#include "source/fuzz/transformation_store.h"
#include "gtest/gtest.h"
#include "source/fuzz/fuzzer_util.h"
#include "source/fuzz/instruction_descriptor.h"
#include "test/fuzz/fuzz_test_util.h"
namespace spvtools {
namespace fuzz {
namespace {
TEST(TransformationStoreTest, BasicTest) {
std::string shader = R"(
OpCapability Shader
OpCapability VariablePointers
%1 = OpExtInstImport "GLSL.std.450"
OpMemoryModel Logical GLSL450
OpEntryPoint Fragment %4 "main" %92 %52 %53
OpExecutionMode %4 OriginUpperLeft
OpSource ESSL 310
OpDecorate %92 BuiltIn FragCoord
%2 = OpTypeVoid
%3 = OpTypeFunction %2
%6 = OpTypeInt 32 1
%7 = OpTypeFloat 32
%8 = OpTypeStruct %6 %7
%9 = OpTypePointer Function %8
%10 = OpTypeFunction %6 %9
%14 = OpConstant %6 0
%15 = OpTypePointer Function %6
%51 = OpTypePointer Private %6
%21 = OpConstant %6 2
%23 = OpConstant %6 1
%24 = OpConstant %7 1
%25 = OpTypePointer Function %7
%50 = OpTypePointer Private %7
%34 = OpTypeBool
%35 = OpConstantFalse %34
%60 = OpConstantNull %50
%52 = OpVariable %50 Private
%53 = OpVariable %51 Private
%80 = OpConstantComposite %8 %21 %24
%90 = OpTypeVector %7 4
%91 = OpTypePointer Input %90
%92 = OpVariable %91 Input
%93 = OpConstantComposite %90 %24 %24 %24 %24
%4 = OpFunction %2 None %3
%5 = OpLabel
%20 = OpVariable %9 Function
%27 = OpVariable %9 Function ; irrelevant
%22 = OpAccessChain %15 %20 %14
%44 = OpCopyObject %9 %20
%26 = OpAccessChain %25 %20 %23
%29 = OpFunctionCall %6 %12 %27
%30 = OpAccessChain %15 %20 %14
%45 = OpCopyObject %15 %30
%81 = OpCopyObject %9 %27 ; irrelevant
%33 = OpAccessChain %15 %20 %14
OpSelectionMerge %37 None
OpBranchConditional %35 %36 %37
%36 = OpLabel
%38 = OpAccessChain %15 %20 %14
%40 = OpAccessChain %15 %20 %14
%43 = OpAccessChain %15 %20 %14
%82 = OpCopyObject %9 %27 ; irrelevant
OpBranch %37
%37 = OpLabel
OpReturn
OpFunctionEnd
%12 = OpFunction %6 None %10
%11 = OpFunctionParameter %9 ; irrelevant
%13 = OpLabel
%46 = OpCopyObject %9 %11 ; irrelevant
%16 = OpAccessChain %15 %11 %14 ; irrelevant
%95 = OpCopyObject %8 %80
OpReturnValue %21
OpFunctionEnd
)";
const auto env = SPV_ENV_UNIVERSAL_1_4;
const auto consumer = nullptr;
const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
spvtools::ValidatorOptions validator_options;
ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options,
kConsoleMessageConsumer));
TransformationContext transformation_context(
MakeUnique<FactManager>(context.get()), validator_options);
transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
27);
transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
11);
transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
46);
transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
16);
transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
52);
transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
81);
transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
82);
transformation_context.GetFactManager()->AddFactBlockIsDead(36);
ASSERT_FALSE(TransformationStore(
11, false, 0, 0, 80,
MakeInstructionDescriptor(38, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
81, false, 0, 0, 80,
MakeInstructionDescriptor(45, spv::Op::OpCopyObject, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(
TransformationStore(52, false, 0, 0, 24,
MakeInstructionDescriptor(27, spv::Op::OpVariable, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
1000, false, 0, 0, 24,
MakeInstructionDescriptor(38, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
5, false, 0, 0, 24,
MakeInstructionDescriptor(38, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
24, false, 0, 0, 24,
MakeInstructionDescriptor(38, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
60, false, 0, 0, 24,
MakeInstructionDescriptor(38, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
61, false, 0, 0, 21,
MakeInstructionDescriptor(38, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(
TransformationStore(82, false, 0, 0, 80,
MakeInstructionDescriptor(37, spv::Op::OpReturn, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
27, false, 0, 0, 1000,
MakeInstructionDescriptor(38, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
27, false, 0, 0, 15,
MakeInstructionDescriptor(38, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
27, false, 0, 0, 14,
MakeInstructionDescriptor(38, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
92, false, 0, 0, 93,
MakeInstructionDescriptor(40, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
27, false, 0, 0, 95,
MakeInstructionDescriptor(40, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
20, false, 0, 0, 95,
MakeInstructionDescriptor(45, spv::Op::OpCopyObject, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
27, false, 0, 0, 80,
MakeInstructionDescriptor(1000, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
{
TransformationStore transformation(
27, false, 0, 0, 80,
MakeInstructionDescriptor(38, spv::Op::OpAccessChain, 0));
ASSERT_TRUE(
transformation.IsApplicable(context.get(), transformation_context));
ApplyAndCheckFreshIds(transformation, context.get(),
&transformation_context);
ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(
context.get(), validator_options, kConsoleMessageConsumer));
}
{
TransformationStore transformation(
11, false, 0, 0, 95,
MakeInstructionDescriptor(95, spv::Op::OpReturnValue, 0));
ASSERT_TRUE(
transformation.IsApplicable(context.get(), transformation_context));
ApplyAndCheckFreshIds(transformation, context.get(),
&transformation_context);
ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(
context.get(), validator_options, kConsoleMessageConsumer));
}
{
TransformationStore transformation(
46, false, 0, 0, 80,
MakeInstructionDescriptor(95, spv::Op::OpReturnValue, 0));
ASSERT_TRUE(
transformation.IsApplicable(context.get(), transformation_context));
ApplyAndCheckFreshIds(transformation, context.get(),
&transformation_context);
ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(
context.get(), validator_options, kConsoleMessageConsumer));
}
{
TransformationStore transformation(
16, false, 0, 0, 21,
MakeInstructionDescriptor(95, spv::Op::OpReturnValue, 0));
ASSERT_TRUE(
transformation.IsApplicable(context.get(), transformation_context));
ApplyAndCheckFreshIds(transformation, context.get(),
&transformation_context);
ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(
context.get(), validator_options, kConsoleMessageConsumer));
}
{
TransformationStore transformation(
53, false, 0, 0, 21,
MakeInstructionDescriptor(38, spv::Op::OpAccessChain, 0));
ASSERT_TRUE(
transformation.IsApplicable(context.get(), transformation_context));
ApplyAndCheckFreshIds(transformation, context.get(),
&transformation_context);
ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(
context.get(), validator_options, kConsoleMessageConsumer));
}
std::string after_transformation = R"(
OpCapability Shader
OpCapability VariablePointers
%1 = OpExtInstImport "GLSL.std.450"
OpMemoryModel Logical GLSL450
OpEntryPoint Fragment %4 "main" %92 %52 %53
OpExecutionMode %4 OriginUpperLeft
OpSource ESSL 310
OpDecorate %92 BuiltIn FragCoord
%2 = OpTypeVoid
%3 = OpTypeFunction %2
%6 = OpTypeInt 32 1
%7 = OpTypeFloat 32
%8 = OpTypeStruct %6 %7
%9 = OpTypePointer Function %8
%10 = OpTypeFunction %6 %9
%14 = OpConstant %6 0
%15 = OpTypePointer Function %6
%51 = OpTypePointer Private %6
%21 = OpConstant %6 2
%23 = OpConstant %6 1
%24 = OpConstant %7 1
%25 = OpTypePointer Function %7
%50 = OpTypePointer Private %7
%34 = OpTypeBool
%35 = OpConstantFalse %34
%60 = OpConstantNull %50
%52 = OpVariable %50 Private
%53 = OpVariable %51 Private
%80 = OpConstantComposite %8 %21 %24
%90 = OpTypeVector %7 4
%91 = OpTypePointer Input %90
%92 = OpVariable %91 Input
%93 = OpConstantComposite %90 %24 %24 %24 %24
%4 = OpFunction %2 None %3
%5 = OpLabel
%20 = OpVariable %9 Function
%27 = OpVariable %9 Function ; irrelevant
%22 = OpAccessChain %15 %20 %14
%44 = OpCopyObject %9 %20
%26 = OpAccessChain %25 %20 %23
%29 = OpFunctionCall %6 %12 %27
%30 = OpAccessChain %15 %20 %14
%45 = OpCopyObject %15 %30
%81 = OpCopyObject %9 %27 ; irrelevant
%33 = OpAccessChain %15 %20 %14
OpSelectionMerge %37 None
OpBranchConditional %35 %36 %37
%36 = OpLabel
OpStore %27 %80
OpStore %53 %21
%38 = OpAccessChain %15 %20 %14
%40 = OpAccessChain %15 %20 %14
%43 = OpAccessChain %15 %20 %14
%82 = OpCopyObject %9 %27 ; irrelevant
OpBranch %37
%37 = OpLabel
OpReturn
OpFunctionEnd
%12 = OpFunction %6 None %10
%11 = OpFunctionParameter %9 ; irrelevant
%13 = OpLabel
%46 = OpCopyObject %9 %11 ; irrelevant
%16 = OpAccessChain %15 %11 %14 ; irrelevant
%95 = OpCopyObject %8 %80
OpStore %11 %95
OpStore %46 %80
OpStore %16 %21
OpReturnValue %21
OpFunctionEnd
)";
ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
}
TEST(TransformationStoreTest, DoNotAllowStoresToReadOnlyMemory) {
std::string shader = R"(
OpCapability Shader
%1 = OpExtInstImport "GLSL.std.450"
OpMemoryModel Logical GLSL450
OpEntryPoint Fragment %4 "main"
OpExecutionMode %4 OriginUpperLeft
OpSource ESSL 320
OpMemberDecorate %10 0 Offset 0
OpMemberDecorate %10 1 Offset 4
OpDecorate %10 Block
OpMemberDecorate %23 0 Offset 0
OpDecorate %23 Block
OpDecorate %25 DescriptorSet 0
OpDecorate %25 Binding 0
%2 = OpTypeVoid
%3 = OpTypeFunction %2
%6 = OpTypeInt 32 1
%7 = OpTypePointer Function %6
%9 = OpTypeFloat 32
%10 = OpTypeStruct %6 %9
%11 = OpTypePointer PushConstant %10
%12 = OpVariable %11 PushConstant
%13 = OpConstant %6 0
%14 = OpTypePointer PushConstant %6
%17 = OpConstant %6 1
%18 = OpTypePointer PushConstant %9
%23 = OpTypeStruct %9
%24 = OpTypePointer UniformConstant %23
%25 = OpVariable %24 UniformConstant
%26 = OpTypePointer UniformConstant %9
%50 = OpConstant %9 0
%4 = OpFunction %2 None %3
%5 = OpLabel
%15 = OpAccessChain %14 %12 %13
%19 = OpAccessChain %18 %12 %17
%27 = OpAccessChain %26 %25 %13
OpReturn
OpFunctionEnd
)";
const auto env = SPV_ENV_UNIVERSAL_1_3;
const auto consumer = nullptr;
const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
spvtools::ValidatorOptions validator_options;
ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options,
kConsoleMessageConsumer));
TransformationContext transformation_context(
MakeUnique<FactManager>(context.get()), validator_options);
transformation_context.GetFactManager()->AddFactBlockIsDead(5);
ASSERT_FALSE(
TransformationStore(15, false, 0, 0, 13,
MakeInstructionDescriptor(27, spv::Op::OpReturn, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(
TransformationStore(19, false, 0, 0, 50,
MakeInstructionDescriptor(27, spv::Op::OpReturn, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(
TransformationStore(27, false, 0, 0, 50,
MakeInstructionDescriptor(27, spv::Op::OpReturn, 0))
.IsApplicable(context.get(), transformation_context));
}
TEST(TransformationStoreTest, SupportAtomicStore) {
const std::string shader = R"(
OpCapability Shader
OpCapability Int8
%1 = OpExtInstImport "GLSL.std.450"
OpMemoryModel Logical GLSL450
OpEntryPoint Fragment %4 "main"
OpExecutionMode %4 OriginUpperLeft
OpSource ESSL 320
%2 = OpTypeVoid
%3 = OpTypeFunction %2
%6 = OpTypeInt 32 1
%7 = OpTypeInt 8 1
%9 = OpTypeInt 32 0
%26 = OpTypeFloat 32
%8 = OpTypeStruct %6
%10 = OpTypePointer StorageBuffer %8
%11 = OpVariable %10 StorageBuffer
%19 = OpConstant %26 0
%18 = OpConstant %9 1
%12 = OpConstant %6 0
%13 = OpTypePointer StorageBuffer %6
%15 = OpConstant %6 4
%16 = OpConstant %6 7
%17 = OpConstant %7 4
%20 = OpConstant %9 64
%21 = OpConstant %6 15
%4 = OpFunction %2 None %3
%5 = OpLabel
%14 = OpAccessChain %13 %11 %12
%24 = OpAccessChain %13 %11 %12
OpReturn
OpFunctionEnd
)";
const auto env = SPV_ENV_UNIVERSAL_1_3;
const auto consumer = nullptr;
const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
spvtools::ValidatorOptions validator_options;
ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options,
kConsoleMessageConsumer));
TransformationContext transformation_context(
MakeUnique<FactManager>(context.get()), validator_options);
transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
14);
ASSERT_FALSE(TransformationStore(
14, true, 100, 20, 21,
MakeInstructionDescriptor(24, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
14, true, 15, 100, 21,
MakeInstructionDescriptor(24, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
14, true, 5, 20, 21,
MakeInstructionDescriptor(24, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
14, true, 15, 5, 21,
MakeInstructionDescriptor(24, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
14, true, 15, 19, 21,
MakeInstructionDescriptor(24, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
14, true, 19, 20, 21,
MakeInstructionDescriptor(24, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
14, true, 17, 20, 21,
MakeInstructionDescriptor(24, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
14, true, 15, 17, 21,
MakeInstructionDescriptor(24, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
14, true, 16, 20, 21,
MakeInstructionDescriptor(24, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
14, true, 15, 16, 21,
MakeInstructionDescriptor(24, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
14, true, 15, 20, 21,
MakeInstructionDescriptor(150, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
14, true, 15, 20, 21,
MakeInstructionDescriptor(15, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
ASSERT_FALSE(TransformationStore(
14, true, 15, 20, 21,
MakeInstructionDescriptor(20, spv::Op::OpAccessChain, 0))
.IsApplicable(context.get(), transformation_context));
{
TransformationStore transformation(
14, true, 15, 20, 21,
MakeInstructionDescriptor(24, spv::Op::OpReturn, 0));
ASSERT_TRUE(
transformation.IsApplicable(context.get(), transformation_context));
ApplyAndCheckFreshIds(transformation, context.get(),
&transformation_context);
ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(
context.get(), validator_options, kConsoleMessageConsumer));
}
const std::string after_transformation = R"(
OpCapability Shader
OpCapability Int8
%1 = OpExtInstImport "GLSL.std.450"
OpMemoryModel Logical GLSL450
OpEntryPoint Fragment %4 "main"
OpExecutionMode %4 OriginUpperLeft
OpSource ESSL 320
%2 = OpTypeVoid
%3 = OpTypeFunction %2
%6 = OpTypeInt 32 1
%7 = OpTypeInt 8 1
%9 = OpTypeInt 32 0
%26 = OpTypeFloat 32
%8 = OpTypeStruct %6
%10 = OpTypePointer StorageBuffer %8
%11 = OpVariable %10 StorageBuffer
%19 = OpConstant %26 0
%18 = OpConstant %9 1
%12 = OpConstant %6 0
%13 = OpTypePointer StorageBuffer %6
%15 = OpConstant %6 4
%16 = OpConstant %6 7
%17 = OpConstant %7 4
%20 = OpConstant %9 64
%21 = OpConstant %6 15
%4 = OpFunction %2 None %3
%5 = OpLabel
%14 = OpAccessChain %13 %11 %12
%24 = OpAccessChain %13 %11 %12
OpAtomicStore %14 %15 %20 %21
OpReturn
OpFunctionEnd
)";
ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
}
} } }