#include "source/fuzz/transformation_replace_params_with_struct.h"
#include <vector>
#include "source/fuzz/fuzzer_util.h"
namespace spvtools {
namespace fuzz {
TransformationReplaceParamsWithStruct::TransformationReplaceParamsWithStruct(
protobufs::TransformationReplaceParamsWithStruct message)
: message_(std::move(message)) {}
TransformationReplaceParamsWithStruct::TransformationReplaceParamsWithStruct(
const std::vector<uint32_t>& parameter_id, uint32_t fresh_function_type_id,
uint32_t fresh_parameter_id,
const std::map<uint32_t, uint32_t>& caller_id_to_fresh_composite_id) {
message_.set_fresh_function_type_id(fresh_function_type_id);
message_.set_fresh_parameter_id(fresh_parameter_id);
for (auto id : parameter_id) {
message_.add_parameter_id(id);
}
*message_.mutable_caller_id_to_fresh_composite_id() =
fuzzerutil::MapToRepeatedUInt32Pair(caller_id_to_fresh_composite_id);
}
bool TransformationReplaceParamsWithStruct::IsApplicable(
opt::IRContext* ir_context, const TransformationContext& ) const {
std::vector<uint32_t> parameter_id(message_.parameter_id().begin(),
message_.parameter_id().end());
if (parameter_id.empty() || fuzzerutil::HasDuplicates(parameter_id)) {
return false;
}
if (!ir_context->get_def_use_mgr()->GetDef(parameter_id[0])) {
return false;
}
const auto* function =
fuzzerutil::GetFunctionFromParameterId(ir_context, parameter_id[0]);
if (!function ||
fuzzerutil::FunctionIsEntryPoint(ir_context, function->result_id())) {
return false;
}
std::unordered_set<uint32_t> all_parameter_ids;
for (const auto* param :
fuzzerutil::GetParameters(ir_context, function->result_id())) {
all_parameter_ids.insert(param->result_id());
}
for (auto id : parameter_id) {
if (!ir_context->get_def_use_mgr()->GetDef(id)) {
return false;
}
if (!all_parameter_ids.count(id)) {
return false;
}
if (!IsParameterTypeSupported(ir_context,
fuzzerutil::GetTypeId(ir_context, id))) {
return false;
}
}
if (!MaybeGetRequiredStructType(ir_context)) {
return false;
}
const auto caller_id_to_fresh_composite_id =
fuzzerutil::RepeatedUInt32PairToMap(
message_.caller_id_to_fresh_composite_id());
for (const auto* inst :
fuzzerutil::GetCallers(ir_context, function->result_id())) {
if (!caller_id_to_fresh_composite_id.count(inst->result_id())) {
return false;
}
}
std::vector<uint32_t> fresh_ids = {message_.fresh_function_type_id(),
message_.fresh_parameter_id()};
for (const auto& entry : caller_id_to_fresh_composite_id) {
fresh_ids.push_back(entry.second);
}
return !fuzzerutil::HasDuplicates(fresh_ids) &&
std::all_of(fresh_ids.begin(), fresh_ids.end(),
[ir_context](uint32_t id) {
return fuzzerutil::IsFreshId(ir_context, id);
});
}
void TransformationReplaceParamsWithStruct::Apply(
opt::IRContext* ir_context, TransformationContext* ) const {
auto* function = fuzzerutil::GetFunctionFromParameterId(
ir_context, message_.parameter_id(0));
assert(function &&
"All parameters' ids should've been checked in the IsApplicable");
auto struct_type_id = MaybeGetRequiredStructType(ir_context);
assert(struct_type_id &&
"IsApplicable should've guaranteed that this value isn't equal to 0");
function->AddParameter(MakeUnique<opt::Instruction>(
ir_context, spv::Op::OpFunctionParameter, struct_type_id,
message_.fresh_parameter_id(), opt::Instruction::OperandList()));
fuzzerutil::UpdateModuleIdBound(ir_context, message_.fresh_parameter_id());
const auto indices_of_replaced_params =
ComputeIndicesOfReplacedParameters(ir_context);
const auto caller_id_to_fresh_composite_id =
fuzzerutil::RepeatedUInt32PairToMap(
message_.caller_id_to_fresh_composite_id());
for (auto* inst : fuzzerutil::GetCallers(ir_context, function->result_id())) {
opt::Instruction::OperandList composite_components;
for (auto index : indices_of_replaced_params) {
composite_components.emplace_back(
std::move(inst->GetInOperand(index + 1)));
}
for (auto index : std::set<uint32_t, std::greater<uint32_t>>(
indices_of_replaced_params.begin(),
indices_of_replaced_params.end())) {
inst->RemoveInOperand(index + 1);
}
auto fresh_composite_id =
caller_id_to_fresh_composite_id.at(inst->result_id());
inst->InsertBefore(MakeUnique<opt::Instruction>(
ir_context, spv::Op::OpCompositeConstruct, struct_type_id,
fresh_composite_id, std::move(composite_components)));
inst->AddOperand({SPV_OPERAND_TYPE_ID, {fresh_composite_id}});
fuzzerutil::UpdateModuleIdBound(ir_context, fresh_composite_id);
}
for (int i = 0; i < message_.parameter_id_size(); ++i) {
const auto* param_inst =
ir_context->get_def_use_mgr()->GetDef(message_.parameter_id(i));
assert(param_inst && "Parameter id is invalid");
auto iter = function->begin()->begin();
while (iter != function->begin()->end() &&
!fuzzerutil::CanInsertOpcodeBeforeInstruction(
spv::Op::OpCompositeExtract, iter)) {
++iter;
}
assert(fuzzerutil::CanInsertOpcodeBeforeInstruction(
spv::Op::OpCompositeExtract, iter) &&
"Can't extract parameter's value from the structure");
iter.InsertBefore(MakeUnique<opt::Instruction>(
ir_context, spv::Op::OpCompositeExtract, param_inst->type_id(),
param_inst->result_id(),
opt::Instruction::OperandList{
{SPV_OPERAND_TYPE_ID, {message_.fresh_parameter_id()}},
{SPV_OPERAND_TYPE_LITERAL_INTEGER, {static_cast<uint32_t>(i)}}}));
fuzzerutil::RemoveParameter(ir_context, param_inst->result_id());
}
{
auto* old_function_type = fuzzerutil::GetFunctionType(ir_context, function);
assert(old_function_type && "Function has invalid type");
std::vector<uint32_t> parameter_type_ids;
for (uint32_t i = 1; i < old_function_type->NumInOperands(); ++i) {
if (std::find(indices_of_replaced_params.begin(),
indices_of_replaced_params.end(),
i - 1) == indices_of_replaced_params.end()) {
parameter_type_ids.push_back(
old_function_type->GetSingleWordInOperand(i));
}
}
parameter_type_ids.push_back(struct_type_id);
fuzzerutil::UpdateFunctionType(
ir_context, function->result_id(), message_.fresh_function_type_id(),
old_function_type->GetSingleWordInOperand(0), parameter_type_ids);
}
ir_context->InvalidateAnalysesExceptFor(
opt::IRContext::Analysis::kAnalysisNone);
}
protobufs::Transformation TransformationReplaceParamsWithStruct::ToMessage()
const {
protobufs::Transformation result;
*result.mutable_replace_params_with_struct() = message_;
return result;
}
bool TransformationReplaceParamsWithStruct::IsParameterTypeSupported(
opt::IRContext* ir_context, uint32_t param_type_id) {
return fuzzerutil::CanCreateConstant(ir_context, param_type_id);
}
uint32_t TransformationReplaceParamsWithStruct::MaybeGetRequiredStructType(
opt::IRContext* ir_context) const {
std::vector<uint32_t> component_type_ids;
for (auto id : message_.parameter_id()) {
component_type_ids.push_back(fuzzerutil::GetTypeId(ir_context, id));
}
return fuzzerutil::MaybeGetStructType(ir_context, component_type_ids);
}
std::vector<uint32_t>
TransformationReplaceParamsWithStruct::ComputeIndicesOfReplacedParameters(
opt::IRContext* ir_context) const {
assert(!message_.parameter_id().empty() &&
"There must be at least one parameter to replace");
const auto* function = fuzzerutil::GetFunctionFromParameterId(
ir_context, message_.parameter_id(0));
assert(function && "|parameter_id|s are invalid");
std::vector<uint32_t> result;
auto params = fuzzerutil::GetParameters(ir_context, function->result_id());
for (auto id : message_.parameter_id()) {
auto it = std::find_if(params.begin(), params.end(),
[id](const opt::Instruction* param) {
return param->result_id() == id;
});
assert(it != params.end() && "Parameter's id is invalid");
result.push_back(static_cast<uint32_t>(it - params.begin()));
}
return result;
}
std::unordered_set<uint32_t>
TransformationReplaceParamsWithStruct::GetFreshIds() const {
std::unordered_set<uint32_t> result = {message_.fresh_function_type_id(),
message_.fresh_parameter_id()};
for (auto& pair : message_.caller_id_to_fresh_composite_id()) {
result.insert(pair.second());
}
return result;
}
}
}