third_party/SPIRV-Tools/test/fuzz/transformation_access_chain_test.cpp

// Copyright (c) 2020 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include "source/fuzz/transformation_access_chain.h"
#include "source/fuzz/instruction_descriptor.h"
#include "test/fuzz/fuzz_test_util.h"

namespace spvtools {
namespace fuzz {
namespace {

TEST(TransformationAccessChainTest, BasicTest) {
  std::string shader = R"(
               OpCapability Shader
          %1 = OpExtInstImport "GLSL.std.450"
               OpMemoryModel Logical GLSL450
               OpEntryPoint Fragment %4 "main" %48 %54
               OpExecutionMode %4 OriginUpperLeft
               OpSource ESSL 310
          %2 = OpTypeVoid
          %3 = OpTypeFunction %2
          %6 = OpTypeFloat 32
          %7 = OpTypeVector %6 2
         %50 = OpTypeMatrix %7 2
         %70 = OpTypePointer Function %7
         %71 = OpTypePointer Function %50
          %8 = OpTypeStruct %7 %6
          %9 = OpTypePointer Function %8
         %10 = OpTypeInt 32 1
         %11 = OpTypePointer Function %10
         %12 = OpTypeFunction %10 %9 %11
         %17 = OpConstant %10 0
         %18 = OpTypeInt 32 0
         %19 = OpConstant %18 0
         %20 = OpTypePointer Function %6
         %99 = OpTypePointer Private %6
         %29 = OpConstant %6 0
         %30 = OpConstant %6 1
         %31 = OpConstantComposite %7 %29 %30
         %32 = OpConstant %6 2
         %33 = OpConstantComposite %8 %31 %32
         %35 = OpConstant %10 10
         %51 = OpConstant %18 10
         %80 = OpConstant %18 0
         %81 = OpConstant %10 1
         %82 = OpConstant %18 2
         %83 = OpConstant %10 3
         %84 = OpConstant %18 4
         %85 = OpConstant %10 5
         %52 = OpTypeArray %50 %51
         %53 = OpTypePointer Private %52
         %45 = OpUndef %9
         %46 = OpConstantNull %9
         %47 = OpTypePointer Private %8
         %48 = OpVariable %47 Private
         %54 = OpVariable %53 Private
          %4 = OpFunction %2 None %3
          %5 = OpLabel
         %28 = OpVariable %9 Function
         %34 = OpVariable %11 Function
         %36 = OpVariable %9 Function
         %38 = OpVariable %11 Function
         %44 = OpCopyObject %9 %36
               OpStore %28 %33
               OpStore %34 %35
         %37 = OpLoad %8 %28
               OpStore %36 %37
         %39 = OpLoad %10 %34
               OpStore %38 %39
         %40 = OpFunctionCall %10 %15 %36 %38
         %41 = OpLoad %10 %34
         %42 = OpIAdd %10 %41 %40
               OpStore %34 %42
               OpReturn
               OpFunctionEnd
         %15 = OpFunction %10 None %12
         %13 = OpFunctionParameter %9
         %14 = OpFunctionParameter %11
         %16 = OpLabel
         %21 = OpAccessChain %20 %13 %17 %19
         %43 = OpCopyObject %9 %13
         %22 = OpLoad %6 %21
         %23 = OpConvertFToS %10 %22
         %24 = OpLoad %10 %14
         %25 = OpIAdd %10 %23 %24
               OpReturnValue %25
               OpFunctionEnd
  )";

  const auto env = SPV_ENV_UNIVERSAL_1_4;
  const auto consumer = nullptr;
  const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
  ASSERT_TRUE(IsValid(env, context.get()));

  // Types:
  // Ptr | Pointee | Storage class | GLSL for pointee    | Ids of this type
  // ----+---------+---------------+---------------------+------------------
  //  9  |    8    | Function      | struct(vec2, float) | 28, 36, 44, 13, 43
  // 11  |   10    | Function      | int                 | 34, 38, 14
  // 20  |    6    | Function      | float               | -
  // 99  |    6    | Private       | float               | -
  // 53  |   52    | Private       | mat2x2[10]          | 54
  // 47  |    8    | Private       | struct(vec2, float) | 48
  // 70  |    7    | Function      | vec2                | -
  // 71  |   59    | Function      | mat2x2              | -

  // Indices 0-5 are in ids 80-85

  FactManager fact_manager;
  fact_manager.AddFactValueOfPointeeIsIrrelevant(54);

  // Bad: id is not fresh
  ASSERT_FALSE(TransformationAccessChain(
                   43, 43, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
                   .IsApplicable(context.get(), fact_manager));

  // Bad: pointer id does not exist
  ASSERT_FALSE(TransformationAccessChain(
                   100, 1000, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
                   .IsApplicable(context.get(), fact_manager));

  // Bad: pointer id is not a type
  ASSERT_FALSE(TransformationAccessChain(
                   100, 5, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
                   .IsApplicable(context.get(), fact_manager));

  // Bad: pointer id is not a pointer
  ASSERT_FALSE(TransformationAccessChain(
                   100, 23, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
                   .IsApplicable(context.get(), fact_manager));

  // Bad: index id does not exist
  ASSERT_FALSE(TransformationAccessChain(
                   100, 43, {1000}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
                   .IsApplicable(context.get(), fact_manager));

  // Bad: index id is not a constant
  ASSERT_FALSE(TransformationAccessChain(
                   100, 43, {24}, MakeInstructionDescriptor(25, SpvOpIAdd, 0))
                   .IsApplicable(context.get(), fact_manager));

  // Bad: too many indices
  ASSERT_FALSE(
      TransformationAccessChain(100, 43, {80, 80, 80},
                                MakeInstructionDescriptor(24, SpvOpLoad, 0))
          .IsApplicable(context.get(), fact_manager));

  // Bad: index id is out of bounds
  ASSERT_FALSE(
      TransformationAccessChain(100, 43, {80, 83},
                                MakeInstructionDescriptor(24, SpvOpLoad, 0))
          .IsApplicable(context.get(), fact_manager));

  // Bad: attempt to insert before variable
  ASSERT_FALSE(TransformationAccessChain(
                   100, 34, {}, MakeInstructionDescriptor(36, SpvOpVariable, 0))
                   .IsApplicable(context.get(), fact_manager));

  // Bad: pointer not available
  ASSERT_FALSE(
      TransformationAccessChain(
          100, 43, {80}, MakeInstructionDescriptor(21, SpvOpAccessChain, 0))
          .IsApplicable(context.get(), fact_manager));

  // Bad: instruction descriptor does not identify anything
  ASSERT_FALSE(TransformationAccessChain(
                   100, 43, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 100))
                   .IsApplicable(context.get(), fact_manager));

  // Bad: pointer is null
  ASSERT_FALSE(TransformationAccessChain(
                   100, 45, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
                   .IsApplicable(context.get(), fact_manager));

  // Bad: pointer is undef
  ASSERT_FALSE(TransformationAccessChain(
                   100, 46, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
                   .IsApplicable(context.get(), fact_manager));

  // Bad: pointer to result type does not exist
  ASSERT_FALSE(TransformationAccessChain(
                   100, 52, {0}, MakeInstructionDescriptor(24, SpvOpLoad, 0))
                   .IsApplicable(context.get(), fact_manager));

  {
    TransformationAccessChain transformation(
        100, 43, {80}, MakeInstructionDescriptor(24, SpvOpLoad, 0));
    ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
    transformation.Apply(context.get(), &fact_manager);
    ASSERT_TRUE(IsValid(env, context.get()));
    ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(100));
  }

  {
    TransformationAccessChain transformation(
        101, 28, {81}, MakeInstructionDescriptor(42, SpvOpReturn, 0));
    ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
    transformation.Apply(context.get(), &fact_manager);
    ASSERT_TRUE(IsValid(env, context.get()));
    ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(101));
  }

  {
    TransformationAccessChain transformation(
        102, 36, {80, 81}, MakeInstructionDescriptor(37, SpvOpStore, 0));
    ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
    transformation.Apply(context.get(), &fact_manager);
    ASSERT_TRUE(IsValid(env, context.get()));
    ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(102));
  }

  {
    TransformationAccessChain transformation(
        103, 44, {}, MakeInstructionDescriptor(44, SpvOpStore, 0));
    ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
    transformation.Apply(context.get(), &fact_manager);
    ASSERT_TRUE(IsValid(env, context.get()));
    ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(103));
  }

  {
    TransformationAccessChain transformation(
        104, 13, {80}, MakeInstructionDescriptor(21, SpvOpAccessChain, 0));
    ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
    transformation.Apply(context.get(), &fact_manager);
    ASSERT_TRUE(IsValid(env, context.get()));
    ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(104));
  }

  {
    TransformationAccessChain transformation(
        105, 34, {}, MakeInstructionDescriptor(44, SpvOpStore, 1));
    ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
    transformation.Apply(context.get(), &fact_manager);
    ASSERT_TRUE(IsValid(env, context.get()));
    ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(105));
  }

  {
    TransformationAccessChain transformation(
        106, 38, {}, MakeInstructionDescriptor(40, SpvOpFunctionCall, 0));
    ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
    transformation.Apply(context.get(), &fact_manager);
    ASSERT_TRUE(IsValid(env, context.get()));
    ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(106));
  }

  {
    TransformationAccessChain transformation(
        107, 14, {}, MakeInstructionDescriptor(24, SpvOpLoad, 0));
    ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
    transformation.Apply(context.get(), &fact_manager);
    ASSERT_TRUE(IsValid(env, context.get()));
    ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(107));
  }

  {
    TransformationAccessChain transformation(
        108, 54, {85, 81, 81}, MakeInstructionDescriptor(24, SpvOpLoad, 0));
    ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
    transformation.Apply(context.get(), &fact_manager);
    ASSERT_TRUE(IsValid(env, context.get()));
    ASSERT_TRUE(fact_manager.PointeeValueIsIrrelevant(108));
  }

  {
    TransformationAccessChain transformation(
        109, 48, {80, 80}, MakeInstructionDescriptor(24, SpvOpLoad, 0));
    ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
    transformation.Apply(context.get(), &fact_manager);
    ASSERT_TRUE(IsValid(env, context.get()));
    ASSERT_FALSE(fact_manager.PointeeValueIsIrrelevant(109));
  }

  std::string after_transformation = R"(
               OpCapability Shader
          %1 = OpExtInstImport "GLSL.std.450"
               OpMemoryModel Logical GLSL450
               OpEntryPoint Fragment %4 "main" %48 %54
               OpExecutionMode %4 OriginUpperLeft
               OpSource ESSL 310
          %2 = OpTypeVoid
          %3 = OpTypeFunction %2
          %6 = OpTypeFloat 32
          %7 = OpTypeVector %6 2
         %50 = OpTypeMatrix %7 2
         %70 = OpTypePointer Function %7
         %71 = OpTypePointer Function %50
          %8 = OpTypeStruct %7 %6
          %9 = OpTypePointer Function %8
         %10 = OpTypeInt 32 1
         %11 = OpTypePointer Function %10
         %12 = OpTypeFunction %10 %9 %11
         %17 = OpConstant %10 0
         %18 = OpTypeInt 32 0
         %19 = OpConstant %18 0
         %20 = OpTypePointer Function %6
         %99 = OpTypePointer Private %6
         %29 = OpConstant %6 0
         %30 = OpConstant %6 1
         %31 = OpConstantComposite %7 %29 %30
         %32 = OpConstant %6 2
         %33 = OpConstantComposite %8 %31 %32
         %35 = OpConstant %10 10
         %51 = OpConstant %18 10
         %80 = OpConstant %18 0
         %81 = OpConstant %10 1
         %82 = OpConstant %18 2
         %83 = OpConstant %10 3
         %84 = OpConstant %18 4
         %85 = OpConstant %10 5
         %52 = OpTypeArray %50 %51
         %53 = OpTypePointer Private %52
         %45 = OpUndef %9
         %46 = OpConstantNull %9
         %47 = OpTypePointer Private %8
         %48 = OpVariable %47 Private
         %54 = OpVariable %53 Private
          %4 = OpFunction %2 None %3
          %5 = OpLabel
         %28 = OpVariable %9 Function
         %34 = OpVariable %11 Function
         %36 = OpVariable %9 Function
         %38 = OpVariable %11 Function
         %44 = OpCopyObject %9 %36
        %103 = OpAccessChain %9 %44
               OpStore %28 %33
        %105 = OpAccessChain %11 %34
               OpStore %34 %35
         %37 = OpLoad %8 %28
        %102 = OpAccessChain %20 %36 %80 %81
               OpStore %36 %37
         %39 = OpLoad %10 %34
               OpStore %38 %39
        %106 = OpAccessChain %11 %38
         %40 = OpFunctionCall %10 %15 %36 %38
         %41 = OpLoad %10 %34
         %42 = OpIAdd %10 %41 %40
               OpStore %34 %42
        %101 = OpAccessChain %20 %28 %81
               OpReturn
               OpFunctionEnd
         %15 = OpFunction %10 None %12
         %13 = OpFunctionParameter %9
         %14 = OpFunctionParameter %11
         %16 = OpLabel
        %104 = OpAccessChain %70 %13 %80
         %21 = OpAccessChain %20 %13 %17 %19
         %43 = OpCopyObject %9 %13
         %22 = OpLoad %6 %21
         %23 = OpConvertFToS %10 %22
        %100 = OpAccessChain %70 %43 %80
        %107 = OpAccessChain %11 %14
        %108 = OpAccessChain %99 %54 %85 %81 %81
        %109 = OpAccessChain %99 %48 %80 %80
         %24 = OpLoad %10 %14
         %25 = OpIAdd %10 %23 %24
               OpReturnValue %25
               OpFunctionEnd
  )";
  ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
}

TEST(TransformationAccessChainTest, IsomorphicStructs) {
  std::string shader = R"(
               OpCapability Shader
          %1 = OpExtInstImport "GLSL.std.450"
               OpMemoryModel Logical GLSL450
               OpEntryPoint Fragment %4 "main" %11 %12
               OpExecutionMode %4 OriginUpperLeft
               OpSource ESSL 310
          %2 = OpTypeVoid
          %3 = OpTypeFunction %2
          %6 = OpTypeFloat 32
          %7 = OpTypeStruct %6
          %8 = OpTypePointer Private %7
          %9 = OpTypeStruct %6
         %10 = OpTypePointer Private %9
         %11 = OpVariable %8 Private
         %12 = OpVariable %10 Private
          %4 = OpFunction %2 None %3
          %5 = OpLabel
               OpReturn
               OpFunctionEnd
  )";

  const auto env = SPV_ENV_UNIVERSAL_1_4;
  const auto consumer = nullptr;
  const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
  ASSERT_TRUE(IsValid(env, context.get()));

  FactManager fact_manager;

  {
    TransformationAccessChain transformation(
        100, 11, {}, MakeInstructionDescriptor(5, SpvOpReturn, 0));
    ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
    transformation.Apply(context.get(), &fact_manager);
    ASSERT_TRUE(IsValid(env, context.get()));
  }
  {
    TransformationAccessChain transformation(
        101, 12, {}, MakeInstructionDescriptor(5, SpvOpReturn, 0));
    ASSERT_TRUE(transformation.IsApplicable(context.get(), fact_manager));
    transformation.Apply(context.get(), &fact_manager);
    ASSERT_TRUE(IsValid(env, context.get()));
  }

  std::string after_transformation = R"(
               OpCapability Shader
          %1 = OpExtInstImport "GLSL.std.450"
               OpMemoryModel Logical GLSL450
               OpEntryPoint Fragment %4 "main" %11 %12
               OpExecutionMode %4 OriginUpperLeft
               OpSource ESSL 310
          %2 = OpTypeVoid
          %3 = OpTypeFunction %2
          %6 = OpTypeFloat 32
          %7 = OpTypeStruct %6
          %8 = OpTypePointer Private %7
          %9 = OpTypeStruct %6
         %10 = OpTypePointer Private %9
         %11 = OpVariable %8 Private
         %12 = OpVariable %10 Private
          %4 = OpFunction %2 None %3
          %5 = OpLabel
        %100 = OpAccessChain %8 %11
        %101 = OpAccessChain %10 %12
               OpReturn
               OpFunctionEnd
  )";
  ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
}

}  // namespace
}  // namespace fuzz
}  // namespace spvtools