.
  14. #include "source/fuzz/fuzzer_util.h"
  15. #include <algorithm>
  16. #include <unordered_set>
  17. #include "source/opt/build_module.h"
  18. namespace spvtools {
  19. namespace fuzz {
  20. namespace fuzzerutil {
  21. namespace {
  22. // A utility class that uses RAII to change and restore the terminator
  23. // instruction of the |block|.
  24. class ChangeTerminatorRAII {
  25. public:
  26. explicit ChangeTerminatorRAII(opt::BasicBlock* block,
  27. opt::Instruction new_terminator)
  28. : block_(block), old_terminator_(std::move(*block->terminator())) {
  29. *block_->terminator() = std::move(new_terminator);
  30. }
  31. ~ChangeTerminatorRAII() {
  32. *block_->terminator() = std::move(old_terminator_);
  33. }
  34. private:
  35. opt::BasicBlock* block_;
  36. opt::Instruction old_terminator_;
  37. };
  38. uint32_t MaybeGetOpConstant(opt::IRContext* ir_context,
  39. const TransformationContext& transformation_context,
  40. const std::vector<uint32_t>& words,
  41. uint32_t type_id, bool is_irrelevant) {
  42. for (const auto& inst : ir_context->types_values()) {
  43. if (inst.opcode() == spv::Op::OpConstant && inst.type_id() == type_id &&
  44. inst.GetInOperand(0).words == words &&
  45. transformation_context.GetFactManager()->IdIsIrrelevant(
  46. inst.result_id()) == is_irrelevant) {
  47. return inst.result_id();
  48. }
  49. }
  50. return 0;
  51. }
  52. } // namespace
  53. const spvtools::MessageConsumer kSilentMessageConsumer =
  54. [](spv_message_level_t, const char*, const spv_position_t&,
  55. const char*) -> void {};
  56. bool BuildIRContext(spv_target_env target_env,
  57. const spvtools::MessageConsumer& message_consumer,
  58. const std::vector<uint32_t>& binary_in,
  59. spv_validator_options validator_options,
  60. std::unique_ptr<spvtools::opt::IRContext>* ir_context) {
  61. SpirvTools tools(target_env);
  62. tools.SetMessageConsumer(message_consumer);
  63. if (!tools.IsValid()) {
  64. message_consumer(SPV_MSG_ERROR, nullptr, {},
  65. "Failed to create SPIRV-Tools interface; stopping.");
  66. return false;
  67. }
  68. // Initial binary should be valid.
  69. if (!tools.Validate(binary_in.data(), binary_in.size(), validator_options)) {
  70. message_consumer(SPV_MSG_ERROR, nullptr, {},
  71. "Initial binary is invalid; stopping.");
  72. return false;
  73. }
  74. // Build the module from the input binary.
  75. auto result = BuildModule(target_env, message_consumer, binary_in.data(),
  76. binary_in.size());
  77. assert(result && "IRContext must be valid");
  78. *ir_context = std::move(result);
  79. return true;
  80. }
  81. bool IsFreshId(opt::IRContext* context, uint32_t id) {
  82. return !context->get_def_use_mgr()->GetDef(id);
  83. }
  84. void UpdateModuleIdBound(opt::IRContext* context, uint32_t id) {
  85. // TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/2541) consider the
  86. // case where the maximum id bound is reached.
  87. context->module()->SetIdBound(
  88. std::max(context->module()->id_bound(), id + 1));
  89. }
  90. opt::BasicBlock* MaybeFindBlock(opt::IRContext* context,
  91. uint32_t maybe_block_id) {
  92. auto inst = context->get_def_use_mgr()->GetDef(maybe_block_id);
  93. if (inst == nullptr) {
  94. // No instruction defining this id was found.
  95. return nullptr;
  96. }
  97. if (inst->opcode() != spv::Op::OpLabel) {
  98. // The instruction defining the id is not a label, so it cannot be a block
  99. // id.
  100. return nullptr;
  101. }
  102. return context->cfg()->block(maybe_block_id);
  103. }
  104. bool PhiIdsOkForNewEdge(
  105. opt::IRContext* context, opt::BasicBlock* bb_from, opt::BasicBlock* bb_to,
  106. const google::protobuf::RepeatedField<google::protobuf::uint32>& phi_ids) {
  107. if (bb_from->IsSuccessor(bb_to)) {
  108. // There is already an edge from |from_block| to |to_block|, so there is
  109. // no need to extend OpPhi instructions. Do not allow phi ids to be
  110. // present. This might turn out to be too strict; perhaps it would be OK
  111. // just to ignore the ids in this case.
  112. return phi_ids.empty();
  113. }
  114. // The edge would add a previously non-existent edge from |from_block| to
  115. // |to_block|, so we go through the given phi ids and check that they exactly
  116. // match the OpPhi instructions in |to_block|.
  117. uint32_t phi_index = 0;
  118. // An explicit loop, rather than applying a lambda to each OpPhi in |bb_to|,
  119. // makes sense here because we need to increment |phi_index| for each OpPhi
  120. // instruction.
  121. for (auto& inst : *bb_to) {
  122. if (inst.opcode() != spv::Op::OpPhi) {
  123. // The OpPhi instructions all occur at the start of the block; if we find
  124. // a non-OpPhi then we have seen them all.
  125. break;
  126. }
  127. if (phi_index == static_cast<uint32_t>(phi_ids.size())) {
  128. // Not enough phi ids have been provided to account for the OpPhi
  129. // instructions.
  130. return false;
  131. }
  132. // Look for an instruction defining the next phi id.
  133. opt::Instruction* phi_extension =
  134. context->get_def_use_mgr()->GetDef(phi_ids[phi_index]);
  135. if (!phi_extension) {
  136. // The id given to extend this OpPhi does not exist.
  137. return false;
  138. }
  139. if (phi_extension->type_id() != inst.type_id()) {
  140. // The instruction given to extend this OpPhi either does not have a type
  141. // or its type does not match that of the OpPhi.
  142. return false;
  143. }
  144. if (context->get_instr_block(phi_extension)) {
  145. // The instruction defining the phi id has an associated block (i.e., it
  146. // is not a global value). Check whether its definition dominates the
  147. // exit of |from_block|.
  148. auto dominator_analysis =
  149. context->GetDominatorAnalysis(bb_from->GetParent());
  150. if (!dominator_analysis->Dominates(phi_extension,
  151. bb_from->terminator())) {
  152. // The given id is no good as its definition does not dominate the exit
  153. // of |from_block|
  154. return false;
  155. }
  156. }
  157. phi_index++;
  158. }
  159. // We allow some of the ids provided for extending OpPhi instructions to be
  160. // unused. Their presence does no harm, and requiring a perfect match may
  161. // make transformations less likely to cleanly apply.
  162. return true;
  163. }
  164. opt::Instruction CreateUnreachableEdgeInstruction(opt::IRContext* ir_context,
  165. uint32_t bb_from_id,
  166. uint32_t bb_to_id,
  167. uint32_t bool_id) {
  168. const auto* bb_from = MaybeFindBlock(ir_context, bb_from_id);
  169. assert(bb_from && "|bb_from_id| is invalid");
  170. assert(MaybeFindBlock(ir_context, bb_to_id) && "|bb_to_id| is invalid");
  171. assert(bb_from->terminator()->opcode() == spv::Op::OpBranch &&
  172. "Precondition on terminator of bb_from is not satisfied");
  173. // Get the id of the boolean constant to be used as the condition.
  174. auto condition_inst = ir_context->get_def_use_mgr()->GetDef(bool_id);
  175. assert(condition_inst &&
  176. (condition_inst->opcode() == spv::Op::OpConstantTrue ||
  177. condition_inst->opcode() == spv::Op::OpConstantFalse) &&
  178. "|bool_id| is invalid");
  179. auto condition_value = condition_inst->opcode() == spv::Op::OpConstantTrue;
  180. auto successor_id = bb_from->terminator()->GetSingleWordInOperand(0);
  181. // Add the dead branch, by turning OpBranch into OpBranchConditional, and
  182. // ordering the targets depending on whether the given boolean corresponds to
  183. // true or false.
  184. return opt::Instruction(
  185. ir_context, spv::Op::OpBranchConditional, 0, 0,
  186. {{SPV_OPERAND_TYPE_ID, {bool_id}},
  187. {SPV_OPERAND_TYPE_ID, {condition_value ? successor_id : bb_to_id}},
  188. {SPV_OPERAND_TYPE_ID, {condition_value ? bb_to_id : successor_id}}});
  189. }
  190. void AddUnreachableEdgeAndUpdateOpPhis(
  191. opt::IRContext* context, opt::BasicBlock* bb_from, opt::BasicBlock* bb_to,
  192. uint32_t bool_id,
  193. const google::protobuf::RepeatedField<google::protobuf::uint32>& phi_ids) {
  194. assert(PhiIdsOkForNewEdge(context, bb_from, bb_to, phi_ids) &&
  195. "Precondition on phi_ids is not satisfied");
  196. const bool from_to_edge_already_exists = bb_from->IsSuccessor(bb_to);
  197. *bb_from->terminator() = CreateUnreachableEdgeInstruction(
  198. context, bb_from->id(), bb_to->id(), bool_id);
  199. // Update OpPhi instructions in the target block if this branch adds a
  200. // previously non-existent edge from source to target.
  201. if (!from_to_edge_already_exists) {
  202. uint32_t phi_index = 0;
  203. for (auto& inst : *bb_to) {
  204. if (inst.opcode() != spv::Op::OpPhi) {
  205. break;
  206. }
  207. assert(phi_index < static_cast<uint32_t>(phi_ids.size()) &&
  208. "There should be at least one phi id per OpPhi instruction.");
  209. inst.AddOperand({SPV_OPERAND_TYPE_ID, {phi_ids[phi_index]}});
  210. inst.AddOperand({SPV_OPERAND_TYPE_ID, {bb_from->id()}});
  211. phi_index++;
  212. }
  213. }
  214. }
  215. bool BlockIsBackEdge(opt::IRContext* context, uint32_t block_id,
  216. uint32_t loop_header_id) {
  217. auto block = context->cfg()->block(block_id);
  218. auto loop_header = context->cfg()->block(loop_header_id);
  219. // |block| and |loop_header| must be defined, |loop_header| must be in fact
  220. // loop header and |block| must branch to it.
  221. if (!(block && loop_header && loop_header->IsLoopHeader() &&
  222. block->IsSuccessor(loop_header))) {
  223. return false;
  224. }
  225. // |block| must be reachable and be dominated by |loop_header|.
  226. opt::DominatorAnalysis* dominator_analysis =
  227. context->GetDominatorAnalysis(loop_header->GetParent());
  228. return context->IsReachable(*block) &&
  229. dominator_analysis->Dominates(loop_header, block);
  230. }
  231. bool BlockIsInLoopContinueConstruct(opt::IRContext* context, uint32_t block_id,
  232. uint32_t maybe_loop_header_id) {
  233. // We deem a block to be part of a loop's continue construct if the loop's
  234. // continue target dominates the block.
  235. auto containing_construct_block = context->cfg()->block(maybe_loop_header_id);
  236. if (containing_construct_block->IsLoopHeader()) {
  237. auto continue_target = containing_construct_block->ContinueBlockId();
  238. if (context->GetDominatorAnalysis(containing_construct_block->GetParent())
  239. ->Dominates(continue_target, block_id)) {
  240. return true;
  241. }
  242. }
  243. return false;
  244. }
  245. opt::BasicBlock::iterator GetIteratorForInstruction(
  246. opt::BasicBlock* block, const opt::Instruction* inst) {
  247. for (auto inst_it = block->begin(); inst_it != block->end(); ++inst_it) {
  248. if (inst == &*inst_it) {
  249. return inst_it;
  250. }
  251. }
  252. return block->end();
  253. }
  254. bool CanInsertOpcodeBeforeInstruction(
  255. spv::Op opcode, const opt::BasicBlock::iterator& instruction_in_block) {
  256. if (instruction_in_block->PreviousNode() &&
  257. (instruction_in_block->PreviousNode()->opcode() == spv::Op::OpLoopMerge ||
  258. instruction_in_block->PreviousNode()->opcode() ==
  259. spv::Op::OpSelectionMerge)) {
  260. // We cannot insert directly after a merge instruction.
  261. return false;
  262. }
  263. if (opcode != spv::Op::OpVariable &&
  264. instruction_in_block->opcode() == spv::Op::OpVariable) {
  265. // We cannot insert a non-OpVariable instruction directly before a
  266. // variable; variables in a function must be contiguous in the entry block.
  267. return false;
  268. }
  269. // We cannot insert a non-OpPhi instruction directly before an OpPhi, because
  270. // OpPhi instructions need to be contiguous at the start of a block.
  271. return opcode == spv::Op::OpPhi ||
  272. instruction_in_block->opcode() != spv::Op::OpPhi;
  273. }
  274. bool CanMakeSynonymOf(opt::IRContext* ir_context,
  275. const TransformationContext& transformation_context,
  276. const opt::Instruction& inst) {
  277. if (inst.opcode() == spv::Op::OpSampledImage) {
  278. // The SPIR-V data rules say that only very specific instructions may
  279. // may consume the result id of an OpSampledImage, and this excludes the
  280. // instructions that are used for making synonyms.
  281. return false;
  282. }
  283. if (!inst.HasResultId()) {
  284. // We can only make a synonym of an instruction that generates an id.
  285. return false;
  286. }
  287. if (transformation_context.GetFactManager()->IdIsIrrelevant(
  288. inst.result_id())) {
  289. // An irrelevant id can't be a synonym of anything.
  290. return false;
  291. }
  292. if (!inst.type_id()) {
  293. // We can only make a synonym of an instruction that has a type.
  294. return false;
  295. }
  296. auto type_inst = ir_context->get_def_use_mgr()->GetDef(inst.type_id());
  297. if (type_inst->opcode() == spv::Op::OpTypeVoid) {
  298. // We only make synonyms of instructions that define objects, and an object
  299. // cannot have void type.
  300. return false;
  301. }
  302. if (type_inst->opcode() == spv::Op::OpTypePointer) {
  303. switch (inst.opcode()) {
  304. case spv::Op::OpConstantNull:
  305. case spv::Op::OpUndef:
  306. // We disallow making synonyms of null or undefined pointers. This is
  307. // to provide the property that if the original shader exhibited no bad
  308. // pointer accesses, the transformed shader will not either.
  309. return false;
  310. default:
  311. break;
  312. }
  313. }
  314. // We do not make synonyms of objects that have decorations: if the synonym is
  315. // not decorated analogously, using the original object vs. its synonymous
  316. // form may not be equivalent.
  317. return ir_context->get_decoration_mgr()
  318. ->GetDecorationsFor(inst.result_id(), true)
  319. .empty();
  320. }
  321. bool IsCompositeType(const opt::analysis::Type* type) {
  322. return type && (type->AsArray() || type->AsMatrix() || type->AsStruct() ||
  323. type->AsVector());
  324. }
  325. std::vector<uint32_t> RepeatedFieldToVector(
  326. const google::protobuf::RepeatedField<uint32_t>& repeated_field) {
  327. std::vector<uint32_t> result;
  328. for (auto i : repeated_field) {
  329. result.push_back(i);
  330. }
  331. return result;
  332. }
  333. uint32_t WalkOneCompositeTypeIndex(opt::IRContext* context,
  334. uint32_t base_object_type_id,
  335. uint32_t index) {
  336. auto should_be_composite_type =
  337. context->get_def_use_mgr()->GetDef(base_object_type_id);
  338. assert(should_be_composite_type && "The type should exist.");
  339. switch (should_be_composite_type->opcode()) {
  340. case spv::Op::OpTypeArray: {
  341. auto array_length = GetArraySize(*should_be_composite_type, context);
  342. if (array_length == 0 || index >= array_length) {
  343. return 0;
  344. }
  345. return should_be_composite_type->GetSingleWordInOperand(0);
  346. }
  347. case spv::Op::OpTypeMatrix:
  348. case spv::Op::OpTypeVector: {
  349. auto count = should_be_composite_type->GetSingleWordInOperand(1);
  350. if (index >= count) {
  351. return 0;
  352. }
  353. return should_be_composite_type->GetSingleWordInOperand(0);
  354. }
  355. case spv::Op::OpTypeStruct: {
  356. if (index >= GetNumberOfStructMembers(*should_be_composite_type)) {
  357. return 0;
  358. }
  359. return should_be_composite_type->GetSingleWordInOperand(index);
  360. }
  361. default:
  362. return 0;
  363. }
  364. }
  365. uint32_t WalkCompositeTypeIndices(
  366. opt::IRContext* context, uint32_t base_object_type_id,
  367. const google::protobuf::RepeatedField<google::protobuf::uint32>& indices) {
  368. uint32_t sub_object_type_id = base_object_type_id;
  369. for (auto index : indices) {
  370. sub_object_type_id =
  371. WalkOneCompositeTypeIndex(context, sub_object_type_id, index);
  372. if (!sub_object_type_id) {
  373. return 0;
  374. }
  375. }
  376. return sub_object_type_id;
  377. }
  378. uint32_t GetNumberOfStructMembers(
  379. const opt::Instruction& struct_type_instruction) {
  380. assert(struct_type_instruction.opcode() == spv::Op::OpTypeStruct &&
  381. "An OpTypeStruct instruction is required here.");
  382. return struct_type_instruction.NumInOperands();
  383. }
  384. uint32_t GetArraySize(const opt::Instruction& array_type_instruction,
  385. opt::IRContext* context) {
  386. auto array_length_constant =
  387. context->get_constant_mgr()
  388. ->GetConstantFromInst(context->get_def_use_mgr()->GetDef(
  389. array_type_instruction.GetSingleWordInOperand(1)))
  390. ->AsIntConstant();
  391. if (array_length_constant->words().size() != 1) {
  392. return 0;
  393. }
  394. return array_length_constant->GetU32();
  395. }
  396. uint32_t GetBoundForCompositeIndex(const opt::Instruction& composite_type_inst,
  397. opt::IRContext* ir_context) {
  398. switch (composite_type_inst.opcode()) {
  399. case spv::Op::OpTypeArray:
  400. return fuzzerutil::GetArraySize(composite_type_inst, ir_context);
  401. case spv::Op::OpTypeMatrix:
  402. case spv::Op::OpTypeVector:
  403. return composite_type_inst.GetSingleWordInOperand(1);
  404. case spv::Op::OpTypeStruct: {
  405. return fuzzerutil::GetNumberOfStructMembers(composite_type_inst);
  406. }
  407. case spv::Op::OpTypeRuntimeArray:
  408. assert(false &&
  409. "GetBoundForCompositeIndex should not be invoked with an "
  410. "OpTypeRuntimeArray, which does not have a static bound.");
  411. return 0;
  412. default:
  413. assert(false && "Unknown composite type.");
  414. return 0;
  415. }
  416. }
  417. spv::MemorySemanticsMask GetMemorySemanticsForStorageClass(
  418. spv::StorageClass storage_class) {
  419. switch (storage_class) {
  420. case spv::StorageClass::Workgroup:
  421. return spv::MemorySemanticsMask::WorkgroupMemory;
  422. case spv::StorageClass::StorageBuffer:
  423. case spv::StorageClass::PhysicalStorageBuffer:
  424. return spv::MemorySemanticsMask::UniformMemory;
  425. case spv::StorageClass::CrossWorkgroup:
  426. return spv::MemorySemanticsMask::CrossWorkgroupMemory;
  427. case spv::StorageClass::AtomicCounter:
  428. return spv::MemorySemanticsMask::AtomicCounterMemory;
  429. case spv::StorageClass::Image:
  430. return spv::MemorySemanticsMask::ImageMemory;
  431. default:
  432. return spv::MemorySemanticsMask::MaskNone;
  433. }
  434. }
  435. bool IsValid(const opt::IRContext* context,
  436. spv_validator_options validator_options,
  437. MessageConsumer consumer) {
  438. std::vector<uint32_t> binary;
  439. context->module()->ToBinary(&binary, false);
  440. SpirvTools tools(context->grammar().target_env());
  441. tools.SetMessageConsumer(std::move(consumer));
  442. return tools.Validate(binary.data(), binary.size(), validator_options);
  443. }
  444. bool IsValidAndWellFormed(const opt::IRContext* ir_context,
  445. spv_validator_options validator_options,
  446. MessageConsumer consumer) {
  447. if (!IsValid(ir_context, validator_options, consumer)) {
  448. // Expression to dump |ir_context| to /data/temp/shader.spv:
  449. // DumpShader(ir_context, "/data/temp/shader.spv")
  450. consumer(SPV_MSG_INFO, nullptr, {},
  451. "Module is invalid (set a breakpoint to inspect).");
  452. return false;
  453. }
  454. // Check that all blocks in the module have appropriate parent functions.
  455. for (auto& function : *ir_context->module()) {
  456. for (auto& block : function) {
  457. if (block.GetParent() == nullptr) {
  458. std::stringstream ss;
  459. ss << "Block " << block.id() << " has no parent; its parent should be "
  460. << function.result_id() << " (set a breakpoint to inspect).";
  461. consumer(SPV_MSG_INFO, nullptr, {}, ss.str().c_str());
  462. return false;
  463. }
  464. if (block.GetParent() != &function) {
  465. std::stringstream ss;
  466. ss << "Block " << block.id() << " should have parent "
  467. << function.result_id() << " but instead has parent "
  468. << block.GetParent() << " (set a breakpoint to inspect).";
  469. consumer(SPV_MSG_INFO, nullptr, {}, ss.str().c_str());
  470. return false;
  471. }
  472. }
  473. }
  474. // Check that all instructions have distinct unique ids. We map each unique
  475. // id to the first instruction it is observed to be associated with so that
  476. // if we encounter a duplicate we have access to the previous instruction -
  477. // this is a useful aid to debugging.
  478. std::unordered_map<uint32_t, opt::Instruction*> unique_ids;
  479. bool found_duplicate = false;
  480. ir_context->module()->ForEachInst([&consumer, &found_duplicate, ir_context,
  481. &unique_ids](opt::Instruction* inst) {
  482. (void)ir_context; // Only used in an assertion; keep release-mode compilers
  483. // happy.
  484. assert(inst->context() == ir_context &&
  485. "Instruction has wrong IR context.");
  486. if (unique_ids.count(inst->unique_id()) != 0) {
  487. consumer(SPV_MSG_INFO, nullptr, {},
  488. "Two instructions have the same unique id (set a breakpoint to "
  489. "inspect).");
  490. found_duplicate = true;
  491. }
  492. unique_ids.insert({inst->unique_id(), inst});
  493. });
  494. return !found_duplicate;
  495. }
  496. std::unique_ptr<opt::IRContext> CloneIRContext(opt::IRContext* context) {
  497. std::vector<uint32_t> binary;
  498. context->module()->ToBinary(&binary, false);
  499. return BuildModule(context->grammar().target_env(), nullptr, binary.data(),
  500. binary.size());
  501. }
  502. bool IsNonFunctionTypeId(opt::IRContext* ir_context, uint32_t id) {
  503. auto type = ir_context->get_type_mgr()->GetType(id);
  504. return type && !type->AsFunction();
  505. }
  506. bool IsMergeOrContinue(opt::IRContext* ir_context, uint32_t block_id) {
  507. bool result = false;
  508. ir_context->get_def_use_mgr()->WhileEachUse(
  509. block_id,
  510. [&result](const opt::Instruction* use_instruction,
  511. uint32_t /*unused*/) -> bool {
  512. switch (use_instruction->opcode()) {
  513. case spv::Op::OpLoopMerge:
  514. case spv::Op::OpSelectionMerge:
  515. result = true;
  516. return false;
  517. default:
  518. return true;
  519. }
  520. });
  521. return result;
  522. }
  523. uint32_t GetLoopFromMergeBlock(opt::IRContext* ir_context,
  524. uint32_t merge_block_id) {
  525. uint32_t result = 0;
  526. ir_context->get_def_use_mgr()->WhileEachUse(
  527. merge_block_id,
  528. [ir_context, &result](opt::Instruction* use_instruction,
  529. uint32_t use_index) -> bool {
  530. switch (use_instruction->opcode()) {
  531. case spv::Op::OpLoopMerge:
  532. // The merge block operand is the first operand in OpLoopMerge.
  533. if (use_index == 0) {
  534. result = ir_context->get_instr_block(use_instruction)->id();
  535. return false;
  536. }
  537. return true;
  538. default:
  539. return true;
  540. }
  541. });
  542. return result;
  543. }
  544. uint32_t FindFunctionType(opt::IRContext* ir_context,
  545. const std::vector<uint32_t>& type_ids) {
  546. // Look through the existing types for a match.
  547. for (auto& type_or_value : ir_context->types_values()) {
  548. if (type_or_value.opcode() != spv::Op::OpTypeFunction) {
  549. // We are only interested in function types.
  550. continue;
  551. }
  552. if (type_or_value.NumInOperands() != type_ids.size()) {
  553. // Not a match: different numbers of arguments.
  554. continue;
  555. }
  556. // Check whether the return type and argument types match.
  557. bool input_operands_match = true;
  558. for (uint32_t i = 0; i < type_or_value.NumInOperands(); i++) {
  559. if (type_ids[i] != type_or_value.GetSingleWordInOperand(i)) {
  560. input_operands_match = false;
  561. break;
  562. }
  563. }
  564. if (input_operands_match) {
  565. // Everything matches.
  566. return type_or_value.result_id();
  567. }
  568. }
  569. // No match was found.
  570. return 0;
  571. }
  572. opt::Instruction* GetFunctionType(opt::IRContext* context,
  573. const opt::Function* function) {
  574. uint32_t type_id = function->DefInst().GetSingleWordInOperand(1);
  575. return context->get_def_use_mgr()->GetDef(type_id);
  576. }
  577. opt::Function* FindFunction(opt::IRContext* ir_context, uint32_t function_id) {
  578. for (auto& function : *ir_context->module()) {
  579. if (function.result_id() == function_id) {
  580. return &function;
  581. }
  582. }
  583. return nullptr;
  584. }
  585. bool FunctionContainsOpKillOrUnreachable(const opt::Function& function) {
  586. for (auto& block : function) {
  587. if (block.terminator()->opcode() == spv::Op::OpKill ||
  588. block.terminator()->opcode() == spv::Op::OpUnreachable) {
  589. return true;
  590. }
  591. }
  592. return false;
  593. }
  594. bool FunctionIsEntryPoint(opt::IRContext* context, uint32_t function_id) {
  595. for (auto& entry_point : context->module()->entry_points()) {
  596. if (entry_point.GetSingleWordInOperand(1) == function_id) {
  597. return true;
  598. }
  599. }
  600. return false;
  601. }
  602. bool IdIsAvailableAtUse(opt::IRContext* context,
  603. opt::Instruction* use_instruction,
  604. uint32_t use_input_operand_index, uint32_t id) {
  605. assert(context->get_instr_block(use_instruction) &&
  606. "|use_instruction| must be in a basic block");
  607. auto defining_instruction = context->get_def_use_mgr()->GetDef(id);
  608. auto enclosing_function =
  609. context->get_instr_block(use_instruction)->GetParent();
  610. // If the id a function parameter, it needs to be associated with the
  611. // function containing the use.
  612. if (defining_instruction->opcode() == spv::Op::OpFunctionParameter) {
  613. return InstructionIsFunctionParameter(defining_instruction,
  614. enclosing_function);
  615. }
  616. if (!context->get_instr_block(id)) {
  617. // The id must be at global scope.
  618. return true;
  619. }
  620. if (defining_instruction == use_instruction) {
  621. // It is not OK for a definition to use itself.
  622. return false;
  623. }
  624. if (!context->IsReachable(*context->get_instr_block(use_instruction)) ||
  625. !context->IsReachable(*context->get_instr_block(id))) {
  626. // Skip unreachable blocks.
  627. return false;
  628. }
  629. auto dominator_analysis = context->GetDominatorAnalysis(enclosing_function);
  630. if (use_instruction->opcode() == spv::Op::OpPhi) {
  631. // In the case where the use is an operand to OpPhi, it is actually the
  632. // *parent* block associated with the operand that must be dominated by
  633. // the synonym.
  634. auto parent_block =
  635. use_instruction->GetSingleWordInOperand(use_input_operand_index + 1);
  636. return dominator_analysis->Dominates(
  637. context->get_instr_block(defining_instruction)->id(), parent_block);
  638. }
  639. return dominator_analysis->Dominates(defining_instruction, use_instruction);
  640. }
  641. bool IdIsAvailableBeforeInstruction(opt::IRContext* context,
  642. opt::Instruction* instruction,
  643. uint32_t id) {
  644. assert(context->get_instr_block(instruction) &&
  645. "|instruction| must be in a basic block");
  646. auto id_definition = context->get_def_use_mgr()->GetDef(id);
  647. auto function_enclosing_instruction =
  648. context->get_instr_block(instruction)->GetParent();
  649. // If the id a function parameter, it needs to be associated with the
  650. // function containing the instruction.
  651. if (id_definition->opcode() == spv::Op::OpFunctionParameter) {
  652. return InstructionIsFunctionParameter(id_definition,
  653. function_enclosing_instruction);
  654. }
  655. if (!context->get_instr_block(id)) {
  656. // The id is at global scope.
  657. return true;
  658. }
  659. if (id_definition == instruction) {
  660. // The instruction is not available right before its own definition.
  661. return false;
  662. }
  663. const auto* dominator_analysis =
  664. context->GetDominatorAnalysis(function_enclosing_instruction);
  665. if (context->IsReachable(*context->get_instr_block(instruction)) &&
  666. context->IsReachable(*context->get_instr_block(id)) &&
  667. dominator_analysis->Dominates(id_definition, instruction)) {
  668. // The id's definition dominates the instruction, and both the definition
  669. // and the instruction are in reachable blocks, thus the id is available at
  670. // the instruction.
  671. return true;
  672. }
  673. if (id_definition->opcode() == spv::Op::OpVariable &&
  674. function_enclosing_instruction ==
  675. context->get_instr_block(id)->GetParent()) {
  676. assert(!context->IsReachable(*context->get_instr_block(instruction)) &&
  677. "If the instruction were in a reachable block we should already "
  678. "have returned true.");
  679. // The id is a variable and it is in the same function as |instruction|.
  680. // This is OK despite |instruction| being unreachable.
  681. return true;
  682. }
  683. return false;
  684. }
  685. bool InstructionIsFunctionParameter(opt::Instruction* instruction,
  686. opt::Function* function) {
  687. if (instruction->opcode() != spv::Op::OpFunctionParameter) {
  688. return false;
  689. }
  690. bool found_parameter = false;
  691. function->ForEachParam(
  692. [instruction, &found_parameter](opt::Instruction* param) {
  693. if (param == instruction) {
  694. found_parameter = true;
  695. }
  696. });
  697. return found_parameter;
  698. }
  699. uint32_t GetTypeId(opt::IRContext* context, uint32_t result_id) {
  700. const auto* inst = context->get_def_use_mgr()->GetDef(result_id);
  701. assert(inst && "|result_id| is invalid");
  702. return inst->type_id();
  703. }
  704. uint32_t GetPointeeTypeIdFromPointerType(opt::Instruction* pointer_type_inst) {
  705. assert(pointer_type_inst &&
  706. pointer_type_inst->opcode() == spv::Op::OpTypePointer &&
  707. "Precondition: |pointer_type_inst| must be OpTypePointer.");
  708. return pointer_type_inst->GetSingleWordInOperand(1);
  709. }
  710. uint32_t GetPointeeTypeIdFromPointerType(opt::IRContext* context,
  711. uint32_t pointer_type_id) {
  712. return GetPointeeTypeIdFromPointerType(
  713. context->get_def_use_mgr()->GetDef(pointer_type_id));
  714. }
  715. spv::StorageClass GetStorageClassFromPointerType(
  716. opt::Instruction* pointer_type_inst) {
  717. assert(pointer_type_inst &&
  718. pointer_type_inst->opcode() == spv::Op::OpTypePointer &&
  719. "Precondition: |pointer_type_inst| must be OpTypePointer.");
  720. return static_cast<spv::StorageClass>(
  721. pointer_type_inst->GetSingleWordInOperand(0));
  722. }
  723. spv::StorageClass GetStorageClassFromPointerType(opt::IRContext* context,
  724. uint32_t pointer_type_id) {
  725. return GetStorageClassFromPointerType(
  726. context->get_def_use_mgr()->GetDef(pointer_type_id));
  727. }
  728. uint32_t MaybeGetPointerType(opt::IRContext* context, uint32_t pointee_type_id,
  729. spv::StorageClass storage_class) {
  730. for (auto& inst : context->types_values()) {
  731. switch (inst.opcode()) {
  732. case spv::Op::OpTypePointer:
  733. if (spv::StorageClass(inst.GetSingleWordInOperand(0)) ==
  734. storage_class &&
  735. inst.GetSingleWordInOperand(1) == pointee_type_id) {
  736. return inst.result_id();
  737. }
  738. break;
  739. default:
  740. break;
  741. }
  742. }
  743. return 0;
  744. }
  745. uint32_t InOperandIndexFromOperandIndex(const opt::Instruction& inst,
  746. uint32_t absolute_index) {
  747. // Subtract the number of non-input operands from the index
  748. return absolute_index - inst.NumOperands() + inst.NumInOperands();
  749. }
  750. bool IsNullConstantSupported(opt::IRContext* ir_context,
  751. const opt::Instruction& type_inst) {
  752. switch (type_inst.opcode()) {
  753. case spv::Op::OpTypeArray:
  754. case spv::Op::OpTypeBool:
  755. case spv::Op::OpTypeDeviceEvent:
  756. case spv::Op::OpTypeEvent:
  757. case spv::Op::OpTypeFloat:
  758. case spv::Op::OpTypeInt:
  759. case spv::Op::OpTypeMatrix:
  760. case spv::Op::OpTypeQueue:
  761. case spv::Op::OpTypeReserveId:
  762. case spv::Op::OpTypeVector:
  763. case spv::Op::OpTypeStruct:
  764. return true;
  765. case spv::Op::OpTypePointer:
  766. // Null pointers are allowed if the VariablePointers capability is
  767. // enabled, or if the VariablePointersStorageBuffer capability is enabled
  768. // and the pointer type has StorageBuffer as its storage class.
  769. if (ir_context->get_feature_mgr()->HasCapability(
  770. spv::Capability::VariablePointers)) {
  771. return true;
  772. }
  773. if (ir_context->get_feature_mgr()->HasCapability(
  774. spv::Capability::VariablePointersStorageBuffer)) {
  775. return spv::StorageClass(type_inst.GetSingleWordInOperand(0)) ==
  776. spv::StorageClass::StorageBuffer;
  777. }
  778. return false;
  779. default:
  780. return false;
  781. }
  782. }
  783. bool GlobalVariablesMustBeDeclaredInEntryPointInterfaces(
  784. const opt::IRContext* ir_context) {
  785. // TODO(afd): We capture the environments for which this requirement holds.
  786. // The check should be refined on demand for other target environments.
  787. switch (ir_context->grammar().target_env()) {
  788. case SPV_ENV_UNIVERSAL_1_0:
  789. case SPV_ENV_UNIVERSAL_1_1:
  790. case SPV_ENV_UNIVERSAL_1_2:
  791. case SPV_ENV_UNIVERSAL_1_3:
  792. case SPV_ENV_VULKAN_1_0:
  793. case SPV_ENV_VULKAN_1_1:
  794. return false;
  795. default:
  796. return true;
  797. }
  798. }
  799. void AddVariableIdToEntryPointInterfaces(opt::IRContext* context, uint32_t id) {
  800. if (GlobalVariablesMustBeDeclaredInEntryPointInterfaces(context)) {
  801. // Conservatively add this global to the interface of every entry point in
  802. // the module. This means that the global is available for other
  803. // transformations to use.
  804. //
  805. // A downside of this is that the global will be in the interface even if it
  806. // ends up never being used.
  807. //
  808. // TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/3111) revisit
  809. // this if a more thorough approach to entry point interfaces is taken.
  810. for (auto& entry_point : context->module()->entry_points()) {
  811. entry_point.AddOperand({SPV_OPERAND_TYPE_ID, {id}});
  812. }
  813. }
  814. }
  815. opt::Instruction* AddGlobalVariable(opt::IRContext* context, uint32_t result_id,
  816. uint32_t type_id,
  817. spv::StorageClass storage_class,
  818. uint32_t initializer_id) {
  819. // Check various preconditions.
  820. assert(result_id != 0 && "Result id can't be 0");
  821. assert((storage_class == spv::StorageClass::Private ||
  822. storage_class == spv::StorageClass::Workgroup) &&
  823. "Variable's storage class must be either Private or Workgroup");
  824. auto* type_inst = context->get_def_use_mgr()->GetDef(type_id);
  825. (void)type_inst; // Variable becomes unused in release mode.
  826. assert(type_inst && type_inst->opcode() == spv::Op::OpTypePointer &&
  827. GetStorageClassFromPointerType(type_inst) == storage_class &&
  828. "Variable's type is invalid");
  829. if (storage_class == spv::StorageClass::Workgroup) {
  830. assert(initializer_id == 0);
  831. }
  832. if (initializer_id != 0) {
  833. const auto* constant_inst =
  834. context->get_def_use_mgr()->GetDef(initializer_id);
  835. (void)constant_inst; // Variable becomes unused in release mode.
  836. assert(constant_inst && spvOpcodeIsConstant(constant_inst->opcode()) &&
  837. GetPointeeTypeIdFromPointerType(type_inst) ==
  838. constant_inst->type_id() &&
  839. "Initializer is invalid");
  840. }
  841. opt::Instruction::OperandList operands = {
  842. {SPV_OPERAND_TYPE_STORAGE_CLASS, {static_cast<uint32_t>(storage_class)}}};
  843. if (initializer_id) {
  844. operands.push_back({SPV_OPERAND_TYPE_ID, {initializer_id}});
  845. }
  846. auto new_instruction = MakeUnique<opt::Instruction>(
  847. context, spv::Op::OpVariable, type_id, result_id, std::move(operands));
  848. auto result = new_instruction.get();
  849. context->module()->AddGlobalValue(std::move(new_instruction));
  850. AddVariableIdToEntryPointInterfaces(context, result_id);
  851. UpdateModuleIdBound(context, result_id);
  852. return result;
  853. }
  854. opt::Instruction* AddLocalVariable(opt::IRContext* context, uint32_t result_id,
  855. uint32_t type_id, uint32_t function_id,
  856. uint32_t initializer_id) {
  857. // Check various preconditions.
  858. assert(result_id != 0 && "Result id can't be 0");
  859. auto* type_inst = context->get_def_use_mgr()->GetDef(type_id);
  860. (void)type_inst; // Variable becomes unused in release mode.
  861. assert(type_inst && type_inst->opcode() == spv::Op::OpTypePointer &&
  862. GetStorageClassFromPointerType(type_inst) ==
  863. spv::StorageClass::Function &&
  864. "Variable's type is invalid");
  865. const auto* constant_inst =
  866. context->get_def_use_mgr()->GetDef(initializer_id);
  867. (void)constant_inst; // Variable becomes unused in release mode.
  868. assert(constant_inst && spvOpcodeIsConstant(constant_inst->opcode()) &&
  869. GetPointeeTypeIdFromPointerType(type_inst) ==
  870. constant_inst->type_id() &&
  871. "Initializer is invalid");
  872. auto* function = FindFunction(context, function_id);
  873. assert(function && "Function id is invalid");
  874. auto new_instruction = MakeUnique<opt::Instruction>(
  875. context, spv::Op::OpVariable, type_id, result_id,
  876. opt::Instruction::OperandList{{SPV_OPERAND_TYPE_STORAGE_CLASS,
  877. {uint32_t(spv::StorageClass::Function)}},
  878. {SPV_OPERAND_TYPE_ID, {initializer_id}}});
  879. auto result = new_instruction.get();
  880. function->begin()->begin()->InsertBefore(std::move(new_instruction));
  881. UpdateModuleIdBound(context, result_id);
  882. return result;
  883. }
  884. bool HasDuplicates(const std::vector<uint32_t>& arr) {
  885. return std::unordered_set<uint32_t>(arr.begin(), arr.end()).size() !=
  886. arr.size();
  887. }
  888. bool IsPermutationOfRange(const std::vector<uint32_t>& arr, uint32_t lo,
  889. uint32_t hi) {
  890. if (arr.empty()) {
  891. return lo > hi;
  892. }
  893. if (HasDuplicates(arr)) {
  894. return false;
  895. }
  896. auto min_max = std::minmax_element(arr.begin(), arr.end());
  897. return arr.size() == hi - lo + 1 && *min_max.first == lo &&
  898. *min_max.second == hi;
  899. }
  900. std::vector<opt::Instruction*> GetParameters(opt::IRContext* ir_context,
  901. uint32_t function_id) {
  902. auto* function = FindFunction(ir_context, function_id);
  903. assert(function && "|function_id| is invalid");
  904. std::vector<opt::Instruction*> result;
  905. function->ForEachParam(
  906. [&result](opt::Instruction* inst) { result.push_back(inst); });
  907. return result;
  908. }
  909. void RemoveParameter(opt::IRContext* ir_context, uint32_t parameter_id) {
  910. auto* function = GetFunctionFromParameterId(ir_context, parameter_id);
  911. assert(function && "|parameter_id| is invalid");
  912. assert(!FunctionIsEntryPoint(ir_context, function->result_id()) &&
  913. "Can't remove parameter from an entry point function");
  914. function->RemoveParameter(parameter_id);
  915. // We've just removed parameters from the function and cleared their memory.
  916. // Make sure analyses have no dangling pointers.
  917. ir_context->InvalidateAnalysesExceptFor(
  918. opt::IRContext::Analysis::kAnalysisNone);
  919. }
  920. std::vector<opt::Instruction*> GetCallers(opt::IRContext* ir_context,
  921. uint32_t function_id) {
  922. assert(FindFunction(ir_context, function_id) &&
  923. "|function_id| is not a result id of a function");
  924. std::vector<opt::Instruction*> result;
  925. ir_context->get_def_use_mgr()->ForEachUser(
  926. function_id, [&result, function_id](opt::Instruction* inst) {
  927. if (inst->opcode() == spv::Op::OpFunctionCall &&
  928. inst->GetSingleWordInOperand(0) == function_id) {
  929. result.push_back(inst);
  930. }
  931. });
  932. return result;
  933. }
  934. opt::Function* GetFunctionFromParameterId(opt::IRContext* ir_context,
  935. uint32_t param_id) {
  936. auto* param_inst = ir_context->get_def_use_mgr()->GetDef(param_id);
  937. assert(param_inst && "Parameter id is invalid");
  938. for (auto& function : *ir_context->module()) {
  939. if (InstructionIsFunctionParameter(param_inst, &function)) {
  940. return &function;
  941. }
  942. }
  943. return nullptr;
  944. }
  945. uint32_t UpdateFunctionType(opt::IRContext* ir_context, uint32_t function_id,
  946. uint32_t new_function_type_result_id,
  947. uint32_t return_type_id,
  948. const std::vector<uint32_t>& parameter_type_ids) {
  949. // Check some initial constraints.
  950. assert(ir_context->get_type_mgr()->GetType(return_type_id) &&
  951. "Return type is invalid");
  952. for (auto id : parameter_type_ids) {
  953. const auto* type = ir_context->get_type_mgr()->GetType(id);
  954. (void)type; // Make compilers happy in release mode.
  955. // Parameters can't be OpTypeVoid.
  956. assert(type && !type->AsVoid() && "Parameter has invalid type");
  957. }
  958. auto* function = FindFunction(ir_context, function_id);
  959. assert(function && "|function_id| is invalid");
  960. auto* old_function_type = GetFunctionType(ir_context, function);
  961. assert(old_function_type && "Function has invalid type");
  962. std::vector<uint32_t> operand_ids = {return_type_id};
  963. operand_ids.insert(operand_ids.end(), parameter_type_ids.begin(),
  964. parameter_type_ids.end());
  965. // A trivial case - we change nothing.
  966. if (FindFunctionType(ir_context, operand_ids) ==
  967. old_function_type->result_id()) {
  968. return old_function_type->result_id();
  969. }
  970. if (ir_context->get_def_use_mgr()->NumUsers(old_function_type) == 1 &&
  971. FindFunctionType(ir_context, operand_ids) == 0) {
  972. // We can change |old_function_type| only if it's used once in the module
  973. // and we are certain we won't create a duplicate as a result of the change.
  974. // Update |old_function_type| in-place.
  975. opt::Instruction::OperandList operands;
  976. for (auto id : operand_ids) {
  977. operands.push_back({SPV_OPERAND_TYPE_ID, {id}});
  978. }
  979. old_function_type->SetInOperands(std::move(operands));
  980. // |operands| may depend on result ids defined below the |old_function_type|
  981. // in the module.
  982. old_function_type->RemoveFromList();
  983. ir_context->AddType(std::unique_ptr<opt::Instruction>(old_function_type));
  984. return old_function_type->result_id();
  985. } else {
  986. // We can't modify the |old_function_type| so we have to either use an
  987. // existing one or create a new one.
  988. auto type_id = FindOrCreateFunctionType(
  989. ir_context, new_function_type_result_id, operand_ids);
  990. assert(type_id != old_function_type->result_id() &&
  991. "We should've handled this case above");
  992. function->DefInst().SetInOperand(1, {type_id});
  993. // DefUseManager hasn't been updated yet, so if the following condition is
  994. // true, then |old_function_type| will have no users when this function
  995. // returns. We might as well remove it.
  996. if (ir_context->get_def_use_mgr()->NumUsers(old_function_type) == 1) {
  997. ir_context->KillInst(old_function_type);
  998. }
  999. return type_id;
  1000. }
  1001. }
  1002. void AddFunctionType(opt::IRContext* ir_context, uint32_t result_id,
  1003. const std::vector<uint32_t>& type_ids) {
  1004. assert(result_id != 0 && "Result id can't be 0");
  1005. assert(!type_ids.empty() &&
  1006. "OpTypeFunction always has at least one operand - function's return "
  1007. "type");
  1008. assert(IsNonFunctionTypeId(ir_context, type_ids[0]) &&
  1009. "Return type must not be a function");
  1010. for (size_t i = 1; i < type_ids.size(); ++i) {
  1011. const auto* param_type = ir_context->get_type_mgr()->GetType(type_ids[i]);
  1012. (void)param_type; // Make compiler happy in release mode.
  1013. assert(param_type && !param_type->AsVoid() && !param_type->AsFunction() &&
  1014. "Function parameter can't have a function or void type");
  1015. }
  1016. opt::Instruction::OperandList operands;
  1017. operands.reserve(type_ids.size());
  1018. for (auto id : type_ids) {
  1019. operands.push_back({SPV_OPERAND_TYPE_ID, {id}});
  1020. }
  1021. ir_context->AddType(MakeUnique<opt::Instruction>(
  1022. ir_context, spv::Op::OpTypeFunction, 0, result_id, std::move(operands)));
  1023. UpdateModuleIdBound(ir_context, result_id);
  1024. }
  1025. uint32_t FindOrCreateFunctionType(opt::IRContext* ir_context,
  1026. uint32_t result_id,
  1027. const std::vector<uint32_t>& type_ids) {
  1028. if (auto existing_id = FindFunctionType(ir_context, type_ids)) {
  1029. return existing_id;
  1030. }
  1031. AddFunctionType(ir_context, result_id, type_ids);
  1032. return result_id;
  1033. }
  1034. uint32_t MaybeGetIntegerType(opt::IRContext* ir_context, uint32_t width,
  1035. bool is_signed) {
  1036. opt::analysis::Integer type(width, is_signed);
  1037. return ir_context->get_type_mgr()->GetId(&type);
  1038. }
  1039. uint32_t MaybeGetFloatType(opt::IRContext* ir_context, uint32_t width) {
  1040. opt::analysis::Float type(width);
  1041. return ir_context->get_type_mgr()->GetId(&type);
  1042. }
  1043. uint32_t MaybeGetBoolType(opt::IRContext* ir_context) {
  1044. opt::analysis::Bool type;
  1045. return ir_context->get_type_mgr()->GetId(&type);
  1046. }
  1047. uint32_t MaybeGetVectorType(opt::IRContext* ir_context,
  1048. uint32_t component_type_id,
  1049. uint32_t element_count) {
  1050. const auto* component_type =
  1051. ir_context->get_type_mgr()->GetType(component_type_id);
  1052. assert(component_type &&
  1053. (component_type->AsInteger() || component_type->AsFloat() ||
  1054. component_type->AsBool()) &&
  1055. "|component_type_id| is invalid");
  1056. assert(element_count >= 2 && element_count <= 4 &&
  1057. "Precondition: component count must be in range [2, 4].");
  1058. opt::analysis::Vector type(component_type, element_count);
  1059. return ir_context->get_type_mgr()->GetId(&type);
  1060. }
  1061. uint32_t MaybeGetStructType(opt::IRContext* ir_context,
  1062. const std::vector<uint32_t>& component_type_ids) {
  1063. for (auto& type_or_value : ir_context->types_values()) {
  1064. if (type_or_value.opcode() != spv::Op::OpTypeStruct ||
  1065. type_or_value.NumInOperands() !=
  1066. static_cast<uint32_t>(component_type_ids.size())) {
  1067. continue;
  1068. }
  1069. bool all_components_match = true;
  1070. for (uint32_t i = 0; i < component_type_ids.size(); i++) {
  1071. if (type_or_value.GetSingleWordInOperand(i) != component_type_ids[i]) {
  1072. all_components_match = false;
  1073. break;
  1074. }
  1075. }
  1076. if (all_components_match) {
  1077. return type_or_value.result_id();
  1078. }
  1079. }
  1080. return 0;
  1081. }
  1082. uint32_t MaybeGetVoidType(opt::IRContext* ir_context) {
  1083. opt::analysis::Void type;
  1084. return ir_context->get_type_mgr()->GetId(&type);
  1085. }
  1086. uint32_t MaybeGetZeroConstant(
  1087. opt::IRContext* ir_context,
  1088. const TransformationContext& transformation_context,
  1089. uint32_t scalar_or_composite_type_id, bool is_irrelevant) {
  1090. const auto* type_inst =
  1091. ir_context->get_def_use_mgr()->GetDef(scalar_or_composite_type_id);
  1092. assert(type_inst && "|scalar_or_composite_type_id| is invalid");
  1093. switch (type_inst->opcode()) {
  1094. case spv::Op::OpTypeBool:
  1095. return MaybeGetBoolConstant(ir_context, transformation_context, false,
  1096. is_irrelevant);
  1097. case spv::Op::OpTypeFloat:
  1098. case spv::Op::OpTypeInt: {
  1099. const auto width = type_inst->GetSingleWordInOperand(0);
  1100. std::vector<uint32_t> words = {0};
  1101. if (width > 32) {
  1102. words.push_back(0);
  1103. }
  1104. return MaybeGetScalarConstant(ir_context, transformation_context, words,
  1105. scalar_or_composite_type_id, is_irrelevant);
  1106. }
  1107. case spv::Op::OpTypeStruct: {
  1108. std::vector<uint32_t> component_ids;
  1109. for (uint32_t i = 0; i < type_inst->NumInOperands(); ++i) {
  1110. const auto component_type_id = type_inst->GetSingleWordInOperand(i);
  1111. auto component_id =
  1112. MaybeGetZeroConstant(ir_context, transformation_context,
  1113. component_type_id, is_irrelevant);
  1114. if (component_id == 0 && is_irrelevant) {
  1115. // Irrelevant constants can use either relevant or irrelevant
  1116. // constituents.
  1117. component_id = MaybeGetZeroConstant(
  1118. ir_context, transformation_context, component_type_id, false);
  1119. }
  1120. if (component_id == 0) {
  1121. return 0;
  1122. }
  1123. component_ids.push_back(component_id);
  1124. }
  1125. return MaybeGetCompositeConstant(
  1126. ir_context, transformation_context, component_ids,
  1127. scalar_or_composite_type_id, is_irrelevant);
  1128. }
  1129. case spv::Op::OpTypeMatrix:
  1130. case spv::Op::OpTypeVector: {
  1131. const auto component_type_id = type_inst->GetSingleWordInOperand(0);
  1132. auto component_id = MaybeGetZeroConstant(
  1133. ir_context, transformation_context, component_type_id, is_irrelevant);
  1134. if (component_id == 0 && is_irrelevant) {
  1135. // Irrelevant constants can use either relevant or irrelevant
  1136. // constituents.
  1137. component_id = MaybeGetZeroConstant(ir_context, transformation_context,
  1138. component_type_id, false);
  1139. }
  1140. if (component_id == 0) {
  1141. return 0;
  1142. }
  1143. const auto component_count = type_inst->GetSingleWordInOperand(1);
  1144. return MaybeGetCompositeConstant(
  1145. ir_context, transformation_context,
  1146. std::vector<uint32_t>(component_count, component_id),
  1147. scalar_or_composite_type_id, is_irrelevant);
  1148. }
  1149. case spv::Op::OpTypeArray: {
  1150. const auto component_type_id = type_inst->GetSingleWordInOperand(0);
  1151. auto component_id = MaybeGetZeroConstant(
  1152. ir_context, transformation_context, component_type_id, is_irrelevant);
  1153. if (component_id == 0 && is_irrelevant) {
  1154. // Irrelevant constants can use either relevant or irrelevant
  1155. // constituents.
  1156. component_id = MaybeGetZeroConstant(ir_context, transformation_context,
  1157. component_type_id, false);
  1158. }
  1159. if (component_id == 0) {
  1160. return 0;
  1161. }
  1162. return MaybeGetCompositeConstant(
  1163. ir_context, transformation_context,
  1164. std::vector<uint32_t>(GetArraySize(*type_inst, ir_context),
  1165. component_id),
  1166. scalar_or_composite_type_id, is_irrelevant);
  1167. }
  1168. default:
  1169. assert(false && "Type is not supported");
  1170. return 0;
  1171. }
  1172. }
  1173. bool CanCreateConstant(opt::IRContext* ir_context, uint32_t type_id) {
  1174. opt::Instruction* type_instr = ir_context->get_def_use_mgr()->GetDef(type_id);
  1175. assert(type_instr != nullptr && "The type must exist.");
  1176. assert(spvOpcodeGeneratesType(type_instr->opcode()) &&
  1177. "A type-generating opcode was expected.");
  1178. switch (type_instr->opcode()) {
  1179. case spv::Op::OpTypeBool:
  1180. case spv::Op::OpTypeInt:
  1181. case spv::Op::OpTypeFloat:
  1182. case spv::Op::OpTypeMatrix:
  1183. case spv::Op::OpTypeVector:
  1184. return true;
  1185. case spv::Op::OpTypeArray:
  1186. return CanCreateConstant(ir_context,
  1187. type_instr->GetSingleWordInOperand(0));
  1188. case spv::Op::OpTypeStruct:
  1189. if (HasBlockOrBufferBlockDecoration(ir_context, type_id)) {
  1190. return false;
  1191. }
  1192. for (uint32_t index = 0; index < type_instr->NumInOperands(); index++) {
  1193. if (!CanCreateConstant(ir_context,
  1194. type_instr->GetSingleWordInOperand(index))) {
  1195. return false;
  1196. }
  1197. }
  1198. return true;
  1199. default:
  1200. return false;
  1201. }
  1202. }
  1203. uint32_t MaybeGetScalarConstant(
  1204. opt::IRContext* ir_context,
  1205. const TransformationContext& transformation_context,
  1206. const std::vector<uint32_t>& words, uint32_t scalar_type_id,
  1207. bool is_irrelevant) {
  1208. const auto* type = ir_context->get_type_mgr()->GetType(scalar_type_id);
  1209. assert(type && "|scalar_type_id| is invalid");
  1210. if (const auto* int_type = type->AsInteger()) {
  1211. return MaybeGetIntegerConstant(ir_context, transformation_context, words,
  1212. int_type->width(), int_type->IsSigned(),
  1213. is_irrelevant);
  1214. } else if (const auto* float_type = type->AsFloat()) {
  1215. return MaybeGetFloatConstant(ir_context, transformation_context, words,
  1216. float_type->width(), is_irrelevant);
  1217. } else {
  1218. assert(type->AsBool() && words.size() == 1 &&
  1219. "|scalar_type_id| doesn't represent a scalar type");
  1220. return MaybeGetBoolConstant(ir_context, transformation_context, words[0],
  1221. is_irrelevant);
  1222. }
  1223. }
  1224. uint32_t MaybeGetCompositeConstant(
  1225. opt::IRContext* ir_context,
  1226. const TransformationContext& transformation_context,
  1227. const std::vector<uint32_t>& component_ids, uint32_t composite_type_id,
  1228. bool is_irrelevant) {
  1229. const auto* type = ir_context->get_type_mgr()->GetType(composite_type_id);
  1230. (void)type; // Make compilers happy in release mode.
  1231. assert(IsCompositeType(type) && "|composite_type_id| is invalid");
  1232. for (const auto& inst : ir_context->types_values()) {
  1233. if (inst.opcode() == spv::Op::OpConstantComposite &&
  1234. inst.type_id() == composite_type_id &&
  1235. transformation_context.GetFactManager()->IdIsIrrelevant(
  1236. inst.result_id()) == is_irrelevant &&
  1237. inst.NumInOperands() == component_ids.size()) {
  1238. bool is_match = true;
  1239. for (uint32_t i = 0; i < inst.NumInOperands(); ++i) {
  1240. if (inst.GetSingleWordInOperand(i) != component_ids[i]) {
  1241. is_match = false;
  1242. break;
  1243. }
  1244. }
  1245. if (is_match) {
  1246. return inst.result_id();
  1247. }
  1248. }
  1249. }
  1250. return 0;
  1251. }
  1252. uint32_t MaybeGetIntegerConstant(
  1253. opt::IRContext* ir_context,
  1254. const TransformationContext& transformation_context,
  1255. const std::vector<uint32_t>& words, uint32_t width, bool is_signed,
  1256. bool is_irrelevant) {
  1257. if (auto type_id = MaybeGetIntegerType(ir_context, width, is_signed)) {
  1258. return MaybeGetOpConstant(ir_context, transformation_context, words,
  1259. type_id, is_irrelevant);
  1260. }
  1261. return 0;
  1262. }
  1263. uint32_t MaybeGetIntegerConstantFromValueAndType(opt::IRContext* ir_context,
  1264. uint32_t value,
  1265. uint32_t int_type_id) {
  1266. auto int_type_inst = ir_context->get_def_use_mgr()->GetDef(int_type_id);
  1267. assert(int_type_inst && "The given type id must exist.");
  1268. auto int_type = ir_context->get_type_mgr()
  1269. ->GetType(int_type_inst->result_id())
  1270. ->AsInteger();
  1271. assert(int_type && int_type->width() == 32 &&
  1272. "The given type id must correspond to an 32-bit integer type.");
  1273. opt::analysis::IntConstant constant(int_type, {value});
  1274. // Check that the constant exists in the module.
  1275. if (!ir_context->get_constant_mgr()->FindConstant(&constant)) {
  1276. return 0;
  1277. }
  1278. return ir_context->get_constant_mgr()
  1279. ->GetDefiningInstruction(&constant)
  1280. ->result_id();
  1281. }
  1282. uint32_t MaybeGetFloatConstant(
  1283. opt::IRContext* ir_context,
  1284. const TransformationContext& transformation_context,
  1285. const std::vector<uint32_t>& words, uint32_t width, bool is_irrelevant) {
  1286. if (auto type_id = MaybeGetFloatType(ir_context, width)) {
  1287. return MaybeGetOpConstant(ir_context, transformation_context, words,
  1288. type_id, is_irrelevant);
  1289. }
  1290. return 0;
  1291. }
  1292. uint32_t MaybeGetBoolConstant(
  1293. opt::IRContext* ir_context,
  1294. const TransformationContext& transformation_context, bool value,
  1295. bool is_irrelevant) {
  1296. if (auto type_id = MaybeGetBoolType(ir_context)) {
  1297. for (const auto& inst : ir_context->types_values()) {
  1298. if (inst.opcode() ==
  1299. (value ? spv::Op::OpConstantTrue : spv::Op::OpConstantFalse) &&
  1300. inst.type_id() == type_id &&
  1301. transformation_context.GetFactManager()->IdIsIrrelevant(
  1302. inst.result_id()) == is_irrelevant) {
  1303. return inst.result_id();
  1304. }
  1305. }
  1306. }
  1307. return 0;
  1308. }
  1309. std::vector<uint32_t> IntToWords(uint64_t value, uint32_t width,
  1310. bool is_signed) {
  1311. assert(width <= 64 && "The bit width should not be more than 64 bits");
  1312. // Sign-extend or zero-extend the last |width| bits of |value|, depending on
  1313. // |is_signed|.
  1314. if (is_signed) {
  1315. // Sign-extend by shifting left and then shifting right, interpreting the
  1316. // integer as signed.
  1317. value = static_cast<int64_t>(value << (64 - width)) >> (64 - width);
  1318. } else {
  1319. // Zero-extend by shifting left and then shifting right, interpreting the
  1320. // integer as unsigned.
  1321. value = (value << (64 - width)) >> (64 - width);
  1322. }
  1323. std::vector<uint32_t> result;
  1324. result.push_back(static_cast<uint32_t>(value));
  1325. if (width > 32) {
  1326. result.push_back(static_cast<uint32_t>(value >> 32));
  1327. }
  1328. return result;
  1329. }
  1330. bool TypesAreEqualUpToSign(opt::IRContext* ir_context, uint32_t type1_id,
  1331. uint32_t type2_id) {
  1332. if (type1_id == type2_id) {
  1333. return true;
  1334. }
  1335. auto type1 = ir_context->get_type_mgr()->GetType(type1_id);
  1336. auto type2 = ir_context->get_type_mgr()->GetType(type2_id);
  1337. // Integer scalar types must have the same width
  1338. if (type1->AsInteger() && type2->AsInteger()) {
  1339. return type1->AsInteger()->width() == type2->AsInteger()->width();
  1340. }
  1341. // Integer vector types must have the same number of components and their
  1342. // component types must be integers with the same width.
  1343. if (type1->AsVector() && type2->AsVector()) {
  1344. auto component_type1 = type1->AsVector()->element_type()->AsInteger();
  1345. auto component_type2 = type2->AsVector()->element_type()->AsInteger();
  1346. // Only check the component count and width if they are integer.
  1347. if (component_type1 && component_type2) {
  1348. return type1->AsVector()->element_count() ==
  1349. type2->AsVector()->element_count() &&
  1350. component_type1->width() == component_type2->width();
  1351. }
  1352. }
  1353. // In all other cases, the types cannot be considered equal.
  1354. return false;
  1355. }
  1356. std::map<uint32_t, uint32_t> RepeatedUInt32PairToMap(
  1357. const google::protobuf::RepeatedPtrField<protobufs::UInt32Pair>& data) {
  1358. std::map<uint32_t, uint32_t> result;
  1359. for (const auto& entry : data) {
  1360. result[entry.first()] = entry.second();
  1361. }
  1362. return result;
  1363. }
  1364. google::protobuf::RepeatedPtrField<protobufs::UInt32Pair>
  1365. MapToRepeatedUInt32Pair(const std::map<uint32_t, uint32_t>& data) {
  1366. google::protobuf::RepeatedPtrField<protobufs::UInt32Pair> result;
  1367. for (const auto& entry : data) {
  1368. protobufs::UInt32Pair pair;
  1369. pair.set_first(entry.first);
  1370. pair.set_second(entry.second);
  1371. *result.Add() = std::move(pair);
  1372. }
  1373. return result;
  1374. }
  1375. opt::Instruction* GetLastInsertBeforeInstruction(opt::IRContext* ir_context,
  1376. uint32_t block_id,
  1377. spv::Op opcode) {
  1378. // CFG::block uses std::map::at which throws an exception when |block_id| is
  1379. // invalid. The error message is unhelpful, though. Thus, we test that
  1380. // |block_id| is valid here.
  1381. const auto* label_inst = ir_context->get_def_use_mgr()->GetDef(block_id);
  1382. (void)label_inst; // Make compilers happy in release mode.
  1383. assert(label_inst && label_inst->opcode() == spv::Op::OpLabel &&
  1384. "|block_id| is invalid");
  1385. auto* block = ir_context->cfg()->block(block_id);
  1386. auto it = block->rbegin();
  1387. assert(it != block->rend() && "Basic block can't be empty");
  1388. if (block->GetMergeInst()) {
  1389. ++it;
  1390. assert(it != block->rend() &&
  1391. "|block| must have at least two instructions:"
  1392. "terminator and a merge instruction");
  1393. }
  1394. return CanInsertOpcodeBeforeInstruction(opcode, &*it) ? &*it : nullptr;
  1395. }
  1396. bool IdUseCanBeReplaced(opt::IRContext* ir_context,
  1397. const TransformationContext& transformation_context,
  1398. opt::Instruction* use_instruction,
  1399. uint32_t use_in_operand_index) {
  1400. if (spvOpcodeIsAccessChain(use_instruction->opcode()) &&
  1401. use_in_operand_index > 0) {
  1402. // A replacement for an irrelevant index in OpAccessChain must be clamped
  1403. // first.
  1404. if (transformation_context.GetFactManager()->IdIsIrrelevant(
  1405. use_instruction->GetSingleWordInOperand(use_in_operand_index))) {
  1406. return false;
  1407. }
  1408. // This is an access chain index. If the (sub-)object being accessed by the
  1409. // given index has struct type then we cannot replace the use, as it needs
  1410. // to be an OpConstant.
  1411. // Get the top-level composite type that is being accessed.
  1412. auto object_being_accessed = ir_context->get_def_use_mgr()->GetDef(
  1413. use_instruction->GetSingleWordInOperand(0));
  1414. auto pointer_type =
  1415. ir_context->get_type_mgr()->GetType(object_being_accessed->type_id());
  1416. assert(pointer_type->AsPointer());
  1417. auto composite_type_being_accessed =
  1418. pointer_type->AsPointer()->pointee_type();
  1419. // Now walk the access chain, tracking the type of each sub-object of the
  1420. // composite that is traversed, until the index of interest is reached.
  1421. for (uint32_t index_in_operand = 1; index_in_operand < use_in_operand_index;
  1422. index_in_operand++) {
  1423. // For vectors, matrices and arrays, getting the type of the sub-object is
  1424. // trivial. For the struct case, the sub-object type is field-sensitive,
  1425. // and depends on the constant index that is used.
  1426. if (composite_type_being_accessed->AsVector()) {
  1427. composite_type_being_accessed =
  1428. composite_type_being_accessed->AsVector()->element_type();
  1429. } else if (composite_type_being_accessed->AsMatrix()) {
  1430. composite_type_being_accessed =
  1431. composite_type_being_accessed->AsMatrix()->element_type();
  1432. } else if (composite_type_being_accessed->AsArray()) {
  1433. composite_type_being_accessed =
  1434. composite_type_being_accessed->AsArray()->element_type();
  1435. } else if (composite_type_being_accessed->AsRuntimeArray()) {
  1436. composite_type_being_accessed =
  1437. composite_type_being_accessed->AsRuntimeArray()->element_type();
  1438. } else {
  1439. assert(composite_type_being_accessed->AsStruct());
  1440. auto constant_index_instruction = ir_context->get_def_use_mgr()->GetDef(
  1441. use_instruction->GetSingleWordInOperand(index_in_operand));
  1442. assert(constant_index_instruction->opcode() == spv::Op::OpConstant);
  1443. uint32_t member_index =
  1444. constant_index_instruction->GetSingleWordInOperand(0);
  1445. composite_type_being_accessed =
  1446. composite_type_being_accessed->AsStruct()
  1447. ->element_types()[member_index];
  1448. }
  1449. }
  1450. // We have found the composite type being accessed by the index we are
  1451. // considering replacing. If it is a struct, then we cannot do the
  1452. // replacement as struct indices must be constants.
  1453. if (composite_type_being_accessed->AsStruct()) {
  1454. return false;
  1455. }
  1456. }
  1457. if (use_instruction->opcode() == spv::Op::OpFunctionCall &&
  1458. use_in_operand_index > 0) {
  1459. // This is a function call argument. It is not allowed to have pointer
  1460. // type.
  1461. // Get the definition of the function being called.
  1462. auto function = ir_context->get_def_use_mgr()->GetDef(
  1463. use_instruction->GetSingleWordInOperand(0));
  1464. // From the function definition, get the function type.
  1465. auto function_type = ir_context->get_def_use_mgr()->GetDef(
  1466. function->GetSingleWordInOperand(1));
  1467. // OpTypeFunction's 0-th input operand is the function return type, and the
  1468. // function argument types follow. Because the arguments to OpFunctionCall
  1469. // start from input operand 1, we can use |use_in_operand_index| to get the
  1470. // type associated with this function argument.
  1471. auto parameter_type = ir_context->get_type_mgr()->GetType(
  1472. function_type->GetSingleWordInOperand(use_in_operand_index));
  1473. if (parameter_type->AsPointer()) {
  1474. return false;
  1475. }
  1476. }
  1477. if (use_instruction->opcode() == spv::Op::OpImageTexelPointer &&
  1478. use_in_operand_index == 2) {
  1479. // The OpImageTexelPointer instruction has a Sample parameter that in some
  1480. // situations must be an id for the value 0. To guard against disrupting
  1481. // that requirement, we do not replace this argument to that instruction.
  1482. return false;
  1483. }
  1484. if (ir_context->get_feature_mgr()->HasCapability(spv::Capability::Shader)) {
  1485. // With the Shader capability, memory scope and memory semantics operands
  1486. // are required to be constants, so they cannot be replaced arbitrarily.
  1487. switch (use_instruction->opcode()) {
  1488. case spv::Op::OpAtomicLoad:
  1489. case spv::Op::OpAtomicStore:
  1490. case spv::Op::OpAtomicExchange:
  1491. case spv::Op::OpAtomicIIncrement:
  1492. case spv::Op::OpAtomicIDecrement:
  1493. case spv::Op::OpAtomicIAdd:
  1494. case spv::Op::OpAtomicISub:
  1495. case spv::Op::OpAtomicSMin:
  1496. case spv::Op::OpAtomicUMin:
  1497. case spv::Op::OpAtomicSMax:
  1498. case spv::Op::OpAtomicUMax:
  1499. case spv::Op::OpAtomicAnd:
  1500. case spv::Op::OpAtomicOr:
  1501. case spv::Op::OpAtomicXor:
  1502. if (use_in_operand_index == 1 || use_in_operand_index == 2) {
  1503. return false;
  1504. }
  1505. break;
  1506. case spv::Op::OpAtomicCompareExchange:
  1507. if (use_in_operand_index == 1 || use_in_operand_index == 2 ||
  1508. use_in_operand_index == 3) {
  1509. return false;
  1510. }
  1511. break;
  1512. case spv::Op::OpAtomicCompareExchangeWeak:
  1513. case spv::Op::OpAtomicFlagTestAndSet:
  1514. case spv::Op::OpAtomicFlagClear:
  1515. case spv::Op::OpAtomicFAddEXT:
  1516. assert(false && "Not allowed with the Shader capability.");
  1517. default:
  1518. break;
  1519. }
  1520. }
  1521. return true;
  1522. }
  1523. bool MembersHaveBuiltInDecoration(opt::IRContext* ir_context,
  1524. uint32_t struct_type_id) {
  1525. const auto* type_inst = ir_context->get_def_use_mgr()->GetDef(struct_type_id);
  1526. assert(type_inst && type_inst->opcode() == spv::Op::OpTypeStruct &&
  1527. "|struct_type_id| is not a result id of an OpTypeStruct");
  1528. uint32_t builtin_count = 0;
  1529. ir_context->get_def_use_mgr()->ForEachUser(
  1530. type_inst,
  1531. [struct_type_id, &builtin_count](const opt::Instruction* user) {
  1532. if (user->opcode() == spv::Op::OpMemberDecorate &&
  1533. user->GetSingleWordInOperand(0) == struct_type_id &&
  1534. static_cast<spv::Decoration>(user->GetSingleWordInOperand(2)) ==
  1535. spv::Decoration::BuiltIn) {
  1536. ++builtin_count;
  1537. }
  1538. });
  1539. assert((builtin_count == 0 || builtin_count == type_inst->NumInOperands()) &&
  1540. "The module is invalid: either none or all of the members of "
  1541. "|struct_type_id| may be builtin");
  1542. return builtin_count != 0;
  1543. }
  1544. bool HasBlockOrBufferBlockDecoration(opt::IRContext* ir_context, uint32_t id) {
  1545. for (auto decoration :
  1546. {spv::Decoration::Block, spv::Decoration::BufferBlock}) {
  1547. if (!ir_context->get_decoration_mgr()->WhileEachDecoration(
  1548. id, uint32_t(decoration),
  1549. [](const opt::Instruction & /*unused*/) -> bool {
  1550. return false;
  1551. })) {
  1552. return true;
  1553. }
  1554. }
  1555. return false;
  1556. }
  1557. bool SplittingBeforeInstructionSeparatesOpSampledImageDefinitionFromUse(
  1558. opt::BasicBlock* block_to_split, opt::Instruction* split_before) {
  1559. std::set<uint32_t> sampled_image_result_ids;
  1560. bool before_split = true;
  1561. // Check all the instructions in the block to split.
  1562. for (auto& instruction : *block_to_split) {
  1563. if (&instruction == &*split_before) {
  1564. before_split = false;
  1565. }
  1566. if (before_split) {
  1567. // If the instruction comes before the split and its opcode is
  1568. // OpSampledImage, record its result id.
  1569. if (instruction.opcode() == spv::Op::OpSampledImage) {
  1570. sampled_image_result_ids.insert(instruction.result_id());
  1571. }
  1572. } else {
  1573. // If the instruction comes after the split, check if ids
  1574. // corresponding to OpSampledImage instructions defined before the split
  1575. // are used, and return true if they are.
  1576. if (!instruction.WhileEachInId(
  1577. [&sampled_image_result_ids](uint32_t* id) -> bool {
  1578. return !sampled_image_result_ids.count(*id);
  1579. })) {
  1580. return true;
  1581. }
  1582. }
  1583. }
  1584. // No usage that would be separated from the definition has been found.
  1585. return false;
  1586. }
  1587. bool InstructionHasNoSideEffects(const opt::Instruction& instruction) {
  1588. switch (instruction.opcode()) {
  1589. case spv::Op::OpUndef:
  1590. case spv::Op::OpAccessChain:
  1591. case spv::Op::OpInBoundsAccessChain:
  1592. case spv::Op::OpArrayLength:
  1593. case spv::Op::OpVectorExtractDynamic:
  1594. case spv::Op::OpVectorInsertDynamic:
  1595. case spv::Op::OpVectorShuffle:
  1596. case spv::Op::OpCompositeConstruct:
  1597. case spv::Op::OpCompositeExtract:
  1598. case spv::Op::OpCompositeInsert:
  1599. case spv::Op::OpCopyObject:
  1600. case spv::Op::OpTranspose:
  1601. case spv::Op::OpConvertFToU:
  1602. case spv::Op::OpConvertFToS:
  1603. case spv::Op::OpConvertSToF:
  1604. case spv::Op::OpConvertUToF:
  1605. case spv::Op::OpUConvert:
  1606. case spv::Op::OpSConvert:
  1607. case spv::Op::OpFConvert:
  1608. case spv::Op::OpQuantizeToF16:
  1609. case spv::Op::OpSatConvertSToU:
  1610. case spv::Op::OpSatConvertUToS:
  1611. case spv::Op::OpBitcast:
  1612. case spv::Op::OpSNegate:
  1613. case spv::Op::OpFNegate:
  1614. case spv::Op::OpIAdd:
  1615. case spv::Op::OpFAdd:
  1616. case spv::Op::OpISub:
  1617. case spv::Op::OpFSub:
  1618. case spv::Op::OpIMul:
  1619. case spv::Op::OpFMul:
  1620. case spv::Op::OpUDiv:
  1621. case spv::Op::OpSDiv:
  1622. case spv::Op::OpFDiv:
  1623. case spv::Op::OpUMod:
  1624. case spv::Op::OpSRem:
  1625. case spv::Op::OpSMod:
  1626. case spv::Op::OpFRem:
  1627. case spv::Op::OpFMod:
  1628. case spv::Op::OpVectorTimesScalar:
  1629. case spv::Op::OpMatrixTimesScalar:
  1630. case spv::Op::OpVectorTimesMatrix:
  1631. case spv::Op::OpMatrixTimesVector:
  1632. case spv::Op::OpMatrixTimesMatrix:
  1633. case spv::Op::OpOuterProduct:
  1634. case spv::Op::OpDot:
  1635. case spv::Op::OpIAddCarry:
  1636. case spv::Op::OpISubBorrow:
  1637. case spv::Op::OpUMulExtended:
  1638. case spv::Op::OpSMulExtended:
  1639. case spv::Op::OpAny:
  1640. case spv::Op::OpAll:
  1641. case spv::Op::OpIsNan:
  1642. case spv::Op::OpIsInf:
  1643. case spv::Op::OpIsFinite:
  1644. case spv::Op::OpIsNormal:
  1645. case spv::Op::OpSignBitSet:
  1646. case spv::Op::OpLessOrGreater:
  1647. case spv::Op::OpOrdered:
  1648. case spv::Op::OpUnordered:
  1649. case spv::Op::OpLogicalEqual:
  1650. case spv::Op::OpLogicalNotEqual:
  1651. case spv::Op::OpLogicalOr:
  1652. case spv::Op::OpLogicalAnd:
  1653. case spv::Op::OpLogicalNot:
  1654. case spv::Op::OpSelect:
  1655. case spv::Op::OpIEqual:
  1656. case spv::Op::OpINotEqual:
  1657. case spv::Op::OpUGreaterThan:
  1658. case spv::Op::OpSGreaterThan:
  1659. case spv::Op::OpUGreaterThanEqual:
  1660. case spv::Op::OpSGreaterThanEqual:
  1661. case spv::Op::OpULessThan:
  1662. case spv::Op::OpSLessThan:
  1663. case spv::Op::OpULessThanEqual:
  1664. case spv::Op::OpSLessThanEqual:
  1665. case spv::Op::OpFOrdEqual:
  1666. case spv::Op::OpFUnordEqual:
  1667. case spv::Op::OpFOrdNotEqual:
  1668. case spv::Op::OpFUnordNotEqual:
  1669. case spv::Op::OpFOrdLessThan:
  1670. case spv::Op::OpFUnordLessThan:
  1671. case spv::Op::OpFOrdGreaterThan:
  1672. case spv::Op::OpFUnordGreaterThan:
  1673. case spv::Op::OpFOrdLessThanEqual:
  1674. case spv::Op::OpFUnordLessThanEqual:
  1675. case spv::Op::OpFOrdGreaterThanEqual:
  1676. case spv::Op::OpFUnordGreaterThanEqual:
  1677. case spv::Op::OpShiftRightLogical:
  1678. case spv::Op::OpShiftRightArithmetic:
  1679. case spv::Op::OpShiftLeftLogical:
  1680. case spv::Op::OpBitwiseOr:
  1681. case spv::Op::OpBitwiseXor:
  1682. case spv::Op::OpBitwiseAnd:
  1683. case spv::Op::OpNot:
  1684. case spv::Op::OpBitFieldInsert:
  1685. case spv::Op::OpBitFieldSExtract:
  1686. case spv::Op::OpBitFieldUExtract:
  1687. case spv::Op::OpBitReverse:
  1688. case spv::Op::OpBitCount:
  1689. case spv::Op::OpCopyLogical:
  1690. case spv::Op::OpPhi:
  1691. case spv::Op::OpPtrEqual:
  1692. case spv::Op::OpPtrNotEqual:
  1693. return true;
  1694. default:
  1695. return false;
  1696. }
  1697. }
  1698. std::set<uint32_t> GetReachableReturnBlocks(opt::IRContext* ir_context,
  1699. uint32_t function_id) {
  1700. auto function = ir_context->GetFunction(function_id);
  1701. assert(function && "The function |function_id| must exist.");
  1702. std::set<uint32_t> result;
  1703. ir_context->cfg()->ForEachBlockInPostOrder(function->entry().get(),
  1704. [&result](opt::BasicBlock* block) {
  1705. if (block->IsReturn()) {
  1706. result.emplace(block->id());
  1707. }
  1708. });
  1709. return result;
  1710. }
  1711. bool NewTerminatorPreservesDominationRules(opt::IRContext* ir_context,
  1712. uint32_t block_id,
  1713. opt::Instruction new_terminator) {
  1714. auto* mutated_block = MaybeFindBlock(ir_context, block_id);
  1715. assert(mutated_block && "|block_id| is invalid");
  1716. ChangeTerminatorRAII change_terminator_raii(mutated_block,
  1717. std::move(new_terminator));
  1718. opt::DominatorAnalysis dominator_analysis;
  1719. dominator_analysis.InitializeTree(*ir_context->cfg(),
  1720. mutated_block->GetParent());
  1721. // Check that each dominator appears before each dominated block.
  1722. std::unordered_map<uint32_t, size_t> positions;
  1723. for (const auto& block : *mutated_block->GetParent()) {
  1724. positions[block.id()] = positions.size();
  1725. }
  1726. std::queue<uint32_t> q({mutated_block->GetParent()->begin()->id()});
  1727. std::unordered_set<uint32_t> visited;
  1728. while (!q.empty()) {
  1729. auto block = q.front();
  1730. q.pop();
  1731. visited.insert(block);
  1732. auto success = ir_context->cfg()->block(block)->WhileEachSuccessorLabel(
  1733. [&positions, &visited, &dominator_analysis, block, &q](uint32_t id) {
  1734. if (id == block) {
  1735. // Handle the case when loop header and continue target are the same
  1736. // block.
  1737. return true;
  1738. }
  1739. if (dominator_analysis.Dominates(block, id) &&
  1740. positions[block] > positions[id]) {
  1741. // |block| dominates |id| but appears after |id| - violates
  1742. // domination rules.
  1743. return false;
  1744. }
  1745. if (!visited.count(id)) {
  1746. q.push(id);
  1747. }
  1748. return true;
  1749. });
  1750. if (!success) {
  1751. return false;
  1752. }
  1753. }
  1754. // For each instruction in the |block->GetParent()| function check whether
  1755. // all its dependencies satisfy domination rules (i.e. all id operands
  1756. // dominate that instruction).
  1757. for (const auto& block : *mutated_block->GetParent()) {
  1758. if (!ir_context->IsReachable(block)) {
  1759. // If some block is not reachable then we don't need to worry about the
  1760. // preservation of domination rules for its instructions.
  1761. continue;
  1762. }
  1763. for (const auto& inst : block) {
  1764. for (uint32_t i = 0; i < inst.NumInOperands();
  1765. i += inst.opcode() == spv::Op::OpPhi ? 2 : 1) {
  1766. const auto& operand = inst.GetInOperand(i);
  1767. if (!spvIsInIdType(operand.type)) {
  1768. continue;
  1769. }
  1770. if (MaybeFindBlock(ir_context, operand.words[0])) {
  1771. // Ignore operands that refer to OpLabel instructions.
  1772. continue;
  1773. }
  1774. const auto* dependency_block =
  1775. ir_context->get_instr_block(operand.words[0]);
  1776. if (!dependency_block) {
  1777. // A global instruction always dominates all instructions in any
  1778. // function.
  1779. continue;
  1780. }
  1781. auto domination_target_id = inst.opcode() == spv::Op::OpPhi
  1782. ? inst.GetSingleWordInOperand(i + 1)
  1783. : block.id();
  1784. if (!dominator_analysis.Dominates(dependency_block->id(),
  1785. domination_target_id)) {
  1786. return false;
  1787. }
  1788. }
  1789. }
  1790. }
  1791. return true;
  1792. }
  1793. opt::Module::iterator GetFunctionIterator(opt::IRContext* ir_context,
  1794. uint32_t function_id) {
  1795. return std::find_if(ir_context->module()->begin(),
  1796. ir_context->module()->end(),
  1797. [function_id](const opt::Function& f) {
  1798. return f.result_id() == function_id;
  1799. });
  1800. }
  1801. // TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/3582): Add all
  1802. // opcodes that are agnostic to signedness of operands to function.
  1803. // This is not exhaustive yet.
  1804. bool IsAgnosticToSignednessOfOperand(spv::Op opcode,
  1805. uint32_t use_in_operand_index) {
  1806. switch (opcode) {
  1807. case spv::Op::OpSNegate:
  1808. case spv::Op::OpNot:
  1809. case spv::Op::OpIAdd:
  1810. case spv::Op::OpISub:
  1811. case spv::Op::OpIMul:
  1812. case spv::Op::OpSDiv:
  1813. case spv::Op::OpSRem:
  1814. case spv::Op::OpSMod:
  1815. case spv::Op::OpShiftRightLogical:
  1816. case spv::Op::OpShiftRightArithmetic:
  1817. case spv::Op::OpShiftLeftLogical:
  1818. case spv::Op::OpBitwiseOr:
  1819. case spv::Op::OpBitwiseXor:
  1820. case spv::Op::OpBitwiseAnd:
  1821. case spv::Op::OpIEqual:
  1822. case spv::Op::OpINotEqual:
  1823. case spv::Op::OpULessThan:
  1824. case spv::Op::OpSLessThan:
  1825. case spv::Op::OpUGreaterThan:
  1826. case spv::Op::OpSGreaterThan:
  1827. case spv::Op::OpULessThanEqual:
  1828. case spv::Op::OpSLessThanEqual:
  1829. case spv::Op::OpUGreaterThanEqual:
  1830. case spv::Op::OpSGreaterThanEqual:
  1831. return true;
  1832. case spv::Op::OpAtomicStore:
  1833. case spv::Op::OpAtomicExchange:
  1834. case spv::Op::OpAtomicIAdd:
  1835. case spv::Op::OpAtomicISub:
  1836. case spv::Op::OpAtomicSMin:
  1837. case spv::Op::OpAtomicUMin:
  1838. case spv::Op::OpAtomicSMax:
  1839. case spv::Op::OpAtomicUMax:
  1840. case spv::Op::OpAtomicAnd:
  1841. case spv::Op::OpAtomicOr:
  1842. case spv::Op::OpAtomicXor:
  1843. case spv::Op::OpAtomicFAddEXT: // Capability AtomicFloat32AddEXT,
  1844. // AtomicFloat64AddEXT.
  1845. assert(use_in_operand_index != 0 &&
  1846. "Signedness check should not occur on a pointer operand.");
  1847. return use_in_operand_index == 1 || use_in_operand_index == 2;
  1848. case spv::Op::OpAtomicCompareExchange:
  1849. case spv::Op::OpAtomicCompareExchangeWeak: // Capability Kernel.
  1850. assert(use_in_operand_index != 0 &&
  1851. "Signedness check should not occur on a pointer operand.");
  1852. return use_in_operand_index >= 1 && use_in_operand_index <= 3;
  1853. case spv::Op::OpAtomicLoad:
  1854. case spv::Op::OpAtomicIIncrement:
  1855. case spv::Op::OpAtomicIDecrement:
  1856. case spv::Op::OpAtomicFlagTestAndSet: // Capability Kernel.
  1857. case spv::Op::OpAtomicFlagClear: // Capability Kernel.
  1858. assert(use_in_operand_index != 0 &&
  1859. "Signedness check should not occur on a pointer operand.");
  1860. return use_in_operand_index >= 1;
  1861. case spv::Op::OpAccessChain:
  1862. // The signedness of indices does not matter.
  1863. return use_in_operand_index > 0;
  1864. default:
  1865. // Conservatively assume that the id cannot be swapped in other
  1866. // instructions.
  1867. return false;
  1868. }
  1869. }
  1870. bool TypesAreCompatible(opt::IRContext* ir_context, spv::Op opcode,
  1871. uint32_t use_in_operand_index, uint32_t type_id_1,
  1872. uint32_t type_id_2) {
  1873. assert(ir_context->get_type_mgr()->GetType(type_id_1) &&
  1874. ir_context->get_type_mgr()->GetType(type_id_2) &&
  1875. "Type ids are invalid");
  1876. return type_id_1 == type_id_2 ||
  1877. (IsAgnosticToSignednessOfOperand(opcode, use_in_operand_index) &&
  1878. fuzzerutil::TypesAreEqualUpToSign(ir_context, type_id_1, type_id_2));
  1879. }
  1880. } // namespace fuzzerutil
  1881. } // namespace fuzz
  1882. } // namespace spvtools