spirv-fuzz: FuzzerPassPropagateInstructionsUp (#3478)

Given an instruction (that may use an OpPhi result from the same block as an input operand), try to clone the instruction into each predecessor block, replacing the input operand with the corresponding OpPhi input operand in each case, if necessary.

Fixes #3458.

source/fuzz/CMakeLists.txt

@@ -75,6 +75,7 @@ if(SPIRV_BUILD_FUZZER)
         fuzzer_pass_permute_function_parameters.h
         fuzzer_pass_permute_instructions.h
         fuzzer_pass_permute_phi_operands.h
+        fuzzer_pass_propagate_instructions_up.h
         fuzzer_pass_push_ids_through_variables.h
         fuzzer_pass_replace_adds_subs_muls_with_carrying_extended.h
         fuzzer_pass_replace_copy_memories_with_loads_stores.h
@@ -142,6 +143,7 @@ if(SPIRV_BUILD_FUZZER)
         transformation_outline_function.h
         transformation_permute_function_parameters.h
         transformation_permute_phi_operands.h
+        transformation_propagate_instruction_up.h
         transformation_push_id_through_variable.h
         transformation_record_synonymous_constants.h
         transformation_replace_add_sub_mul_with_carrying_extended.h
@@ -212,6 +214,7 @@ if(SPIRV_BUILD_FUZZER)
         fuzzer_pass_permute_function_parameters.cpp
         fuzzer_pass_permute_instructions.cpp
         fuzzer_pass_permute_phi_operands.cpp
+        fuzzer_pass_propagate_instructions_up.cpp
         fuzzer_pass_push_ids_through_variables.cpp
         fuzzer_pass_replace_adds_subs_muls_with_carrying_extended.cpp
         fuzzer_pass_replace_copy_memories_with_loads_stores.cpp
@@ -278,6 +281,7 @@ if(SPIRV_BUILD_FUZZER)
         transformation_outline_function.cpp
         transformation_permute_function_parameters.cpp
         transformation_permute_phi_operands.cpp
+        transformation_propagate_instruction_up.cpp
         transformation_push_id_through_variable.cpp
         transformation_record_synonymous_constants.cpp
         transformation_replace_add_sub_mul_with_carrying_extended.cpp

source/fuzz/fuzzer.cpp

@@ -57,6 +57,7 @@
 #include "source/fuzz/fuzzer_pass_permute_function_parameters.h"
 #include "source/fuzz/fuzzer_pass_permute_instructions.h"
 #include "source/fuzz/fuzzer_pass_permute_phi_operands.h"
+#include "source/fuzz/fuzzer_pass_propagate_instructions_up.h"
 #include "source/fuzz/fuzzer_pass_push_ids_through_variables.h"
 #include "source/fuzz/fuzzer_pass_replace_linear_algebra_instructions.h"
 #include "source/fuzz/fuzzer_pass_replace_parameter_with_global.h"
@@ -289,6 +290,9 @@ Fuzzer::FuzzerResultStatus Fuzzer::Run(
     MaybeAddPass<FuzzerPassPermuteInstructions>(
         &passes, ir_context.get(), &transformation_context, &fuzzer_context,
         transformation_sequence_out);
+    MaybeAddPass<FuzzerPassPropagateInstructionsUp>(
+        &passes, ir_context.get(), &transformation_context, &fuzzer_context,
+        transformation_sequence_out);
     MaybeAddPass<FuzzerPassPushIdsThroughVariables>(
         &passes, ir_context.get(), &transformation_context, &fuzzer_context,
         transformation_sequence_out);

source/fuzz/fuzzer_context.cpp

@@ -81,6 +81,8 @@ const std::pair<uint32_t, uint32_t> kChanceOfOutliningFunction = {10, 90};
 const std::pair<uint32_t, uint32_t> kChanceOfPermutingInstructions = {20, 70};
 const std::pair<uint32_t, uint32_t> kChanceOfPermutingParameters = {30, 90};
 const std::pair<uint32_t, uint32_t> kChanceOfPermutingPhiOperands = {30, 90};
+const std::pair<uint32_t, uint32_t> kChanceOfPropagatingInstructionsUp = {20,
+                                                                          70};
 const std::pair<uint32_t, uint32_t> kChanceOfPushingIdThroughVariable = {5, 50};
 const std::pair<uint32_t, uint32_t>
     kChanceOfReplacingAddSubMulWithCarryingExtended = {20, 90};
@@ -227,6 +229,8 @@ FuzzerContext::FuzzerContext(RandomGenerator* random_generator,
       ChooseBetweenMinAndMax(kChanceOfPermutingParameters);
   chance_of_permuting_phi_operands_ =
       ChooseBetweenMinAndMax(kChanceOfPermutingPhiOperands);
+  chance_of_propagating_instructions_up_ =
+      ChooseBetweenMinAndMax(kChanceOfPropagatingInstructionsUp);
   chance_of_pushing_id_through_variable_ =
       ChooseBetweenMinAndMax(kChanceOfPushingIdThroughVariable);
   chance_of_replacing_add_sub_mul_with_carrying_extended_ =

source/fuzz/fuzzer_context.h

@@ -218,6 +218,9 @@ class FuzzerContext {
   uint32_t GetChanceOfPermutingPhiOperands() {
     return chance_of_permuting_phi_operands_;
   }
+  uint32_t GetChanceOfPropagatingInstructionsUp() {
+    return chance_of_propagating_instructions_up_;
+  }
   uint32_t GetChanceOfPushingIdThroughVariable() {
     return chance_of_pushing_id_through_variable_;
   }
@@ -377,6 +380,7 @@ class FuzzerContext {
   uint32_t chance_of_permuting_instructions_;
   uint32_t chance_of_permuting_parameters_;
   uint32_t chance_of_permuting_phi_operands_;
+  uint32_t chance_of_propagating_instructions_up_;
   uint32_t chance_of_pushing_id_through_variable_;
   uint32_t chance_of_replacing_add_sub_mul_with_carrying_extended_;
   uint32_t chance_of_replacing_copy_memory_with_load_store_;

source/fuzz/fuzzer_pass_propagate_instructions_up.cpp

@@ -0,0 +1,58 @@
+// Copyright (c) 2020 Vasyl Teliman
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "source/fuzz/fuzzer_pass_propagate_instructions_up.h"
+
+#include "source/fuzz/fuzzer_context.h"
+#include "source/fuzz/fuzzer_util.h"
+#include "source/fuzz/instruction_descriptor.h"
+#include "source/fuzz/transformation_propagate_instruction_up.h"
+
+namespace spvtools {
+namespace fuzz {
+
+FuzzerPassPropagateInstructionsUp::FuzzerPassPropagateInstructionsUp(
+    opt::IRContext* ir_context, TransformationContext* transformation_context,
+    FuzzerContext* fuzzer_context,
+    protobufs::TransformationSequence* transformations)
+    : FuzzerPass(ir_context, transformation_context, fuzzer_context,
+                 transformations) {}
+
+FuzzerPassPropagateInstructionsUp::~FuzzerPassPropagateInstructionsUp() =
+    default;
+
+void FuzzerPassPropagateInstructionsUp::Apply() {
+  for (const auto& function : *GetIRContext()->module()) {
+    for (const auto& block : function) {
+      if (!GetFuzzerContext()->ChoosePercentage(
+              GetFuzzerContext()->GetChanceOfPropagatingInstructionsUp())) {
+        continue;
+      }
+
+      if (TransformationPropagateInstructionUp::IsApplicableToBlock(
+              GetIRContext(), block.id())) {
+        std::map<uint32_t, uint32_t> fresh_ids;
+        for (auto id : GetIRContext()->cfg()->preds(block.id())) {
+          fresh_ids[id] = GetFuzzerContext()->GetFreshId();
+        }
+
+        ApplyTransformation(
+            TransformationPropagateInstructionUp(block.id(), fresh_ids));
+      }
+    }
+  }
+}
+
+}  // namespace fuzz
+}  // namespace spvtools

source/fuzz/fuzzer_pass_propagate_instructions_up.h

@@ -0,0 +1,40 @@
+// Copyright (c) 2020 Vasyl Teliman
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef SOURCE_FUZZ_FUZZER_PASS_PROPAGATE_INSTRUCTIONS_UP_H_
+#define SOURCE_FUZZ_FUZZER_PASS_PROPAGATE_INSTRUCTIONS_UP_H_
+
+#include "source/fuzz/fuzzer_pass.h"
+
+namespace spvtools {
+namespace fuzz {
+
+// Decides whether to propagate instructions from some block into its
+// predecessors.
+class FuzzerPassPropagateInstructionsUp : public FuzzerPass {
+ public:
+  FuzzerPassPropagateInstructionsUp(
+      opt::IRContext* ir_context, TransformationContext* transformation_context,
+      FuzzerContext* fuzzer_context,
+      protobufs::TransformationSequence* transformations);
+
+  ~FuzzerPassPropagateInstructionsUp() override;
+
+  void Apply() override;
+};
+
+}  // namespace fuzz
+}  // namespace spvtools
+
+#endif  // SOURCE_FUZZ_FUZZER_PASS_PROPAGATE_INSTRUCTIONS_UP_H_

source/fuzz/protobufs/spvtoolsfuzz.proto

@@ -411,6 +411,7 @@ message Transformation {
     TransformationMoveInstructionDown move_instruction_down = 64;
     TransformationMakeVectorOperationDynamic make_vector_operation_dynamic = 65;
     TransformationReplaceAddSubMulWithCarryingExtended replace_add_sub_mul_with_carrying_extended = 66;
+    TransformationPropagateInstructionUp propagate_instruction_up = 67;
     // Add additional option using the next available number.
   }
 }
@@ -1239,6 +1240,26 @@ message TransformationPermutePhiOperands {
 
 }
 
+message TransformationPropagateInstructionUp {
+
+  // Propagates an instruction in the block into the block's predecessors.
+  // Concretely, this transformation clones some particular instruction from
+  // the |block_id| into every block's predecessor and replaces the original
+  // instruction with OpPhi. Take a look at the transformation class to learn
+  // more about how we choose what instruction to propagate.
+
+  // Id of the block to propagate an instruction from.
+  uint32 block_id = 1;
+
+  // A map from the id of some predecessor of the |block_id| to the fresh id.
+  // The map contains a fresh id for at least every predecessor of the |block_id|.
+  // The instruction is propagated by creating a number of clones - one clone for
+  // each predecessor. Fresh ids from this field are used as result ids of cloned
+  // instructions.
+  repeated UInt32Pair predecessor_id_to_fresh_id = 2;
+
+}
+
 message TransformationPushIdThroughVariable {
 
   // A transformation that makes |value_synonym_id| and |value_id| to be

source/fuzz/transformation.cpp

@@ -61,6 +61,7 @@
 #include "source/fuzz/transformation_outline_function.h"
 #include "source/fuzz/transformation_permute_function_parameters.h"
 #include "source/fuzz/transformation_permute_phi_operands.h"
+#include "source/fuzz/transformation_propagate_instruction_up.h"
 #include "source/fuzz/transformation_push_id_through_variable.h"
 #include "source/fuzz/transformation_record_synonymous_constants.h"
 #include "source/fuzz/transformation_replace_add_sub_mul_with_carrying_extended.h"
@@ -214,6 +215,9 @@ std::unique_ptr<Transformation> Transformation::FromMessage(
     case protobufs::Transformation::TransformationCase::kPermutePhiOperands:
       return MakeUnique<TransformationPermutePhiOperands>(
           message.permute_phi_operands());
+    case protobufs::Transformation::TransformationCase::kPropagateInstructionUp:
+      return MakeUnique<TransformationPropagateInstructionUp>(
+          message.propagate_instruction_up());
     case protobufs::Transformation::TransformationCase::kPushIdThroughVariable:
       return MakeUnique<TransformationPushIdThroughVariable>(
           message.push_id_through_variable());

source/fuzz/transformation_propagate_instruction_up.cpp

@@ -0,0 +1,391 @@
+// Copyright (c) 2020 Vasyl Teliman
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "source/fuzz/transformation_propagate_instruction_up.h"
+
+#include "source/fuzz/fuzzer_util.h"
+#include "source/fuzz/instruction_descriptor.h"
+
+namespace spvtools {
+namespace fuzz {
+namespace {
+
+uint32_t GetResultIdFromLabelId(const opt::Instruction& phi_inst,
+                                uint32_t label_id) {
+  assert(phi_inst.opcode() == SpvOpPhi && "|phi_inst| is not an OpPhi");
+
+  for (uint32_t i = 1; i < phi_inst.NumInOperands(); i += 2) {
+    if (phi_inst.GetSingleWordInOperand(i) == label_id) {
+      return phi_inst.GetSingleWordInOperand(i - 1);
+    }
+  }
+
+  return 0;
+}
+
+bool ContainsPointers(const opt::analysis::Type& type) {
+  switch (type.kind()) {
+    case opt::analysis::Type::kPointer:
+      return true;
+    case opt::analysis::Type::kStruct:
+      return std::any_of(type.AsStruct()->element_types().begin(),
+                         type.AsStruct()->element_types().end(),
+                         [](const opt::analysis::Type* element_type) {
+                           return ContainsPointers(*element_type);
+                         });
+    default:
+      return false;
+  }
+}
+
+bool HasValidDependencies(opt::IRContext* ir_context, opt::Instruction* inst) {
+  const auto* inst_block = ir_context->get_instr_block(inst);
+  assert(inst_block &&
+         "This function shouldn't be applied to global instructions or function"
+         "parameters");
+
+  for (uint32_t i = 0; i < inst->NumInOperands(); ++i) {
+    const auto& operand = inst->GetInOperand(i);
+    if (operand.type != SPV_OPERAND_TYPE_ID) {
+      // Consider only <id> operands.
+      continue;
+    }
+
+    auto* dependency = ir_context->get_def_use_mgr()->GetDef(operand.words[0]);
+    assert(dependency && "Operand has invalid id");
+
+    if (ir_context->get_instr_block(dependency) == inst_block &&
+        dependency->opcode() != SpvOpPhi) {
+      // |dependency| is "valid" if it's an OpPhi from the same basic block or
+      // an instruction from a different basic block.
+      return false;
+    }
+  }
+
+  return true;
+}
+
+}  // namespace
+
+TransformationPropagateInstructionUp::TransformationPropagateInstructionUp(
+    const protobufs::TransformationPropagateInstructionUp& message)
+    : message_(message) {}
+
+TransformationPropagateInstructionUp::TransformationPropagateInstructionUp(
+    uint32_t block_id,
+    const std::map<uint32_t, uint32_t>& predecessor_id_to_fresh_id) {
+  message_.set_block_id(block_id);
+  *message_.mutable_predecessor_id_to_fresh_id() =
+      fuzzerutil::MapToRepeatedUInt32Pair(predecessor_id_to_fresh_id);
+}
+
+bool TransformationPropagateInstructionUp::IsApplicable(
+    opt::IRContext* ir_context, const TransformationContext& /*unused*/) const {
+  // Check that we can apply this transformation to the |block_id|.
+  if (!IsApplicableToBlock(ir_context, message_.block_id())) {
+    return false;
+  }
+
+  const auto predecessor_id_to_fresh_id = fuzzerutil::RepeatedUInt32PairToMap(
+      message_.predecessor_id_to_fresh_id());
+  std::vector<uint32_t> maybe_fresh_ids;
+  for (auto id : ir_context->cfg()->preds(message_.block_id())) {
+    // Each predecessor must have a fresh id in the |predecessor_id_to_fresh_id|
+    // map.
+    if (!predecessor_id_to_fresh_id.count(id)) {
+      return false;
+    }
+
+    maybe_fresh_ids.push_back(predecessor_id_to_fresh_id.at(id));
+  }
+
+  // All ids must be unique and fresh.
+  return !fuzzerutil::HasDuplicates(maybe_fresh_ids) &&
+         std::all_of(maybe_fresh_ids.begin(), maybe_fresh_ids.end(),
+                     [ir_context](uint32_t id) {
+                       return fuzzerutil::IsFreshId(ir_context, id);
+                     });
+}
+
+void TransformationPropagateInstructionUp::Apply(
+    opt::IRContext* ir_context, TransformationContext* /*unused*/) const {
+  auto* inst = GetInstructionToPropagate(ir_context, message_.block_id());
+  assert(inst &&
+         "The block must have at least one supported instruction to propagate");
+  assert(inst->result_id() && inst->type_id() &&
+         "|inst| must have a result id and a type id");
+
+  opt::Instruction::OperandList op_phi_operands;
+  const auto predecessor_id_to_fresh_id = fuzzerutil::RepeatedUInt32PairToMap(
+      message_.predecessor_id_to_fresh_id());
+  for (auto predecessor_id : ir_context->cfg()->preds(message_.block_id())) {
+    auto new_result_id = predecessor_id_to_fresh_id.at(predecessor_id);
+
+    // Compute InOperands for the OpPhi instruction to be inserted later.
+    op_phi_operands.push_back({SPV_OPERAND_TYPE_ID, {new_result_id}});
+    op_phi_operands.push_back({SPV_OPERAND_TYPE_ID, {predecessor_id}});
+
+    // Create a clone of the |inst| to be inserted into the |predecessor_id|.
+    std::unique_ptr<opt::Instruction> clone(inst->Clone(ir_context));
+    clone->SetResultId(new_result_id);
+
+    fuzzerutil::UpdateModuleIdBound(ir_context, new_result_id);
+
+    // Adjust |clone|'s operands to account for possible dependencies on OpPhi
+    // instructions from the same basic block.
+    for (uint32_t i = 0; i < clone->NumInOperands(); ++i) {
+      auto& operand = clone->GetInOperand(i);
+      if (operand.type != SPV_OPERAND_TYPE_ID) {
+        // Consider only ids.
+        continue;
+      }
+
+      const auto* dependency_inst =
+          ir_context->get_def_use_mgr()->GetDef(operand.words[0]);
+      assert(dependency_inst && "|clone| depends on an invalid id");
+
+      if (ir_context->get_instr_block(dependency_inst->result_id()) !=
+          ir_context->cfg()->block(message_.block_id())) {
+        // We don't need to adjust anything if |dependency_inst| is from a
+        // different block, a global instruction or a function parameter.
+        continue;
+      }
+
+      assert(dependency_inst->opcode() == SpvOpPhi &&
+             "Propagated instruction can depend only on OpPhis from the same "
+             "basic block or instructions from different basic blocks");
+
+      auto new_id = GetResultIdFromLabelId(*dependency_inst, predecessor_id);
+      assert(new_id && "OpPhi instruction is missing a predecessor");
+      operand.words[0] = new_id;
+    }
+
+    auto* insert_before_inst = fuzzerutil::GetLastInsertBeforeInstruction(
+        ir_context, predecessor_id, clone->opcode());
+    assert(insert_before_inst && "Can't insert |clone| into |predecessor_id");
+
+    insert_before_inst->InsertBefore(std::move(clone));
+  }
+
+  // Insert an OpPhi instruction into the basic block of |inst|.
+  ir_context->get_instr_block(inst)->begin()->InsertBefore(
+      MakeUnique<opt::Instruction>(ir_context, SpvOpPhi, inst->type_id(),
+                                   inst->result_id(),
+                                   std::move(op_phi_operands)));
+
+  // Remove |inst| from the basic block.
+  ir_context->KillInst(inst);
+
+  // We have changed the module so most analyzes are now invalid.
+  ir_context->InvalidateAnalysesExceptFor(
+      opt::IRContext::Analysis::kAnalysisNone);
+}
+
+protobufs::Transformation TransformationPropagateInstructionUp::ToMessage()
+    const {
+  protobufs::Transformation result;
+  *result.mutable_propagate_instruction_up() = message_;
+  return result;
+}
+
+bool TransformationPropagateInstructionUp::IsOpcodeSupported(SpvOp opcode) {
+  // TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/3605):
+  //  We only support "simple" instructions that don't work with memory.
+  //  We should extend this so that we support the ones that modify the memory
+  //  too.
+  switch (opcode) {
+    case SpvOpUndef:
+    case SpvOpAccessChain:
+    case SpvOpInBoundsAccessChain:
+    case SpvOpArrayLength:
+    case SpvOpVectorExtractDynamic:
+    case SpvOpVectorInsertDynamic:
+    case SpvOpVectorShuffle:
+    case SpvOpCompositeConstruct:
+    case SpvOpCompositeExtract:
+    case SpvOpCompositeInsert:
+    case SpvOpCopyObject:
+    case SpvOpTranspose:
+    case SpvOpConvertFToU:
+    case SpvOpConvertFToS:
+    case SpvOpConvertSToF:
+    case SpvOpConvertUToF:
+    case SpvOpUConvert:
+    case SpvOpSConvert:
+    case SpvOpFConvert:
+    case SpvOpQuantizeToF16:
+    case SpvOpSatConvertSToU:
+    case SpvOpSatConvertUToS:
+    case SpvOpBitcast:
+    case SpvOpSNegate:
+    case SpvOpFNegate:
+    case SpvOpIAdd:
+    case SpvOpFAdd:
+    case SpvOpISub:
+    case SpvOpFSub:
+    case SpvOpIMul:
+    case SpvOpFMul:
+    case SpvOpUDiv:
+    case SpvOpSDiv:
+    case SpvOpFDiv:
+    case SpvOpUMod:
+    case SpvOpSRem:
+    case SpvOpSMod:
+    case SpvOpFRem:
+    case SpvOpFMod:
+    case SpvOpVectorTimesScalar:
+    case SpvOpMatrixTimesScalar:
+    case SpvOpVectorTimesMatrix:
+    case SpvOpMatrixTimesVector:
+    case SpvOpMatrixTimesMatrix:
+    case SpvOpOuterProduct:
+    case SpvOpDot:
+    case SpvOpIAddCarry:
+    case SpvOpISubBorrow:
+    case SpvOpUMulExtended:
+    case SpvOpSMulExtended:
+    case SpvOpAny:
+    case SpvOpAll:
+    case SpvOpIsNan:
+    case SpvOpIsInf:
+    case SpvOpIsFinite:
+    case SpvOpIsNormal:
+    case SpvOpSignBitSet:
+    case SpvOpLessOrGreater:
+    case SpvOpOrdered:
+    case SpvOpUnordered:
+    case SpvOpLogicalEqual:
+    case SpvOpLogicalNotEqual:
+    case SpvOpLogicalOr:
+    case SpvOpLogicalAnd:
+    case SpvOpLogicalNot:
+    case SpvOpSelect:
+    case SpvOpIEqual:
+    case SpvOpINotEqual:
+    case SpvOpUGreaterThan:
+    case SpvOpSGreaterThan:
+    case SpvOpUGreaterThanEqual:
+    case SpvOpSGreaterThanEqual:
+    case SpvOpULessThan:
+    case SpvOpSLessThan:
+    case SpvOpULessThanEqual:
+    case SpvOpSLessThanEqual:
+    case SpvOpFOrdEqual:
+    case SpvOpFUnordEqual:
+    case SpvOpFOrdNotEqual:
+    case SpvOpFUnordNotEqual:
+    case SpvOpFOrdLessThan:
+    case SpvOpFUnordLessThan:
+    case SpvOpFOrdGreaterThan:
+    case SpvOpFUnordGreaterThan:
+    case SpvOpFOrdLessThanEqual:
+    case SpvOpFUnordLessThanEqual:
+    case SpvOpFOrdGreaterThanEqual:
+    case SpvOpFUnordGreaterThanEqual:
+    case SpvOpShiftRightLogical:
+    case SpvOpShiftRightArithmetic:
+    case SpvOpShiftLeftLogical:
+    case SpvOpBitwiseOr:
+    case SpvOpBitwiseXor:
+    case SpvOpBitwiseAnd:
+    case SpvOpNot:
+    case SpvOpBitFieldInsert:
+    case SpvOpBitFieldSExtract:
+    case SpvOpBitFieldUExtract:
+    case SpvOpBitReverse:
+    case SpvOpBitCount:
+    case SpvOpCopyLogical:
+    case SpvOpPtrEqual:
+    case SpvOpPtrNotEqual:
+      return true;
+    default:
+      return false;
+  }
+}
+
+opt::Instruction*
+TransformationPropagateInstructionUp::GetInstructionToPropagate(
+    opt::IRContext* ir_context, uint32_t block_id) {
+  auto* block = ir_context->cfg()->block(block_id);
+  assert(block && "|block_id| is invalid");
+
+  for (auto& inst : *block) {
+    // We look for the first instruction in the block that satisfies the
+    // following rules:
+    // - it's not an OpPhi
+    // - it must be supported by this transformation
+    // - it may depend only on instructions from different basic blocks or on
+    //   OpPhi instructions from the same basic block.
+    if (inst.opcode() == SpvOpPhi || !IsOpcodeSupported(inst.opcode()) ||
+        !inst.type_id() || !inst.result_id()) {
+      continue;
+    }
+
+    const auto* inst_type = ir_context->get_type_mgr()->GetType(inst.type_id());
+    assert(inst_type && "|inst| has invalid type");
+
+    if (!ir_context->get_feature_mgr()->HasCapability(
+            SpvCapabilityVariablePointersStorageBuffer) &&
+        ContainsPointers(*inst_type)) {
+      // OpPhi supports pointer operands only with VariablePointers or
+      // VariablePointersStorageBuffer capabilities.
+      //
+      // Note that VariablePointers capability implicitly declares
+      // VariablePointersStorageBuffer capability.
+      continue;
+    }
+
+    if (!HasValidDependencies(ir_context, &inst)) {
+      continue;
+    }
+
+    return &inst;
+  }
+
+  return nullptr;
+}
+
+bool TransformationPropagateInstructionUp::IsApplicableToBlock(
+    opt::IRContext* ir_context, uint32_t block_id) {
+  // Check that |block_id| is valid.
+  const auto* label_inst = ir_context->get_def_use_mgr()->GetDef(block_id);
+  if (!label_inst || label_inst->opcode() != SpvOpLabel) {
+    return false;
+  }
+
+  // Check that |block| has predecessors.
+  const auto& predecessors = ir_context->cfg()->preds(block_id);
+  if (predecessors.empty()) {
+    return false;
+  }
+
+  // The block must contain an instruction to propagate.
+  const auto* inst_to_propagate =
+      GetInstructionToPropagate(ir_context, block_id);
+  if (!inst_to_propagate) {
+    return false;
+  }
+
+  // We should be able to insert |inst_to_propagate| into every predecessor of
+  // |block|.
+  return std::all_of(predecessors.begin(), predecessors.end(),
+                     [ir_context, inst_to_propagate](uint32_t predecessor_id) {
+                       return fuzzerutil::GetLastInsertBeforeInstruction(
+                                  ir_context, predecessor_id,
+                                  inst_to_propagate->opcode()) != nullptr;
+                     });
+}
+
+}  // namespace fuzz
+}  // namespace spvtools

source/fuzz/transformation_propagate_instruction_up.h

@@ -0,0 +1,89 @@
+// Copyright (c) 2020 Vasyl Teliman
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef SOURCE_FUZZ_TRANSFORMATION_PROPAGATE_INSTRUCTION_UP_H_
+#define SOURCE_FUZZ_TRANSFORMATION_PROPAGATE_INSTRUCTION_UP_H_
+
+#include <map>
+
+#include "source/fuzz/protobufs/spirvfuzz_protobufs.h"
+#include "source/fuzz/transformation.h"
+#include "source/fuzz/transformation_context.h"
+#include "source/opt/ir_context.h"
+
+namespace spvtools {
+namespace fuzz {
+
+class TransformationPropagateInstructionUp : public Transformation {
+ public:
+  explicit TransformationPropagateInstructionUp(
+      const protobufs::TransformationPropagateInstructionUp& message);
+
+  TransformationPropagateInstructionUp(
+      uint32_t block_id,
+      const std::map<uint32_t, uint32_t>& predecessor_id_to_fresh_id);
+
+  // - |block_id| must be a valid result id of some OpLabel instruction.
+  // - |block_id| must have at least one predecessor
+  // - |block_id| must contain an instruction that can be propagated using this
+  //   transformation
+  // - the instruction can be propagated if:
+  //   - it's not an OpPhi
+  //   - it is supported by this transformation
+  //   - it depends only on instructions from different basic blocks or on
+  //     OpPhi instructions from the same basic block
+  // - it should be possible to insert the propagated instruction at the end of
+  //   each |block_id|'s predecessor
+  // - |predecessor_id_to_fresh_id| must have an entry for at least every
+  //   predecessor of |block_id|
+  // - each value in the |predecessor_id_to_fresh_id| map must be a fresh id
+  // - all fresh ids in the |predecessor_id_to_fresh_id| must be unique
+  bool IsApplicable(
+      opt::IRContext* ir_context,
+      const TransformationContext& transformation_context) const override;
+
+  // Inserts a copy of the propagated instruction into each |block_id|'s
+  // predecessor. Replaces the original instruction with an OpPhi referring
+  // inserted copies.
+  void Apply(opt::IRContext* ir_context,
+             TransformationContext* transformation_context) const override;
+
+  protobufs::Transformation ToMessage() const override;
+
+  // Returns true if this transformation can be applied to the block with id
+  // |block_id|. Concretely, returns true iff:
+  // - |block_id| is a valid id of some block in the module
+  // - |block_id| has predecessors
+  // - |block_id| contains an instruction that can be propagated
+  // - it is possible to insert the propagated instruction into every
+  //   |block_id|'s predecessor
+  static bool IsApplicableToBlock(opt::IRContext* ir_context,
+                                  uint32_t block_id);
+
+ private:
+  // Returns the instruction that will be propagated into the predecessors of
+  // the |block_id|. Returns nullptr if no such an instruction exists.
+  static opt::Instruction* GetInstructionToPropagate(opt::IRContext* ir_context,
+                                                     uint32_t block_id);
+
+  // Returns true if |opcode| is supported by this transformation.
+  static bool IsOpcodeSupported(SpvOp opcode);
+
+  protobufs::TransformationPropagateInstructionUp message_;
+};
+
+}  // namespace fuzz
+}  // namespace spvtools
+
+#endif  // SOURCE_FUZZ_TRANSFORMATION_PROPAGATE_INSTRUCTION_UP_H_

test/fuzz/CMakeLists.txt

@@ -69,6 +69,7 @@ if (${SPIRV_BUILD_FUZZER})
           transformation_outline_function_test.cpp
           transformation_permute_function_parameters_test.cpp
           transformation_permute_phi_operands_test.cpp
+          transformation_propagate_instruction_up_test.cpp
           transformation_push_id_through_variable_test.cpp
           transformation_replace_add_sub_mul_with_carrying_extended_test.cpp
           transformation_replace_boolean_constant_with_constant_binary_test.cpp

test/fuzz/transformation_propagate_instruction_up_test.cpp

@@ -0,0 +1,820 @@
+// Copyright (c) 2020 Vasyl Teliman
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "source/fuzz/transformation_propagate_instruction_up.h"
+
+#include "test/fuzz/fuzz_test_util.h"
+
+namespace spvtools {
+namespace fuzz {
+namespace {
+
+TEST(TransformationPropagateInstructionUpTest, BasicTest) {
+  std::string shader = R"(
+               OpCapability Shader
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+          %7 = OpTypePointer Function %6
+          %9 = OpConstant %6 3.5
+         %11 = OpConstant %6 3.4000001
+         %12 = OpTypeBool
+         %17 = OpConstant %6 4
+         %20 = OpConstant %6 45
+         %27 = OpTypePointer Function %6
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+         %26 = OpVariable %27 Function
+         %13 = OpFOrdEqual %12 %9 %11
+               OpSelectionMerge %15 None
+               OpBranchConditional %13 %14 %19
+
+         %14 = OpLabel
+         %18 = OpFMod %6 %9 %17
+               OpBranch %15
+
+         %19 = OpLabel
+         %22 = OpFAdd %6 %11 %20
+               OpBranch %15
+
+         %15 = OpLabel
+         %21 = OpPhi %6 %18 %14 %22 %19
+         %23 = OpFMul %6 %21 %21
+         %24 = OpFDiv %6 %21 %23
+               OpBranch %25
+
+         %25 = OpLabel
+         %28 = OpPhi %6 %20 %15
+               OpStore %26 %28
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  const auto env = SPV_ENV_UNIVERSAL_1_3;
+  const auto consumer = nullptr;
+  const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
+  ASSERT_TRUE(IsValid(env, context.get()));
+
+  FactManager fact_manager;
+  spvtools::ValidatorOptions validator_options;
+  TransformationContext transformation_context(&fact_manager,
+                                               validator_options);
+
+  // |block_id| is invalid.
+  ASSERT_FALSE(TransformationPropagateInstructionUp(40, {{}}).IsApplicable(
+      context.get(), transformation_context));
+  ASSERT_FALSE(TransformationPropagateInstructionUp(26, {{}}).IsApplicable(
+      context.get(), transformation_context));
+
+  // |block_id| has no predecessors.
+  ASSERT_FALSE(TransformationPropagateInstructionUp(5, {{}}).IsApplicable(
+      context.get(), transformation_context));
+
+  // |block_id| has no valid instructions to propagate.
+  ASSERT_FALSE(TransformationPropagateInstructionUp(25, {{{15, 40}}})
+                   .IsApplicable(context.get(), transformation_context));
+
+  // Not all predecessors have fresh ids.
+  ASSERT_FALSE(TransformationPropagateInstructionUp(15, {{{19, 40}, {40, 41}}})
+                   .IsApplicable(context.get(), transformation_context));
+
+  // Not all ids are fresh.
+  ASSERT_FALSE(
+      TransformationPropagateInstructionUp(15, {{{19, 40}, {14, 14}, {40, 42}}})
+          .IsApplicable(context.get(), transformation_context));
+  ASSERT_FALSE(
+      TransformationPropagateInstructionUp(15, {{{19, 19}, {14, 40}, {40, 42}}})
+          .IsApplicable(context.get(), transformation_context));
+
+  // Fresh ids have duplicates.
+  ASSERT_FALSE(
+      TransformationPropagateInstructionUp(15, {{{19, 40}, {14, 40}, {19, 41}}})
+          .IsApplicable(context.get(), transformation_context));
+
+  // Valid transformations.
+  {
+    TransformationPropagateInstructionUp transformation(14, {{{5, 40}}});
+    ASSERT_TRUE(
+        transformation.IsApplicable(context.get(), transformation_context));
+    transformation.Apply(context.get(), &transformation_context);
+    ASSERT_TRUE(IsValid(env, context.get()));
+  }
+  {
+    TransformationPropagateInstructionUp transformation(19, {{{5, 41}}});
+    ASSERT_TRUE(
+        transformation.IsApplicable(context.get(), transformation_context));
+    transformation.Apply(context.get(), &transformation_context);
+    ASSERT_TRUE(IsValid(env, context.get()));
+  }
+
+  std::string after_transformation = R"(
+               OpCapability Shader
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+          %7 = OpTypePointer Function %6
+          %9 = OpConstant %6 3.5
+         %11 = OpConstant %6 3.4000001
+         %12 = OpTypeBool
+         %17 = OpConstant %6 4
+         %20 = OpConstant %6 45
+         %27 = OpTypePointer Function %6
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+         %26 = OpVariable %27 Function
+         %13 = OpFOrdEqual %12 %9 %11
+         %40 = OpFMod %6 %9 %17 ; propagated from %14
+         %41 = OpFAdd %6 %11 %20 ; propagated from %19
+               OpSelectionMerge %15 None
+               OpBranchConditional %13 %14 %19
+
+         %14 = OpLabel
+         %18 = OpPhi %6 %40 %5 ; propagated into %5
+               OpBranch %15
+
+         %19 = OpLabel
+         %22 = OpPhi %6 %41 %5 ; propagated into %5
+               OpBranch %15
+
+         %15 = OpLabel
+         %21 = OpPhi %6 %18 %14 %22 %19
+         %23 = OpFMul %6 %21 %21
+         %24 = OpFDiv %6 %21 %23
+               OpBranch %25
+
+         %25 = OpLabel
+         %28 = OpPhi %6 %20 %15
+               OpStore %26 %28
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
+
+  {
+    TransformationPropagateInstructionUp transformation(15,
+                                                        {{{14, 43}, {19, 44}}});
+    ASSERT_TRUE(
+        transformation.IsApplicable(context.get(), transformation_context));
+    transformation.Apply(context.get(), &transformation_context);
+    ASSERT_TRUE(IsValid(env, context.get()));
+  }
+
+  after_transformation = R"(
+               OpCapability Shader
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+          %7 = OpTypePointer Function %6
+          %9 = OpConstant %6 3.5
+         %11 = OpConstant %6 3.4000001
+         %12 = OpTypeBool
+         %17 = OpConstant %6 4
+         %20 = OpConstant %6 45
+         %27 = OpTypePointer Function %6
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+         %26 = OpVariable %27 Function
+         %13 = OpFOrdEqual %12 %9 %11
+         %40 = OpFMod %6 %9 %17
+         %41 = OpFAdd %6 %11 %20
+               OpSelectionMerge %15 None
+               OpBranchConditional %13 %14 %19
+
+         %14 = OpLabel
+         %18 = OpPhi %6 %40 %5
+         %43 = OpFMul %6 %18 %18 ; propagated from %15
+               OpBranch %15
+
+         %19 = OpLabel
+         %22 = OpPhi %6 %41 %5
+         %44 = OpFMul %6 %22 %22 ; propagated from %15
+               OpBranch %15
+
+         %15 = OpLabel
+         %23 = OpPhi %6 %43 %14 %44 %19 ; propagated into %14 and %19
+         %21 = OpPhi %6 %18 %14 %22 %19
+         %24 = OpFDiv %6 %21 %23
+               OpBranch %25
+
+         %25 = OpLabel
+         %28 = OpPhi %6 %20 %15
+               OpStore %26 %28
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
+
+  {
+    TransformationPropagateInstructionUp transformation(15,
+                                                        {{{14, 45}, {19, 46}}});
+    ASSERT_TRUE(
+        transformation.IsApplicable(context.get(), transformation_context));
+    transformation.Apply(context.get(), &transformation_context);
+    ASSERT_TRUE(IsValid(env, context.get()));
+  }
+
+  after_transformation = R"(
+               OpCapability Shader
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+          %7 = OpTypePointer Function %6
+          %9 = OpConstant %6 3.5
+         %11 = OpConstant %6 3.4000001
+         %12 = OpTypeBool
+         %17 = OpConstant %6 4
+         %20 = OpConstant %6 45
+         %27 = OpTypePointer Function %6
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+         %26 = OpVariable %27 Function
+         %13 = OpFOrdEqual %12 %9 %11
+         %40 = OpFMod %6 %9 %17
+         %41 = OpFAdd %6 %11 %20
+               OpSelectionMerge %15 None
+               OpBranchConditional %13 %14 %19
+
+         %14 = OpLabel
+         %18 = OpPhi %6 %40 %5
+         %43 = OpFMul %6 %18 %18
+         %45 = OpFDiv %6 %18 %43 ; propagated from %15
+               OpBranch %15
+
+         %19 = OpLabel
+         %22 = OpPhi %6 %41 %5
+         %44 = OpFMul %6 %22 %22
+         %46 = OpFDiv %6 %22 %44 ; propagated from %15
+               OpBranch %15
+
+         %15 = OpLabel
+         %24 = OpPhi %6 %45 %14 %46 %19 ; propagated into %14 and %19
+         %23 = OpPhi %6 %43 %14 %44 %19
+         %21 = OpPhi %6 %18 %14 %22 %19
+               OpBranch %25
+
+         %25 = OpLabel
+         %28 = OpPhi %6 %20 %15
+               OpStore %26 %28
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
+}
+
+TEST(TransformationPropagateInstructionUpTest, BlockDominatesPredecessor1) {
+  std::string shader = R"(
+               OpCapability Shader
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+          %7 = OpTypePointer Function %6
+          %9 = OpConstant %6 3.5
+         %11 = OpConstant %6 3.4000001
+         %12 = OpTypeBool
+         %17 = OpConstant %6 4
+         %20 = OpConstant %6 45
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+         %13 = OpFOrdEqual %12 %9 %11
+               OpSelectionMerge %15 None
+               OpBranchConditional %13 %14 %19
+
+         %14 = OpLabel
+         %18 = OpFMod %6 %9 %17
+               OpBranch %15
+
+         %19 = OpLabel
+         %22 = OpFAdd %6 %11 %20
+               OpBranch %15
+
+         %15 = OpLabel ; dominates %26
+         %21 = OpPhi %6 %18 %14 %22 %19 %28 %26
+         %23 = OpFMul %6 %21 %21
+         %24 = OpFDiv %6 %21 %23
+               OpLoopMerge %27 %26 None
+               OpBranch %26
+
+         %26 = OpLabel
+         %28 = OpFAdd %6 %24 %23
+               OpBranch %15
+
+         %27 = OpLabel
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  const auto env = SPV_ENV_UNIVERSAL_1_3;
+  const auto consumer = nullptr;
+  const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
+  ASSERT_TRUE(IsValid(env, context.get()));
+
+  FactManager fact_manager;
+  spvtools::ValidatorOptions validator_options;
+  TransformationContext transformation_context(&fact_manager,
+                                               validator_options);
+
+  TransformationPropagateInstructionUp transformation(
+      15, {{{14, 40}, {19, 41}, {26, 42}}});
+  ASSERT_TRUE(
+      transformation.IsApplicable(context.get(), transformation_context));
+  transformation.Apply(context.get(), &transformation_context);
+  ASSERT_TRUE(IsValid(env, context.get()));
+
+  std::string after_transformation = R"(
+               OpCapability Shader
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+          %7 = OpTypePointer Function %6
+          %9 = OpConstant %6 3.5
+         %11 = OpConstant %6 3.4000001
+         %12 = OpTypeBool
+         %17 = OpConstant %6 4
+         %20 = OpConstant %6 45
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+         %13 = OpFOrdEqual %12 %9 %11
+               OpSelectionMerge %15 None
+               OpBranchConditional %13 %14 %19
+
+         %14 = OpLabel
+         %18 = OpFMod %6 %9 %17
+         %40 = OpFMul %6 %18 %18 ; propagated from %15
+               OpBranch %15
+
+         %19 = OpLabel
+         %22 = OpFAdd %6 %11 %20
+         %41 = OpFMul %6 %22 %22 ; propagated from %15
+               OpBranch %15
+
+         %15 = OpLabel
+         %23 = OpPhi %6 %40 %14 %41 %19 %42 %26 ; propagated into %14, %19, %26
+         %21 = OpPhi %6 %18 %14 %22 %19 %28 %26
+         %24 = OpFDiv %6 %21 %23
+               OpLoopMerge %27 %26 None
+               OpBranch %26
+
+         %26 = OpLabel
+         %28 = OpFAdd %6 %24 %23
+         %42 = OpFMul %6 %28 %28 ; propagated from %15
+               OpBranch %15
+
+         %27 = OpLabel
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
+}
+
+TEST(TransformationPropagateInstructionUpTest, BlockDominatesPredecessor2) {
+  std::string shader = R"(
+               OpCapability Shader
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+          %7 = OpTypePointer Function %6
+          %9 = OpConstant %6 3.5
+         %11 = OpConstant %6 3.4000001
+         %12 = OpTypeBool
+         %17 = OpConstant %6 4
+         %20 = OpConstant %6 45
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+         %13 = OpFOrdEqual %12 %9 %11
+               OpSelectionMerge %15 None
+               OpBranchConditional %13 %14 %19
+
+         %14 = OpLabel
+         %18 = OpFMod %6 %9 %17
+               OpBranch %15
+
+         %19 = OpLabel
+         %22 = OpFAdd %6 %11 %20
+               OpBranch %15
+
+         %15 = OpLabel ; doesn't dominate %26
+         %21 = OpPhi %6 %18 %14 %22 %19 %20 %26
+         %23 = OpFMul %6 %21 %21
+         %24 = OpFDiv %6 %21 %23
+               OpLoopMerge %27 %26 None
+               OpBranch %27
+
+         %26 = OpLabel
+               OpBranch %15
+
+         %27 = OpLabel
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  const auto env = SPV_ENV_UNIVERSAL_1_3;
+  const auto consumer = nullptr;
+  const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
+  ASSERT_TRUE(IsValid(env, context.get()));
+
+  FactManager fact_manager;
+  spvtools::ValidatorOptions validator_options;
+  TransformationContext transformation_context(&fact_manager,
+                                               validator_options);
+
+  TransformationPropagateInstructionUp transformation(
+      15, {{{14, 40}, {19, 41}, {26, 42}}});
+  ASSERT_TRUE(
+      transformation.IsApplicable(context.get(), transformation_context));
+  transformation.Apply(context.get(), &transformation_context);
+  ASSERT_TRUE(IsValid(env, context.get()));
+
+  std::string after_transformation = R"(
+               OpCapability Shader
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+          %7 = OpTypePointer Function %6
+          %9 = OpConstant %6 3.5
+         %11 = OpConstant %6 3.4000001
+         %12 = OpTypeBool
+         %17 = OpConstant %6 4
+         %20 = OpConstant %6 45
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+         %13 = OpFOrdEqual %12 %9 %11
+               OpSelectionMerge %15 None
+               OpBranchConditional %13 %14 %19
+
+         %14 = OpLabel
+         %18 = OpFMod %6 %9 %17
+         %40 = OpFMul %6 %18 %18 ; propagated from %15
+               OpBranch %15
+
+         %19 = OpLabel
+         %22 = OpFAdd %6 %11 %20
+         %41 = OpFMul %6 %22 %22 ; propagated from %15
+               OpBranch %15
+
+         %15 = OpLabel
+         %23 = OpPhi %6 %40 %14 %41 %19 %42 %26 ; propagated into %14, %19, %26
+         %21 = OpPhi %6 %18 %14 %22 %19 %20 %26
+         %24 = OpFDiv %6 %21 %23
+               OpLoopMerge %27 %26 None
+               OpBranch %27
+
+         %26 = OpLabel
+         %42 = OpFMul %6 %20 %20 ; propagated from %15
+               OpBranch %15
+
+         %27 = OpLabel
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
+}
+
+TEST(TransformationPropagateInstructionUpTest, BlockDominatesPredecessor3) {
+  std::string shader = R"(
+               OpCapability Shader
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+          %7 = OpTypePointer Function %6
+          %9 = OpConstant %6 3.5
+         %11 = OpConstant %6 3.4000001
+         %12 = OpTypeBool
+         %17 = OpConstant %6 4
+         %20 = OpConstant %6 45
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+         %13 = OpFOrdEqual %12 %9 %11
+               OpSelectionMerge %15 None
+               OpBranchConditional %13 %14 %19
+
+         %14 = OpLabel
+         %18 = OpFMod %6 %9 %17
+               OpBranch %15
+
+         %19 = OpLabel
+         %22 = OpFAdd %6 %11 %20
+               OpBranch %15
+
+         %15 = OpLabel ; branches to itself
+         %21 = OpPhi %6 %18 %14 %22 %19 %24 %15
+         %23 = OpFMul %6 %21 %21
+         %24 = OpFDiv %6 %21 %23
+               OpLoopMerge %27 %15 None
+               OpBranch %15
+
+         %27 = OpLabel
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  const auto env = SPV_ENV_UNIVERSAL_1_3;
+  const auto consumer = nullptr;
+  const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
+  ASSERT_TRUE(IsValid(env, context.get()));
+
+  FactManager fact_manager;
+  spvtools::ValidatorOptions validator_options;
+  TransformationContext transformation_context(&fact_manager,
+                                               validator_options);
+
+  TransformationPropagateInstructionUp transformation(
+      15, {{{14, 40}, {19, 41}, {15, 42}}});
+  ASSERT_TRUE(
+      transformation.IsApplicable(context.get(), transformation_context));
+  transformation.Apply(context.get(), &transformation_context);
+  ASSERT_TRUE(IsValid(env, context.get()));
+
+  std::string after_transformation = R"(
+               OpCapability Shader
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+          %7 = OpTypePointer Function %6
+          %9 = OpConstant %6 3.5
+         %11 = OpConstant %6 3.4000001
+         %12 = OpTypeBool
+         %17 = OpConstant %6 4
+         %20 = OpConstant %6 45
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+         %13 = OpFOrdEqual %12 %9 %11
+               OpSelectionMerge %15 None
+               OpBranchConditional %13 %14 %19
+
+         %14 = OpLabel
+         %18 = OpFMod %6 %9 %17
+         %40 = OpFMul %6 %18 %18 ; propagated from %15
+               OpBranch %15
+
+         %19 = OpLabel
+         %22 = OpFAdd %6 %11 %20
+         %41 = OpFMul %6 %22 %22 ; propagated from %15
+               OpBranch %15
+
+         %15 = OpLabel
+         %23 = OpPhi %6 %40 %14 %41 %19 %42 %15 ; propagated into %14, %19, %15
+         %21 = OpPhi %6 %18 %14 %22 %19 %24 %15
+         %24 = OpFDiv %6 %21 %23
+         %42 = OpFMul %6 %24 %24 ; propagated from %15
+               OpLoopMerge %27 %15 None
+               OpBranch %15
+
+         %27 = OpLabel
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
+}
+
+TEST(TransformationPropagateInstructionUpTest,
+     HandlesVariablePointersCapability) {
+  std::string shader = R"(
+               OpCapability Shader
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+         %11 = OpConstant %6 23
+          %7 = OpTypePointer Function %6
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+          %8 = OpVariable %7 Function
+               OpBranch %9
+
+          %9 = OpLabel
+         %10 = OpCopyObject %7 %8
+               OpStore %10 %11
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  const auto env = SPV_ENV_UNIVERSAL_1_3;
+  const auto consumer = nullptr;
+  const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
+  ASSERT_TRUE(IsValid(env, context.get()));
+
+  FactManager fact_manager;
+  spvtools::ValidatorOptions validator_options;
+  TransformationContext transformation_context(&fact_manager,
+                                               validator_options);
+
+  // Required capabilities haven't yet been specified.
+  TransformationPropagateInstructionUp transformation(9, {{{5, 40}}});
+  ASSERT_FALSE(
+      transformation.IsApplicable(context.get(), transformation_context));
+
+  context->AddCapability(SpvCapabilityVariablePointers);
+
+  ASSERT_TRUE(
+      transformation.IsApplicable(context.get(), transformation_context));
+  transformation.Apply(context.get(), &transformation_context);
+  ASSERT_TRUE(IsValid(env, context.get()));
+
+  std::string after_transformation = R"(
+               OpCapability Shader
+               OpCapability VariablePointers
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+         %11 = OpConstant %6 23
+          %7 = OpTypePointer Function %6
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+          %8 = OpVariable %7 Function
+         %40 = OpCopyObject %7 %8 ; propagated from %9
+               OpBranch %9
+
+          %9 = OpLabel
+         %10 = OpPhi %7 %40 %5 ; propagated into %5
+               OpStore %10 %11
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
+}
+
+TEST(TransformationPropagateInstructionUpTest,
+     HandlesVariablePointersStorageBufferCapability) {
+  std::string shader = R"(
+               OpCapability Shader
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+         %11 = OpConstant %6 23
+          %7 = OpTypePointer Function %6
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+          %8 = OpVariable %7 Function
+               OpBranch %9
+
+          %9 = OpLabel
+         %10 = OpCopyObject %7 %8
+               OpStore %10 %11
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  const auto env = SPV_ENV_UNIVERSAL_1_3;
+  const auto consumer = nullptr;
+  const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
+  ASSERT_TRUE(IsValid(env, context.get()));
+
+  FactManager fact_manager;
+  spvtools::ValidatorOptions validator_options;
+  TransformationContext transformation_context(&fact_manager,
+                                               validator_options);
+
+  // Required capabilities haven't yet been specified
+  TransformationPropagateInstructionUp transformation(9, {{{5, 40}}});
+  ASSERT_FALSE(
+      transformation.IsApplicable(context.get(), transformation_context));
+
+  context->AddCapability(SpvCapabilityVariablePointersStorageBuffer);
+
+  ASSERT_TRUE(
+      transformation.IsApplicable(context.get(), transformation_context));
+  transformation.Apply(context.get(), &transformation_context);
+  ASSERT_TRUE(IsValid(env, context.get()));
+
+  std::string after_transformation = R"(
+               OpCapability Shader
+               OpCapability VariablePointersStorageBuffer
+          %1 = OpExtInstImport "GLSL.std.450"
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpSource ESSL 310
+          %2 = OpTypeVoid
+          %3 = OpTypeFunction %2
+          %6 = OpTypeFloat 32
+         %11 = OpConstant %6 23
+          %7 = OpTypePointer Function %6
+          %4 = OpFunction %2 None %3
+
+          %5 = OpLabel
+          %8 = OpVariable %7 Function
+         %40 = OpCopyObject %7 %8 ; propagated from %9
+               OpBranch %9
+
+          %9 = OpLabel
+         %10 = OpPhi %7 %40 %5 ; propagated into %5
+               OpStore %10 %11
+               OpReturn
+
+               OpFunctionEnd
+  )";
+
+  ASSERT_TRUE(IsEqual(env, after_transformation, context.get()));
+}
+
+}  // namespace
+}  // namespace fuzz
+}  // namespace spvtools