85 lines
3.6 KiB
C++
85 lines
3.6 KiB
C++
|
// Copyright 2021 The Tint Authors.
|
||
|
|
//
|
||
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||
|
|
// you may not use this file except in compliance with the License.
|
||
|
|
// You may obtain a copy of the License at
|
||
|
|
//
|
||
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||
|
|
//
|
||
|
|
// Unless required by applicable law or agreed to in writing, software
|
||
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
|
|
// See the License for the specific language governing permissions and
|
||
|
|
// limitations under the License.
|
||
|
|
|
||
|
|
#include <memory>
|
||
|
|
#include <string>
|
||
|
|
|
||
|
|
#include "fuzzers/tint_spirv_tools_fuzzer/cli.h"
|
||
|
|
#include "fuzzers/tint_spirv_tools_fuzzer/mutator.h"
|
||
|
|
#include "fuzzers/tint_spirv_tools_fuzzer/spirv_fuzz_mutator.h"
|
||
|
|
#include "fuzzers/tint_spirv_tools_fuzzer/spirv_opt_mutator.h"
|
||
|
|
#include "fuzzers/tint_spirv_tools_fuzzer/spirv_reduce_mutator.h"
|
||
|
|
#include "fuzzers/tint_spirv_tools_fuzzer/util.h"
|
||
|
|
|
||
|
|
/// This tool is used to debug *mutators*. It uses CLI arguments similar to the
|
||
|
|
/// ones used by the fuzzer. To debug some mutator you just need to specify the
|
||
|
|
/// mutator type, the seed and the path to the SPIR-V binary that triggered the
|
||
|
|
/// error. This tool will run the mutator on the binary until the error is
|
||
|
|
/// produced or the mutator returns `kLimitReached`.
|
||
|
|
///
|
||
|
|
/// Note that this is different from debugging the fuzzer by specifying input
|
||
|
|
/// files to test. The difference is that the latter will not execute any
|
||
|
|
/// mutator (it will only run the LLVMFuzzerTestOneInput function) whereas this
|
||
|
|
/// tool is useful when one of the spirv-tools mutators crashes or produces an
|
||
|
|
/// invalid binary in LLVMFuzzerCustomMutator.
|
||
|
|
int main(int argc, const char** argv) {
|
||
|
|
auto params =
|
||
|
|
tint::fuzzers::spvtools_fuzzer::ParseMutatorDebuggerCliParams(argc, argv);
|
||
|
|
|
||
|
|
std::unique_ptr<tint::fuzzers::spvtools_fuzzer::Mutator> mutator;
|
||
|
|
const auto& mutator_params = params.mutator_params;
|
||
|
|
switch (params.mutator_type) {
|
||
|
|
case tint::fuzzers::spvtools_fuzzer::MutatorType::kFuzz:
|
||
|
|
mutator =
|
||
|
|
std::make_unique<tint::fuzzers::spvtools_fuzzer::SpirvFuzzMutator>(
|
||
|
|
mutator_params.target_env, params.original_binary, params.seed,
|
||
|
|
mutator_params.donors, mutator_params.enable_all_fuzzer_passes,
|
||
|
|
mutator_params.repeated_pass_strategy,
|
||
|
|
mutator_params.validate_after_each_fuzzer_pass,
|
||
|
|
mutator_params.transformation_batch_size);
|
||
|
|
break;
|
||
|
|
case tint::fuzzers::spvtools_fuzzer::MutatorType::kReduce:
|
||
|
|
mutator =
|
||
|
|
std::make_unique<tint::fuzzers::spvtools_fuzzer::SpirvReduceMutator>(
|
||
|
|
mutator_params.target_env, params.original_binary, params.seed,
|
||
|
|
mutator_params.reduction_batch_size,
|
||
|
|
mutator_params.enable_all_reduce_passes,
|
||
|
|
mutator_params.validate_after_each_reduce_pass);
|
||
|
|
break;
|
||
|
|
case tint::fuzzers::spvtools_fuzzer::MutatorType::kOpt:
|
||
|
|
mutator =
|
||
|
|
std::make_unique<tint::fuzzers::spvtools_fuzzer::SpirvOptMutator>(
|
||
|
|
mutator_params.target_env, params.seed, params.original_binary,
|
||
|
|
mutator_params.validate_after_each_opt_pass,
|
||
|
|
mutator_params.opt_batch_size);
|
||
|
|
break;
|
||
|
|
default:
|
||
|
|
assert(false && "All mutator types must've been handled");
|
||
|
|
return 1;
|
||
|
|
}
|
||
|
|
|
||
|
|
while (true) {
|
||
|
|
auto result = mutator->Mutate();
|
||
|
|
if (result.GetStatus() ==
|
||
|
|
tint::fuzzers::spvtools_fuzzer::Mutator::Status::kInvalid) {
|
||
|
|
std::cerr << mutator->GetErrors() << std::endl;
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
if (result.GetStatus() ==
|
||
|
|
tint::fuzzers::spvtools_fuzzer::Mutator::Status::kLimitReached) {
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|