Skip to content

spirv-fuzz: Ignore specialization constants#3664

Merged
paulthomson merged 6 commits intoKhronosGroup:masterfrom
andreperezmaselco:fix-segmentation-fault-error
Aug 12, 2020
Merged

spirv-fuzz: Ignore specialization constants#3664
paulthomson merged 6 commits intoKhronosGroup:masterfrom
andreperezmaselco:fix-segmentation-fault-error

Conversation

@andreperezmaselco
Copy link
Copy Markdown
Collaborator

@andreperezmaselco andreperezmaselco commented Aug 6, 2020

FuzzerPassInterchangeSignednessOfIntegerOperands and FuzzerPassInterchangeZeroLikeConstants both included specialization constants when trying to find integer constants with known values. However, this is incorrect behavior because we do not know the value of specialization constants. Furthermore, ConstantManager does not support them, and this led to crashes where we assumed we could look up specialization constants via the ConstantManager.

This change fixes both passes to ignore specialization constants.

Fixes #3663.

@Vasniktel
Copy link
Copy Markdown
Collaborator

I think it would be better to mark it as spirv-opt PR and ask guys from spirv-opt team to review it (since the change to the constant manager might break some code in the spirv-opt tool).

Also, the constant manager is somewhat nasty. Maybe there is a way to get rid of it in the fuzzer. @andreperezmaselco, what o you think?

@andreperezmaselco
Copy link
Copy Markdown
Collaborator Author

Yes. There is a way to fix it in the spirv-fuzz code.
I'm going to fix it.

@andreperezmaselco andreperezmaselco changed the title spirv-fuzz: Support OpSpecConstant when getting constant spirv-fuzz: Check specialization before getting declared constant Aug 7, 2020
Copy link
Copy Markdown
Contributor

@paulthomson paulthomson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like IsConstant calls IsCompileTimeConstantInst, which will return true if the opcode is SpvOpConstantTrue (among others). This does not seem right. Maybe you meant to use IsSpecConstantInst(opcode)?

@andreperezmaselco andreperezmaselco force-pushed the fix-segmentation-fault-error branch from 3307e43 to d902e13 Compare August 11, 2020 14:50
Copy link
Copy Markdown
Contributor

@paulthomson paulthomson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I think the comments should be adjusted, then we can merge.

@andreperezmaselco andreperezmaselco force-pushed the fix-segmentation-fault-error branch from 6bebef2 to c429e32 Compare August 12, 2020 12:35
Copy link
Copy Markdown
Contributor

@paulthomson paulthomson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this fix!

@andreperezmaselco andreperezmaselco force-pushed the fix-segmentation-fault-error branch from 64719d7 to 0e7a6f1 Compare August 12, 2020 15:10
@paulthomson paulthomson changed the title spirv-fuzz: Check specialization before getting declared constant spirv-fuzz: Ignore specialization constants Aug 12, 2020
@paulthomson paulthomson merged commit 5e59294 into KhronosGroup:master Aug 12, 2020
dnovillo pushed a commit to dnovillo/SPIRV-Tools that referenced this pull request Aug 19, 2020
`FuzzerPassInterchangeSignednessOfIntegerOperands` and `FuzzerPassInterchangeZeroLikeConstants` both included specialization constants when trying to find integer constants with known values. However, this is incorrect behavior because we do not know the value of specialization constants. Furthermore, ConstantManager does not support them, and this led to crashes where we assumed we could look up specialization constants via the ConstantManager.

This change fixes both passes to ignore specialization constants.

Fixes KhronosGroup#3663.
dneto0 pushed a commit to dneto0/SPIRV-Tools that referenced this pull request Sep 14, 2024
Roll third_party/glslang/ b60e067..f257e0e (11 commits)

KhronosGroup/glslang@b60e067...f257e0e

$ git log b60e067..f257e0e --date=short --no-merges --format='%ad %ae %s'
2020-08-14 john Build: fix a build warning
2020-08-14 rafael.fariasmarinheiro Use --test-root to pass files to Bazel tests.
2020-08-14 john Fix KhronosGroup#2366, fix KhronosGroup#2358, correctly separate out numerical feature checking
2020-08-14 john Non-functional (almost): Refactor when 'extensionRequested' is called.
2020-08-14 john Non-functional: Remove reinventing the scalar type, note code issues
2020-08-11 john Non-functional: spellings of "destinaton" and "addPairConversion"
2020-08-12 alanbaker Update test expectations
2020-08-12 alanbaker Update SPIRV-Tools and SPIRV-Headers known good
2020-08-10 ezdiy GLSLANG_EXPORT for C APIs.
2020-08-07 john Non-functional: correctly do GL_EXT_buffer_reference2 semantic checking
2020-08-06 john Non-functional: consistently use 'const TSourceLoc&' to pass location.

Created with:
  roll-dep third_party/glslang

Roll third_party/googletest/ 3af06fe16..adeef1929 (4 commits)

google/googletest@3af06fe...adeef19

$ git log 3af06fe16..adeef1929 --date=short --no-merges --format='%ad %ae %s'
2020-08-12 krzysio Googletest export
2020-08-11 absl-team Googletest export
2020-08-11 dmauro Googletest export
2020-08-10 absl-team Googletest export

Created with:
  roll-dep third_party/googletest

Roll third_party/spirv-cross/ 82d1c43e4..4c7944bb4 (1 commit)

KhronosGroup/SPIRV-Cross@82d1c43...4c7944b

$ git log 82d1c43e4..4c7944bb4 --date=short --no-merges --format='%ad %ae %s'
2020-08-13 lehoangq Fix KhronosGroup#1445: MSL: Enclose args when convert distance(a,b) to abs(a-b)

Created with:
  roll-dep third_party/spirv-cross

Roll third_party/spirv-tools/ 2990a21..b8de4f5 (19 commits)

KhronosGroup/SPIRV-Tools@2990a21...b8de4f5

$ git log 2990a21..b8de4f5 --date=short --no-merges --format='%ad %ae %s'
2020-08-16 jaebaek Allow DebugTypeTemplate for Type operand (KhronosGroup#3702)
2020-08-14 antonikarp spirv-fuzz: Improve code coverage of tests (KhronosGroup#3686)
2020-08-14 stefanomil spirv-fuzz: Fuzzer pass to randomly apply loop preheaders (KhronosGroup#3668)
2020-08-14 vasniktel spirv-fuzz: Support identical predecessors in TransformationPropagateInstructionUp (KhronosGroup#3689)
2020-08-13 alanbaker Improve non-semantic instruction handling in the optimizer (KhronosGroup#3693)
2020-08-13 vasniktel Fix the bug (KhronosGroup#3680)
2020-08-12 andreperezmaselco.developer spirv-fuzz: Check integer and float width capabilities (KhronosGroup#3670)
2020-08-12 andreperezmaselco.developer spirv-fuzz: consider additional access chain instructions (KhronosGroup#3672)
2020-08-12 andreperezmaselco.developer spirv-fuzz: Ignore specialization constants (KhronosGroup#3664)
2020-08-12 vasniktel Fix the bug (KhronosGroup#3683)
2020-08-12 vasniktel spirv-fuzz: Fix width in FuzzerPassAddEquationInstructions (KhronosGroup#3685)
2020-08-12 jaebaek Preserve debug info in dead-insert-elim pass (KhronosGroup#3652)
2020-08-12 jaebaek Validate more OpenCL.DebugInfo.100 instructions (KhronosGroup#3684)
2020-08-11 alanbaker Only validation locations for appropriate execution models (KhronosGroup#3656)
2020-08-11 andreperezmaselco.developer spirv-fuzz: Fix in operand type assertion (KhronosGroup#3666)
2020-08-11 andreperezmaselco.developer spirv-opt: Add spvOpcodeIsAccessChain (KhronosGroup#3682)
2020-08-11 vasniktel spirv-fuzz: FuzzerPassPropagateInstructionsUp (KhronosGroup#3478)
2020-08-10 stevenperron Handle no index access chain in local access chain convert (KhronosGroup#3678)
2020-08-10 rharrison Roll 2 dependencies (KhronosGroup#3677)

Created with:
  roll-dep third_party/spirv-tools
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

spirv-fuzz: Segmentation fault in FuzzerPassInterchangeZeroLikeConstants::FindOrCreateToggledConstant

3 participants