source/fuzz/fuzzer_pass_add_copy_memory.cpp

   1 // Copyright (c) 2020 Vasyl Teliman
   2 //
   3 // Licensed under the Apache License, Version 2.0 (the "License");
   4 // you may not use this file except in compliance with the License.
   5 // You may obtain a copy of the License at
   6 //
   7 //     http://www.apache.org/licenses/LICENSE-2.0
   8 //
   9 // Unless required by applicable law or agreed to in writing, software
  10 // distributed under the License is distributed on an "AS IS" BASIS,
  11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12 // See the License for the specific language governing permissions and
  13 // limitations under the License.
  14
  15 #include "source/fuzz/fuzzer_pass_add_copy_memory.h"
  16
  17 #include "source/fuzz/fuzzer_context.h"
  18 #include "source/fuzz/fuzzer_util.h"
  19 #include "source/fuzz/instruction_descriptor.h"
  20 #include "source/fuzz/transformation_add_copy_memory.h"
  21
  22 namespace spvtools {
  23 namespace fuzz {
  24
  25 FuzzerPassAddCopyMemory::FuzzerPassAddCopyMemory(
  26     opt::IRContext* ir_context, TransformationContext* transformation_context,
  27     FuzzerContext* fuzzer_context,
  28     protobufs::TransformationSequence* transformations,
  29     bool ignore_inapplicable_transformations)
  30     : FuzzerPass(ir_context, transformation_context, fuzzer_context,
  31                  transformations, ignore_inapplicable_transformations) {}
  32
  33 void FuzzerPassAddCopyMemory::Apply() {
  34   ForEachInstructionWithInstructionDescriptor(
  35       [this](opt::Function* function, opt::BasicBlock* block,
  36              opt::BasicBlock::iterator inst_it,
  37              const protobufs::InstructionDescriptor& instruction_descriptor) {
  38         // Check that we can insert an OpCopyMemory before this instruction.
  39         if (!fuzzerutil::CanInsertOpcodeBeforeInstruction(spv::Op::OpCopyMemory,
  40                                                           inst_it)) {
  41           return;
  42         }
  43
  44         if (!GetFuzzerContext()->ChoosePercentage(
  45                 GetFuzzerContext()->GetChanceOfAddingCopyMemory())) {
  46           return;
  47         }
  48
  49         // Get all instructions available before |inst_it| according to the
  50         // domination rules.
  51         auto instructions = FindAvailableInstructions(
  52             function, block, inst_it,
  53             TransformationAddCopyMemory::IsInstructionSupported);
  54
  55         if (instructions.empty()) {
  56           return;
  57         }
  58
  59         const auto* inst =
  60             instructions[GetFuzzerContext()->RandomIndex(instructions)];
  61
  62         // Decide whether to create global or local variable.
  63         auto storage_class = GetFuzzerContext()->ChooseEven()
  64                                  ? spv::StorageClass::Private
  65                                  : spv::StorageClass::Function;
  66
  67         auto pointee_type_id = fuzzerutil::GetPointeeTypeIdFromPointerType(
  68             GetIRContext(), inst->type_id());
  69
  70         // Create a pointer type with |storage_class| if needed.
  71         FindOrCreatePointerType(pointee_type_id, storage_class);
  72
  73         ApplyTransformation(TransformationAddCopyMemory(
  74             instruction_descriptor, GetFuzzerContext()->GetFreshId(),
  75             inst->result_id(), storage_class,
  76             FindOrCreateZeroConstant(pointee_type_id, false)));
  77       });
  78 }
  79
  80 }  // namespace fuzz
  81 }  // namespace spvtools