1 // Copyright (c) 2020 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "source/fuzz/fuzzer_pass_add_global_variables.h"
16
17 #include "source/fuzz/transformation_add_global_variable.h"
18 #include "source/fuzz/transformation_add_type_pointer.h"
19
20 namespace spvtools {
21 namespace fuzz {
22
FuzzerPassAddGlobalVariables( opt::IRContext* ir_context, TransformationContext* transformation_context, FuzzerContext* fuzzer_context, protobufs::TransformationSequence* transformations, bool ignore_inapplicable_transformations)23 FuzzerPassAddGlobalVariables::FuzzerPassAddGlobalVariables(
24 opt::IRContext* ir_context, TransformationContext* transformation_context,
25 FuzzerContext* fuzzer_context,
26 protobufs::TransformationSequence* transformations,
27 bool ignore_inapplicable_transformations)
28 : FuzzerPass(ir_context, transformation_context, fuzzer_context,
29 transformations, ignore_inapplicable_transformations) {}
30
Apply()31 void FuzzerPassAddGlobalVariables::Apply() {
32 spv::StorageClass variable_storage_class = spv::StorageClass::Private;
33 for (auto& entry_point : GetIRContext()->module()->entry_points()) {
34 // If the execution model of some entry point is GLCompute,
35 // then the variable storage class may be Workgroup.
36 if (spv::ExecutionModel(entry_point.GetSingleWordInOperand(0)) ==
37 spv::ExecutionModel::GLCompute) {
38 variable_storage_class =
39 GetFuzzerContext()->ChoosePercentage(
40 GetFuzzerContext()->GetChanceOfChoosingWorkgroupStorageClass())
41 ? spv::StorageClass::Workgroup
42 : spv::StorageClass::Private;
43 break;
44 }
45 }
46
47 auto basic_type_ids_and_pointers =
48 GetAvailableBasicTypesAndPointers(variable_storage_class);
49
50 // These are the basic types that are available to this fuzzer pass.
51 auto& basic_types = basic_type_ids_and_pointers.first;
52 if (basic_types.empty()) {
53 // There are no basic types, so there is nothing this fuzzer pass can do.
54 return;
55 }
56
57 // These are the pointers to those basic types that are *initially* available
58 // to the fuzzer pass. The fuzzer pass might add pointer types in cases where
59 // none are available for a given basic type.
60 auto& basic_type_to_pointers = basic_type_ids_and_pointers.second;
61
62 // Probabilistically keep adding global variables.
63 while (GetFuzzerContext()->ChoosePercentage(
64 GetFuzzerContext()->GetChanceOfAddingGlobalVariable())) {
65 // Choose a random basic type; the new variable's type will be a pointer to
66 // this basic type.
67 uint32_t basic_type =
68 basic_types[GetFuzzerContext()->RandomIndex(basic_types)];
69 uint32_t pointer_type_id;
70 std::vector<uint32_t>& available_pointers_to_basic_type =
71 basic_type_to_pointers.at(basic_type);
72 // Determine whether there is at least one pointer to this basic type.
73 if (available_pointers_to_basic_type.empty()) {
74 // There is not. Make one, to use here, and add it to the available
75 // pointers for the basic type so that future variables can potentially
76 // use it.
77 pointer_type_id = GetFuzzerContext()->GetFreshId();
78 available_pointers_to_basic_type.push_back(pointer_type_id);
79 ApplyTransformation(TransformationAddTypePointer(
80 pointer_type_id, variable_storage_class, basic_type));
81 } else {
82 // There is - grab one.
83 pointer_type_id =
84 available_pointers_to_basic_type[GetFuzzerContext()->RandomIndex(
85 available_pointers_to_basic_type)];
86 }
87
88 ApplyTransformation(TransformationAddGlobalVariable(
89 GetFuzzerContext()->GetFreshId(), pointer_type_id,
90 variable_storage_class,
91 variable_storage_class == spv::StorageClass::Private
92 ? FindOrCreateZeroConstant(basic_type, false)
93 : 0,
94 true));
95 }
96 }
97
98 } // namespace fuzz
99 } // namespace spvtools
100