source/fuzz/fuzzer_pass_add_parameters.cpp

   1 // Copyright (c) 2020 Vasyl Teliman
   2 //
   3 // Licensed under the Apache License, Version 2.0 (the "License");
   4 // you may not use this file except in compliance with the License.
   5 // You may obtain a copy of the License at
   6 //
   7 //     http://www.apache.org/licenses/LICENSE-2.0
   8 //
   9 // Unless required by applicable law or agreed to in writing, software
  10 // distributed under the License is distributed on an "AS IS" BASIS,
  11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12 // See the License for the specific language governing permissions and
  13 // limitations under the License.
  14
  15 #include "source/fuzz/fuzzer_pass_add_parameters.h"
  16
  17 #include "source/fuzz/fuzzer_context.h"
  18 #include "source/fuzz/fuzzer_util.h"
  19 #include "source/fuzz/instruction_descriptor.h"
  20 #include "source/fuzz/transformation_add_parameter.h"
  21
  22 namespace spvtools {
  23 namespace fuzz {
  24
  25 FuzzerPassAddParameters::FuzzerPassAddParameters(
  26     opt::IRContext* ir_context, TransformationContext* transformation_context,
  27     FuzzerContext* fuzzer_context,
  28     protobufs::TransformationSequence* transformations,
  29     bool ignore_inapplicable_transformations)
  30     : FuzzerPass(ir_context, transformation_context, fuzzer_context,
  31                  transformations, ignore_inapplicable_transformations) {}
  32
  33 void FuzzerPassAddParameters::Apply() {
  34   // Compute type candidates for the new parameter.
  35   std::vector<uint32_t> type_candidates;
  36   for (const auto& type_inst : GetIRContext()->module()->GetTypes()) {
  37     if (TransformationAddParameter::IsParameterTypeSupported(
  38             GetIRContext(), type_inst->result_id())) {
  39       type_candidates.push_back(type_inst->result_id());
  40     }
  41   }
  42
  43   if (type_candidates.empty()) {
  44     // The module contains no suitable types to use in new parameters.
  45     return;
  46   }
  47
  48   // Iterate over all functions in the module.
  49   for (const auto& function : *GetIRContext()->module()) {
  50     // Skip all entry-point functions - we don't want to change those.
  51     if (fuzzerutil::FunctionIsEntryPoint(GetIRContext(),
  52                                          function.result_id())) {
  53       continue;
  54     }
  55
  56     if (GetNumberOfParameters(function) >=
  57         GetFuzzerContext()->GetMaximumNumberOfFunctionParameters()) {
  58       continue;
  59     }
  60
  61     if (!GetFuzzerContext()->ChoosePercentage(
  62             GetFuzzerContext()->GetChanceOfAddingParameters())) {
  63       continue;
  64     }
  65
  66     auto num_new_parameters =
  67         GetFuzzerContext()->GetRandomNumberOfNewParameters(
  68             GetNumberOfParameters(function));
  69
  70     for (uint32_t i = 0; i < num_new_parameters; ++i) {
  71       auto current_type_id =
  72           type_candidates[GetFuzzerContext()->RandomIndex(type_candidates)];
  73       auto current_type =
  74           GetIRContext()->get_type_mgr()->GetType(current_type_id);
  75       std::map<uint32_t, uint32_t> call_parameter_ids;
  76
  77       // Consider the case when a pointer type was selected.
  78       if (current_type->kind() == opt::analysis::Type::kPointer) {
  79         auto storage_class = fuzzerutil::GetStorageClassFromPointerType(
  80             GetIRContext(), current_type_id);
  81         switch (storage_class) {
  82           case spv::StorageClass::Function: {
  83             // In every caller find or create a local variable that has the
  84             // selected type.
  85             for (auto* instr :
  86                  fuzzerutil::GetCallers(GetIRContext(), function.result_id())) {
  87               auto block = GetIRContext()->get_instr_block(instr);
  88               auto function_id = block->GetParent()->result_id();
  89               uint32_t variable_id =
  90                   FindOrCreateLocalVariable(current_type_id, function_id, true);
  91               call_parameter_ids[instr->result_id()] = variable_id;
  92             }
  93           } break;
  94           case spv::StorageClass::Private:
  95           case spv::StorageClass::Workgroup: {
  96             // If there exists at least one caller, find or create a global
  97             // variable that has the selected type.
  98             std::vector<opt::Instruction*> callers =
  99                 fuzzerutil::GetCallers(GetIRContext(), function.result_id());
 100             if (!callers.empty()) {
 101               uint32_t variable_id =
 102                   FindOrCreateGlobalVariable(current_type_id, true);
 103               for (auto* instr : callers) {
 104                 call_parameter_ids[instr->result_id()] = variable_id;
 105               }
 106             }
 107           } break;
 108           default:
 109             break;
 110         }
 111       } else {
 112         // If there exists at least one caller, find or create a zero constant
 113         // that has the selected type.
 114         std::vector<opt::Instruction*> callers =
 115             fuzzerutil::GetCallers(GetIRContext(), function.result_id());
 116         if (!callers.empty()) {
 117           uint32_t constant_id =
 118               FindOrCreateZeroConstant(current_type_id, true);
 119           for (auto* instr :
 120                fuzzerutil::GetCallers(GetIRContext(), function.result_id())) {
 121             call_parameter_ids[instr->result_id()] = constant_id;
 122           }
 123         }
 124       }
 125
 126       ApplyTransformation(TransformationAddParameter(
 127           function.result_id(), GetFuzzerContext()->GetFreshId(),
 128           current_type_id, std::move(call_parameter_ids),
 129           GetFuzzerContext()->GetFreshId()));
 130     }
 131   }
 132 }
 133
 134 uint32_t FuzzerPassAddParameters::GetNumberOfParameters(
 135     const opt::Function& function) const {
 136   const auto* type = GetIRContext()->get_type_mgr()->GetType(
 137       function.DefInst().GetSingleWordInOperand(1));
 138   assert(type && type->AsFunction());
 139
 140   return static_cast<uint32_t>(type->AsFunction()->param_types().size());
 141 }
 142
 143 }  // namespace fuzz
 144 }  // namespace spvtools