source/fuzz/fuzzer_pass_inline_functions.cpp

// Copyright (c) 2020 André Perez Maselco
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include "source/fuzz/fuzzer_pass_inline_functions.h"

#include "source/fuzz/fuzzer_util.h"
#include "source/fuzz/instruction_descriptor.h"
#include "source/fuzz/transformation_inline_function.h"
#include "source/fuzz/transformation_split_block.h"

namespace spvtools {
namespace fuzz {

FuzzerPassInlineFunctions::FuzzerPassInlineFunctions(
    opt::IRContext* ir_context, TransformationContext* transformation_context,
    FuzzerContext* fuzzer_context,
    protobufs::TransformationSequence* transformations,
    bool ignore_inapplicable_transformations)
    : FuzzerPass(ir_context, transformation_context, fuzzer_context,
                 transformations, ignore_inapplicable_transformations) {}

void FuzzerPassInlineFunctions::Apply() {
  // |function_call_instructions| are the instructions that will be inlined.
  // First, they will be collected and then do the inlining in another loop.
  // This avoids changing the module while it is being inspected.
  std::vector<opt::Instruction*> function_call_instructions;

  for (auto& function : *GetIRContext()->module()) {
    for (auto& block : function) {
      for (auto& instruction : block) {
        if (!GetFuzzerContext()->ChoosePercentage(
                GetFuzzerContext()->GetChanceOfInliningFunction())) {
          continue;
        }

        // |instruction| must be suitable for inlining.
        if (!TransformationInlineFunction::IsSuitableForInlining(
                GetIRContext(), &instruction)) {
          continue;
        }

        function_call_instructions.push_back(&instruction);
      }
    }
  }

  // Once the function calls have been collected, it's time to actually create
  // and apply the inlining transformations.
  for (auto& function_call_instruction : function_call_instructions) {
    // If |function_call_instruction| is not the penultimate instruction in its
    // block or its block termination instruction is not OpBranch, then try to
    // split |function_call_block| such that the conditions are met.
    auto* function_call_block =
        GetIRContext()->get_instr_block(function_call_instruction);
    if ((function_call_instruction != &*--function_call_block->tail() ||
         function_call_block->terminator()->opcode() != SpvOpBranch) &&
        !MaybeApplyTransformation(TransformationSplitBlock(
            MakeInstructionDescriptor(GetIRContext(),
                                      function_call_instruction->NextNode()),
            GetFuzzerContext()->GetFreshId()))) {
      continue;
    }

    auto* called_function = fuzzerutil::FindFunction(
        GetIRContext(), function_call_instruction->GetSingleWordInOperand(0));

    // Mapping the called function instructions.
    std::map<uint32_t, uint32_t> result_id_map;
    for (auto& called_function_block : *called_function) {
      // The called function entry block label will not be inlined.
      if (&called_function_block != &*called_function->entry()) {
        result_id_map[called_function_block.GetLabelInst()->result_id()] =
            GetFuzzerContext()->GetFreshId();
      }

      for (auto& instruction_to_inline : called_function_block) {
        // The instructions are mapped to fresh ids.
        if (instruction_to_inline.HasResultId()) {
          result_id_map[instruction_to_inline.result_id()] =
              GetFuzzerContext()->GetFreshId();
        }
      }
    }

    // Applies the inline function transformation.
    ApplyTransformation(TransformationInlineFunction(
        function_call_instruction->result_id(), result_id_map));
  }
}

}  // namespace fuzz
}  // namespace spvtools