)

This change allows the generator to (optionally and at random) make
the functions of a module "livesafe" during donation. This involves
introducing a loop limiter variable to each function and gating the
number of total loop iterations for the function using that variable.
It also involves eliminating OpKill and OpUnreachable instructions
(changing them to OpReturn/OpReturnValue), and clamping access chain
indices so that they are always in-bounds.

Adds a test to check that we do outline code that uses pointer
parameters.

This change adds a new kind of fact to the fact manager, which records
when a variable (or pointer parameter) refers to an arbitrary value,
so that anything can be stored to it, without affecting the observable
behaviour of the module, and nothing can be guaranteed about values
loaded from it. Donated modules are the current source of such
variables, and other transformations, such as outlining, have been
adapted to propagate these facts appropriately.

* Implement constant folding for many transcendentals

This change adds support for folding of sin/cos/tan/asin/acos/atan,
exp/log/exp2/log2, sqrt, atan2 and pow.

The mechanism allows to use any C function to implement folding in the
future; for now I limited the actual additions to the most commonly used
intrinsics in the shaders.

Unary folder had to be tweaked to work with extended instructions - for
extended instructions, constants.size() == 2 and constants[0] ==
nullptr. This adjustment is similar to the one binary folder already
performs.

Fixes KhronosGroup#1390.

* Fix Android build

On old versions of Android NDK, we don't get std::exp2/std::log2
because of partial C++11 support.

We do get ::exp2, but not ::log2 so we need to emulate that.

This adds support for replacing TimeAMD with OpReadClockKHR.  The scope
for OpReadClockKHR is fixed to be a subgroup because TimeAMD operates
only on subgroup.

…roup#3172)

If the fuzzer object-copies a pointer we would like to be able to
perform loads from the copy (and stores to it, if its value is known
not to matter).  Undefined and null pointers present a problem here,
so this change disallows copying them.

Adds a fuzzer pass that randomly adds vector and matrix types not
already present in the module, and randomly adds structs with random
field types and arrays with random base types and sizes. Other passes
will be able to create variables and ids using these types.

This adds language server support for the `GLSL.std.450`, `OpenCL.std` and `OpenCL.DebugInfo.100` extension instructions.

…roup#3175)

Adds two new fuzzer passes to add variables to a module: one that adds
Private storage class global variables, another that adds Function
storage class local variables.

This change adds fuzzer passes that sprinkle loads and stores into a
module at random, with stores restricted to occur in either dead
blocks, or to use pointers for which it is known that the pointee
value does not influence the module's overall behaviour.

The change also generalises the VariableValueIsArbitrary fact to
PointeeValueIsIrrelevant, to allow stores through access chains or
object copies of variables whose values are known to be irrelevant.

The change includes some other minor refactorings.

…onosGroup#3181)

This change ensures that global and local variables donated from other
modules are always initialized at their declaration in the module
being transformed.  This is to help limit issues related to undefined
behaviour that might arise due to accessing uninitialized memory.

The change also introduces some helper functions in fuzzer_util to
make it easier to find the pointee types of pointer types.

Adds a fuzzer pass that inserts function calls into the module at
random. Calls from dead blocks can be arbitrary (so long as they do
not introduce recursion), while calls from other blocks can only be to
livesafe functions.

The change fixes some oversights in transformations to replace
constants with uniforms and to obfuscate constants which testing of
this fuzzer pass identified.

This change adds a fuzzer pass that sprinkles access chain
instructions into a module at random. This allows other passes to
have a richer set of pointers available to them, in particular the
passes that add loads and stores.

…KhronosGroup#3188)

This fixes a bug where the type id of a type instruction, rather than
its result id, was being used.  It also favours using zero as the
return value when replacing an OpKill or OpUnreachable with a return
instruction, and adds a check that the donor module is valid when
doing module donation.

Fixes KhronosGroup#3187.

…osGroup#3186)

According to SPV_AMD_shader_image_load_store_lod spec, Lod operand is
valid with OpImageRead, OpImageWrite, or OpImageSparseRead if the
extension is enabled.

These were declared in the `Opcode` struct type, but were never assigned.
They're not actually used by the language server, but I reused this go schema package for a local experiment and found they were missing.

Fix KhronosGroup#1569

Fixes KhronosGroup#3138

* Start on walkthrough doc.

* Finished draft of doc.

…sGroup#3199)

…oup#3200)

* Combine the extinst-name and extinst-output-base into one arg.

Some build systems such as Android blueprints require that the inputs
and outputs of generator scripts are all provided as arguments.  These
two arguments to generate_language_headers.py are combined to form the
output path in the script.  This change simply lets the user provide the
whole output path as an argument.

* Fix typo in build_defs.bzl and update Android.mk

…#3133)

Add validation rules for DebugCompilationUnit, DebugSource,
DebugTypeBasic, DebugTypeVector, DebugTypeArray, DebugTypedef,
DebugTypeFunction, DebugTypeEnum, DebugTypeComposite,
DebugTypeMember, DebugTypeInheritance, DebugFunction,
DebugFunctionDeclaration, DebugLexicalBlock, DebugScope,
DebugLocalVariable, DebugDeclare, DebugExpression.

Fixes KhronosGroup#3075

Required for compatibility with (some?) Python3 installations.

…oup#3206)

This introduces a new fuzzer pass to add instructions to the module
that define equations, and support in the fact manager for recording
equation facts and deducing synonym facts from equation facts.

Initially the only equations that are supported involve OpIAdd,
OpISub, OpSNegate and OpLogicalNot, but there is scope for adding
support for equations over various other operators.

…#3205)

In this PR, the classes that represent the swap commutable operands
transformation and the fuzzer pass were implemented.

Fixes KhronosGroup#3205.

Changes FuzzerPass::MaybeAddTransformationBeforeEachInstruction to
FuzzerPass::ForEachInstructionWithInstructionDescriptor.

Fixes KhronosGroup#3184.

…oup#3212)

Fixes KhronosGroup#3194.

…osGroup#3211)

In this PR, the classes that represent the toggle access chain
instruction transformation and fuzzer pass were implemented. This
transformation toggles the instructions OpAccessChain and
OpInBoundsAccessChain between them.

Fixes KhronosGroup#3193.

…ym (KhronosGroup#3221)

In this PR, the class FuzzerPassApplyIdSynonyms was updated to allow OpPhi operand to be replaced with a composite synonym.

Fixes KhronosGroup#3209.

Fixes KhronosGroup#3218.

KhronosGroup#3223)

Fixes KhronosGroup#3213.

…sGroup#3225)

Fixes KhronosGroup#2856.

Create a pass to instrument OpDebugPrintf instructions.  This pass replaces all OpDebugPrintf instructions with instructions to write a record containing the string id and the all specified values into a special printf output buffer (if space allows). This pass is designed to support the printf validation in the Vulkan validation layers.

Fixes KhronosGroup#3210

…p#3230)

KhronosGroup/SPIRV-Headers@30ef660...a17e17e

$ git log 30ef660..a17e17e --date=short --no-merges --format='%ad %ae %s'
2020-03-13 jmadill Add missing header to BUILD.gn.

Created with:
  roll-dep external/spirv-headers

Update validator for SPV_KHR_ray_tracing.

* Added handling for new enum types
* Add SpvScopeShaderCallKHR as a valid scope
* update spirv-headers

Co-authored-by: alelenv <alele@nvidia.com>
Co-authored-by: Torosdagli <ntorosda@amd.com>
Co-authored-by: Tobias Hector <tobias.hector@amd.com>
Co-authored-by: Steven Perron <stevenperron@google.com>

…Group#3236)

Add missing RayQueryProvisionalKHR types

It only works when the operand is a literal string.

Add newlines to two files

…Group#3183)

When DebugScope is given in SPIR-V, each instruction following the
DebugScope is from the lexical scope pointed by the DebugScope in
the high level language. We add DebugScope struction to keep the
scope information in Instruction class. When ir_loader loads
DebugScope/DebugNoScope, it keeps the scope information in
|last_dbg_scope_| and lets following instructions have that scope
information.

In terms of DebugDeclare/DebugValue, if it is in a function body
but outside of a basic block, we keep it in |debug_insts_in_header_|
of Function class. If it is in a basic block, we keep it as a normal
instruction i.e., in a instruction list of BasicBlock.

* Disallow phis of sampled images always
* Disallow phis of samplers and images for shaders
* Add tests
* Gate check to only occur post-legalization

Fixes KhronosGroup#3252

* Image and buffer queries did not account for optional level of
arrayness on the variable
  * new tests

…oup#3259)

Fixes KhronosGroup#3268

* Set the parent of the basic block for the wrapper function
* Add a test

* Update dominates to check for null nodes

Fixes KhronosGroup#3270

Allows several validator options to be passed to the fuzzer, to be
used when validation is invoked during fuzzing.

Some transformations (e.g. TransformationAddFunction) rely on running
the validator to decide whether the transformation is applicable.  A
recent change allowed spirv-fuzz to take validator options, to cater
for the case where a module should be considered valid under
particular conditions.  However, validation during the checking of
transformations had no access to these validator options.

This change introduced TransformationContext, which currently consists
of a fact manager and a set of validator options, but could in the
future have other fields corresponding to other objects that it is
useful to have access to when applying transformations.  Now, instead
of checking and applying transformations in the context of a
FactManager, a TransformationContext is used.  This gives access to
the fact manager as before, and also access to the validator options
when they are needed.

Fixes an issue where an id use in a non-regular context, e.g. as a
scope parameter to an atomic instruction, would be replaced with a
synonym.

…oup#3257)

To avoid problems where global and local variables of opaque or
runtime-sized types are added to a module, this change introduces the
notion of a 'basic type' -- a type made up from floats, ints, bools,
or vectors, matrices, structs and fixed-size arrays of basic types.
Added variables have to be of basic type.

KhronosGroup#3262)

The fuzzer pass that constructs composites had an issue where it would
regard isomorphic but distinct structs (similarly arrays) as being
interchangeable when constructing composites.  This change fixes the
problem by relying less on the type manager.

Adds a transformation for adding OpConstantNull to a module, for
appropriate data types.

…roup#3277)

(1) Runtime arrays are turned into fixed-size arrays, by turning
    OpTypeRuntimeArray into OpTypeArray and uses of OpArrayLength into
    uses of the constant used for the length of the fixed-size array.

(2) Atomic instructions are not donated, and uses of their results are
    replaced with uses of constants of the result type.

This change increases the extent to which arbitrary SPIR-V can be used
by the fuzzer pass that donates modules. It handles the case where
various ingredients (such as types, variables and particular
instructions) cannot be donated by omitting them, and then either
omitting their dependencies or replacing their dependencies with
alternative instructions.

The change pays particular attention to allowing code that manipulates
image types to be handled (by skipping anything image-specific).

The management of equation facts suffered from two problems:

(1) The processing of an equation fact required the data descriptors
    used in the equation to be in canonical form.  However, during
    fact processing it can be deduced that certain data descriptors
    are equivalent, causing their equivalence classes to be merged,
    and that could cause previously canonical data descriptors to no
    longer be canonical.

(2) Related to this, if id equations were known about a canonical data
    descriptor dd1, and other id equations known about a different
    canonical data descriptor dd2, the equation facts about these data
    descriptors were not being merged in the event that dd1 and dd2
    were deduced to be equivalent.

This changes solves (1) by not requiring equation facts to be in
canonical form while processing them, but instead always checking
whether (not necessary canonical) data descriptors are equivalent when
looking for corollaries of equation facts, rather than comparing them
using ==.

Problem (2) is solved by adding logic to merge sets of equations when
data descriptors are made equivalent.

In addition, the change also requires elements to be registered in an
equivalence relation before they can be made equivalent, rather than
being added (if not already present) at the point of being made
equivalent.

* Handle more cases in dead member elim

- Rewrite composite insert and extract operations on SpecConstnatOp.
- Leaves assert for Access chain instructions, which are only allowed
for kernels.
- Other operations do not require any extra code will no longer cause an
assert.

Fixes KhronosGroup#3284.
Fixes KhronosGroup#3282.

* Preserve debug info in eliminate-dead-functions

The elimination of dead functions makes OpFunction operand of
DebugFunction invalid. This commit replaces the operand with
DebugInfoNone.

Loop headers must be marked as in the continue if the loop header is
also the continue target.

Fixes KhronosGroup#3264

…up#3299)

This allows enclosing projects to use SPIRV-Headers_SOURCE_DIR
to set up in header includes.

We have not added tests for the new command line options recently.  I've
updated the test and fixed on option that was incorrect.

Fixes KhronosGroup#3247

Fixes KhronosGroup#3296

* Make OpReturn its own case fully

There are some cases where a variable that is declared as a sampled
image could be read only.  That is when the image type has sampled == 1.

Fixes KhronosGroup#3288

The SPIR-V data rules say that all uses of an OpSampledImage
instruction must be in the same block as the instruction, and highly
restrict those instructions that can consume the result id of an
OpSampledImage.

This adapts the transformations that split blocks and create synonyms
to avoid separating an OpSampledImage use from its definition, and to
avoid synonym-creation instructions such as OpCopyObject consuming an
OpSampledImage result id.

Demotes the image storage class to Private during donation.  Also
fixes an issue where instructions that depended on non-donated global
values would not be handled properly.

…hronosGroup#3292)

Provides support for runtime arrays in the code that traverses
composite types when checking applicability of transformations that
replace ids with synonyms.

…nosGroup#3291)

The function outliner uses a struct to return ids that a region
generates and that are used outside that region.  If these ids have
pointer type this would result in a struct with pointer members, which
leads to illegal loading from non-logical pointers if logical
addressing is used.  This change bans that outlining possibility.

Adds an extra condition on when a region can be outlined to avoid the
case where a region ends with a loop head but such that the loop's
continue target is in the region.  (Outlining such a region would mean
that the loop merge is in the original function and the continue target
in the outlined function.)