third_party/SPIRV-Tools/test/fuzz/transformation_function_call_test.cpp

// Copyright (c) 2020 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include "source/fuzz/transformation_function_call.h"

#include "gtest/gtest.h"
#include "source/fuzz/fuzzer_util.h"
#include "source/fuzz/instruction_descriptor.h"
#include "test/fuzz/fuzz_test_util.h"

namespace spvtools {
namespace fuzz {
namespace {

TEST(TransformationFunctionCallTest, BasicTest) {
  std::string shader = R"(
               OpCapability Shader
          %1 = OpExtInstImport "GLSL.std.450"
               OpMemoryModel Logical GLSL450
               OpEntryPoint Fragment %4 "main"
               OpExecutionMode %4 OriginUpperLeft
               OpSource ESSL 310
          %2 = OpTypeVoid
          %3 = OpTypeFunction %2
          %6 = OpTypeInt 32 1
          %7 = OpTypePointer Function %6
          %8 = OpTypeFunction %6 %7
         %12 = OpTypeFloat 32
         %13 = OpTypePointer Function %12
         %14 = OpTypeFunction %6 %7 %13
         %27 = OpConstant %6 1
         %50 = OpConstant %12 1
         %57 = OpTypeBool
         %58 = OpConstantFalse %57
        %204 = OpUndef %6
          %4 = OpFunction %2 None %3
          %5 = OpLabel
         %61 = OpVariable %7 Function
         %62 = OpVariable %7 Function
         %65 = OpVariable %13 Function
         %66 = OpVariable %7 Function
         %68 = OpVariable %13 Function
         %71 = OpVariable %7 Function
         %72 = OpVariable %13 Function
         %73 = OpVariable %7 Function
         %75 = OpVariable %13 Function
         %78 = OpVariable %7 Function
         %98 = OpAccessChain %7 %71
         %99 = OpCopyObject %7 %71
               OpSelectionMerge %60 None
               OpBranchConditional %58 %59 %60
         %59 = OpLabel
               OpBranch %60
         %60 = OpLabel
               OpReturn
               OpFunctionEnd
         %10 = OpFunction %6 None %8
          %9 = OpFunctionParameter %7
         %11 = OpLabel
         %26 = OpLoad %6 %9
         %28 = OpIAdd %6 %26 %27
               OpSelectionMerge %97 None
               OpBranchConditional %58 %96 %97
         %96 = OpLabel
               OpBranch %97
         %97 = OpLabel
               OpReturnValue %28
               OpFunctionEnd
         %17 = OpFunction %6 None %14
         %15 = OpFunctionParameter %7
         %16 = OpFunctionParameter %13
         %18 = OpLabel
         %31 = OpVariable %7 Function
         %32 = OpLoad %6 %15
               OpStore %31 %32
         %33 = OpFunctionCall %6 %10 %31
               OpReturnValue %33
               OpFunctionEnd
         %21 = OpFunction %6 None %14
         %19 = OpFunctionParameter %7
         %20 = OpFunctionParameter %13
         %22 = OpLabel
         %36 = OpLoad %6 %19
         %37 = OpLoad %12 %20
         %38 = OpConvertFToS %6 %37
         %39 = OpIAdd %6 %36 %38
               OpReturnValue %39
               OpFunctionEnd
         %24 = OpFunction %6 None %8
         %23 = OpFunctionParameter %7
         %25 = OpLabel
         %44 = OpVariable %7 Function
         %46 = OpVariable %13 Function
         %51 = OpVariable %7 Function
         %52 = OpVariable %13 Function
         %42 = OpLoad %6 %23
         %43 = OpConvertSToF %12 %42
         %45 = OpLoad %6 %23
               OpStore %44 %45
               OpStore %46 %43
         %47 = OpFunctionCall %6 %17 %44 %46
         %48 = OpLoad %6 %23
         %49 = OpIAdd %6 %48 %27
               OpStore %51 %49
               OpStore %52 %50
         %53 = OpFunctionCall %6 %17 %51 %52
         %54 = OpIAdd %6 %47 %53
               OpReturnValue %54
               OpFunctionEnd
        %200 = OpFunction %6 None %14
        %201 = OpFunctionParameter %7
        %202 = OpFunctionParameter %13
        %203 = OpLabel
               OpSelectionMerge %206 None
               OpBranchConditional %58 %205 %206
        %205 = OpLabel
               OpBranch %206
        %206 = OpLabel
               OpReturnValue %204
               OpFunctionEnd
  )";

  const auto env = SPV_ENV_UNIVERSAL_1_4;
  const auto consumer = nullptr;
  const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
  spvtools::ValidatorOptions validator_options;
  ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options,
                                               kConsoleMessageConsumer));
  TransformationContext transformation_context(
      MakeUnique<FactManager>(context.get()), validator_options);
  transformation_context.GetFactManager()->AddFactBlockIsDead(59);
  transformation_context.GetFactManager()->AddFactBlockIsDead(11);
  transformation_context.GetFactManager()->AddFactBlockIsDead(18);
  transformation_context.GetFactManager()->AddFactBlockIsDead(25);
  transformation_context.GetFactManager()->AddFactBlockIsDead(96);
  transformation_context.GetFactManager()->AddFactBlockIsDead(205);
  transformation_context.GetFactManager()->AddFactFunctionIsLivesafe(21);
  transformation_context.GetFactManager()->AddFactFunctionIsLivesafe(200);
  transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
      71);
  transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
      72);
  transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
      19);
  transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
      20);
  transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
      23);
  transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
      44);
  transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
      46);
  transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
      51);
  transformation_context.GetFactManager()->AddFactValueOfPointeeIsIrrelevant(
      52);

  // Livesafe functions with argument types: 21(7, 13), 200(7, 13)
  // Non-livesafe functions with argument types: 4(), 10(7), 17(7, 13), 24(7)
  // Call graph edges:
  //    17 -> 10
  //    24 -> 17

  // Bad transformations
  // Too many arguments
  ASSERT_FALSE(TransformationFunctionCall(
                   100, 21, {71, 72, 71},
                   MakeInstructionDescriptor(59, spv::Op::OpBranch, 0))
                   .IsApplicable(context.get(), transformation_context));
  // Too few arguments
  ASSERT_FALSE(
      TransformationFunctionCall(
          100, 21, {71}, MakeInstructionDescriptor(59, spv::Op::OpBranch, 0))
          .IsApplicable(context.get(), transformation_context));
  // Arguments are the wrong way around (types do not match)
  ASSERT_FALSE(TransformationFunctionCall(
                   100, 21, {72, 71},
                   MakeInstructionDescriptor(59, spv::Op::OpBranch, 0))
                   .IsApplicable(context.get(), transformation_context));
  // 21 is not an appropriate argument
  ASSERT_FALSE(TransformationFunctionCall(
                   100, 21, {21, 72},
                   MakeInstructionDescriptor(59, spv::Op::OpBranch, 0))
                   .IsApplicable(context.get(), transformation_context));
  // 300 does not exist
  ASSERT_FALSE(TransformationFunctionCall(
                   100, 21, {300, 72},
                   MakeInstructionDescriptor(59, spv::Op::OpBranch, 0))
                   .IsApplicable(context.get(), transformation_context));
  // 71 is not a function
  ASSERT_FALSE(TransformationFunctionCall(
                   100, 71, {71, 72},
                   MakeInstructionDescriptor(59, spv::Op::OpBranch, 0))
                   .IsApplicable(context.get(), transformation_context));
  // 500 does not exist
  ASSERT_FALSE(TransformationFunctionCall(
                   100, 500, {71, 72},
                   MakeInstructionDescriptor(59, spv::Op::OpBranch, 0))
                   .IsApplicable(context.get(), transformation_context));
  // Id is not fresh
  ASSERT_FALSE(
      TransformationFunctionCall(
          21, 21, {71, 72}, MakeInstructionDescriptor(59, spv::Op::OpBranch, 0))
          .IsApplicable(context.get(), transformation_context));
  // Access chain as pointer parameter
  ASSERT_FALSE(TransformationFunctionCall(
                   100, 21, {98, 72},
                   MakeInstructionDescriptor(59, spv::Op::OpBranch, 0))
                   .IsApplicable(context.get(), transformation_context));
  // Copied object as pointer parameter
  ASSERT_FALSE(TransformationFunctionCall(
                   100, 21, {99, 72},
                   MakeInstructionDescriptor(59, spv::Op::OpBranch, 0))
                   .IsApplicable(context.get(), transformation_context));
  // Non-livesafe called from original live block
  ASSERT_FALSE(TransformationFunctionCall(
                   100, 10, {71},
                   MakeInstructionDescriptor(99, spv::Op::OpSelectionMerge, 0))
                   .IsApplicable(context.get(), transformation_context));
  // Non-livesafe called from livesafe function
  ASSERT_FALSE(TransformationFunctionCall(
                   100, 10, {19},
                   MakeInstructionDescriptor(38, spv::Op::OpConvertFToS, 0))
                   .IsApplicable(context.get(), transformation_context));
  // Livesafe function called with pointer to non-arbitrary local variable
  ASSERT_FALSE(TransformationFunctionCall(
                   100, 21, {61, 72},
                   MakeInstructionDescriptor(38, spv::Op::OpConvertFToS, 0))
                   .IsApplicable(context.get(), transformation_context));
  // Direct recursion
  ASSERT_FALSE(
      TransformationFunctionCall(
          100, 4, {}, MakeInstructionDescriptor(59, spv::Op::OpBranch, 0))
          .IsApplicable(context.get(), transformation_context));
  // Indirect recursion
  ASSERT_FALSE(
      TransformationFunctionCall(
          100, 24, {9}, MakeInstructionDescriptor(96, spv::Op::OpBranch, 0))
          .IsApplicable(context.get(), transformation_context));
  // Parameter 23 is not available at the call site
  ASSERT_FALSE(
      TransformationFunctionCall(
          104, 10, {23}, MakeInstructionDescriptor(205, spv::Op::OpBranch, 0))
          .IsApplicable(context.get(), transformation_context));

  // Good transformations
  {
    // Livesafe called from dead block: fine
    TransformationFunctionCall transformation(
        100, 21, {71, 72}, MakeInstructionDescriptor(59, spv::Op::OpBranch, 0));
    ASSERT_TRUE(
        transformation.IsApplicable(context.get(), transformation_context));
    ApplyAndCheckFreshIds(transformation, context.get(),
                          &transformation_context);
    ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(
        context.get(), validator_options, kConsoleMessageConsumer));
  }
  {
    // Livesafe called from original live block: fine
    TransformationFunctionCall transformation(
        101, 21, {71, 72},
        MakeInstructionDescriptor(98, spv::Op::OpAccessChain, 0));
    ASSERT_TRUE(
        transformation.IsApplicable(context.get(), transformation_context));
    ApplyAndCheckFreshIds(transformation, context.get(),
                          &transformation_context);
    ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(
        context.get(), validator_options, kConsoleMessageConsumer));
  }
  {
    // Livesafe called from livesafe function: fine
    TransformationFunctionCall transformation(
        102, 200, {19, 20}, MakeInstructionDescriptor(36, spv::Op::OpLoad, 0));
    ASSERT_TRUE(
        transformation.IsApplicable(context.get(), transformation_context));
    ApplyAndCheckFreshIds(transformation, context.get(),
                          &transformation_context);
    ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(
        context.get(), validator_options, kConsoleMessageConsumer));
  }
  {
    // Dead called from dead block in injected function: fine
    TransformationFunctionCall transformation(
        103, 10, {23}, MakeInstructionDescriptor(45, spv::Op::OpLoad, 0));
    ASSERT_TRUE(
        transformation.IsApplicable(context.get(), transformation_context));
    ApplyAndCheckFreshIds(transformation, context.get(),
                          &transformation_context);
    ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(
        context.get(), validator_options, kConsoleMessageConsumer));
  }
  {
    // Non-livesafe called from dead block in livesafe function: OK
    TransformationFunctionCall transformation(
        104, 10, {201}, MakeInstructionDescriptor(205, spv::Op::OpBranch, 0));
    ASSERT_TRUE(
        transformation.IsApplicable(context.get(), transformation_context));
    ApplyAndCheckFreshIds(transformation, context.get(),
                          &transformation_context);
    ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(
        context.get(), validator_options, kConsoleMessageConsumer));
  }
  {
    // Livesafe called from dead block with non-arbitrary parameter
    TransformationFunctionCall transformation(
        105, 21, {62, 65}, MakeInstructionDescriptor(59, spv::Op::OpBranch, 0));
    ASSERT_TRUE(
        transformation.IsApplicable(context.get(), transformation_context));
    ApplyAndCheckFreshIds(transformation, context.get(),
                          &transformation_context);
    ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(
        context.get(), validator_options, kConsoleMessageConsumer));
  }

  std::string after_transformation = R"(
               OpCapability Shader
          %1 = OpExtInstImport "GLSL.std.450"
               OpMemoryModel Logical GLSL450
               OpEntryPoint Fragment %4 "main"
               OpExecutionMode %4 OriginUpperLeft
               OpSource ESSL 310
          %2 = OpTypeVoid
          %3 = OpTypeFunction %2
          %6 = OpTypeInt 32 1
          %7 = OpTypePointer Function %6
          %8 = OpTypeFunction %6 %7
         %12 = OpTypeFloat 32
         %13 = OpTypePointer Function %12
         %14 = OpTypeFunction %6 %7 %13
         %27 = OpConstant %6 1
         %50 = OpConstant %12 1
         %57 = OpTypeBool
         %58 = OpConstantFalse %57
        %204 = OpUndef %6
          %4 = OpFunction %2 None %3
          %5 = OpLabel
         %61 = OpVariable %7 Function
         %62 = OpVariable %7 Function
         %65 = OpVariable %13 Function
         %66 = OpVariable %7 Function
         %68 = OpVariable %13 Function
         %71 = OpVariable %7 Function
         %72 = OpVariable %13 Function
         %73 = OpVariable %7 Function
         %75 = OpVariable %13 Function
         %78 = OpVariable %7 Function
        %101 = OpFunctionCall %6 %21 %71 %72
         %98 = OpAccessChain %7 %71
         %99 = OpCopyObject %7 %71
               OpSelectionMerge %60 None
               OpBranchConditional %58 %59 %60
         %59 = OpLabel
        %100 = OpFunctionCall %6 %21 %71 %72
        %105 = OpFunctionCall %6 %21 %62 %65
               OpBranch %60
         %60 = OpLabel
               OpReturn
               OpFunctionEnd
         %10 = OpFunction %6 None %8
          %9 = OpFunctionParameter %7
         %11 = OpLabel
         %26 = OpLoad %6 %9
         %28 = OpIAdd %6 %26 %27
               OpSelectionMerge %97 None
               OpBranchConditional %58 %96 %97
         %96 = OpLabel
               OpBranch %97
         %97 = OpLabel
               OpReturnValue %28
               OpFunctionEnd
         %17 = OpFunction %6 None %14
         %15 = OpFunctionParameter %7
         %16 = OpFunctionParameter %13
         %18 = OpLabel
         %31 = OpVariable %7 Function
         %32 = OpLoad %6 %15
               OpStore %31 %32
         %33 = OpFunctionCall %6 %10 %31
               OpReturnValue %33
               OpFunctionEnd
         %21 = OpFunction %6 None %14
         %19 = OpFunctionParameter %7
         %20 = OpFunctionParameter %13
         %22 = OpLabel
        %102 = OpFunctionCall %6 %200 %19 %20
         %36 = OpLoad %6 %19
         %37 = OpLoad %12 %20
         %38 = OpConvertFToS %6 %37
         %39 = OpIAdd %6 %36 %38
               OpReturnValue %39
               OpFunctionEnd
         %24 = OpFunction %6 None %8
         %23 = OpFunctionParameter %7
         %25 = OpLabel
         %44 = OpVariable %7 Function
         %46 = OpVariable %13 Function
         %51 = OpVariable %7 Function
         %52 = OpVariable %13 Function
         %42 = OpLoad %6 %23
         %43 = OpConvertSToF %12 %42
        %103 = OpFunctionCall %6 %10 %23
         %45 = OpLoad %6 %23
               OpStore %44 %45
               OpStore %46 %43
         %47 = OpFunctionCall %6 %17 %44 %46
         %48 = OpLoad %6 %23
         %49 = OpIAdd %6 %48 %27
               OpStore %51 %49
               OpStore %52 %50
         %53 = OpFunctionCall %6 %17 %51 %52
         %54 = OpIAdd %6 %47 %53
               OpReturnValue %54
               OpFunctionEnd
        %200 = OpFunction %6 None %14
        %201 = OpFunctionParameter %7
        %202 = OpFunctionParameter %13
        %203 = OpLabel
               OpSelectionMerge %206 None
               OpBranchConditional %58 %205 %206
        %205 = OpLabel
        %104 = OpFunctionCall %6 %10 %201
               OpBranch %206
        %206 = OpLabel
               OpReturnValue %204
               OpFunctionEnd
  )";
  ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
}

TEST(TransformationFunctionCallTest, DoNotInvokeEntryPoint) {
  std::string shader = R"(
               OpCapability Shader
          %1 = OpExtInstImport "GLSL.std.450"
               OpMemoryModel Logical GLSL450
               OpEntryPoint Fragment %4 "main"
               OpExecutionMode %4 OriginUpperLeft
               OpSource ESSL 310
          %2 = OpTypeVoid
          %3 = OpTypeFunction %2
          %4 = OpFunction %2 None %3
          %5 = OpLabel
               OpReturn
               OpFunctionEnd
         %10 = OpFunction %2 None %3
         %11 = OpLabel
               OpReturn
               OpFunctionEnd
  )";

  const auto env = SPV_ENV_UNIVERSAL_1_4;
  const auto consumer = nullptr;
  const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
  spvtools::ValidatorOptions validator_options;
  ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options,
                                               kConsoleMessageConsumer));
  TransformationContext transformation_context(
      MakeUnique<FactManager>(context.get()), validator_options);
  transformation_context.GetFactManager()->AddFactBlockIsDead(11);

  // 4 is an entry point, so it is not legal for it to be the target of a call.
  ASSERT_FALSE(
      TransformationFunctionCall(
          100, 4, {}, MakeInstructionDescriptor(11, spv::Op::OpReturn, 0))
          .IsApplicable(context.get(), transformation_context));
}

}  // namespace
}  // namespace fuzz
}  // namespace spvtools