From da5828c06b4c7cbe428283a1516a4fb73d5836be Mon Sep 17 00:00:00 2001
From: Ryan Harrison <rharrison@chromium.org>
Date: Wed, 30 Sep 2020 17:50:14 +0000
Subject: [PATCH] Add Tint SPIRV->SPIRV to fuzzing code path

Since we are intending to ship using Tint for normalization, fuzzing
should include this transform.

BUG=dawn:531

Change-Id: Ica25c3bbdc6ff392d5e31361734de43fd1c12815
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/29180
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
---
 build_overrides/tint.gni             |  3 +-
 src/fuzzers/DawnSPIRVCrossFuzzer.cpp | 42 ++++++++++++++++++++++++----
 2 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/build_overrides/tint.gni b/build_overrides/tint.gni
index 352d4b2f70..9fe29de794 100644
--- a/build_overrides/tint.gni
+++ b/build_overrides/tint.gni
@@ -17,8 +17,7 @@ tint_spirv_tools_dir = "//third_party/SPIRV-Tools"
 tint_googletest_dir = "//third_party/googletest"
 tint_spirv_headers_dir = "//third_party/spirv-headers"
 
-# Only need the WGSL->SPIR-V transformation
-tint_build_spv_reader = false
+tint_build_spv_reader = true
 tint_build_spv_writer = true
 tint_build_wgsl_reader = true
 tint_build_wgsl_writer = false
diff --git a/src/fuzzers/DawnSPIRVCrossFuzzer.cpp b/src/fuzzers/DawnSPIRVCrossFuzzer.cpp
index 8ad57114e7..90c4b2b476 100644
--- a/src/fuzzers/DawnSPIRVCrossFuzzer.cpp
+++ b/src/fuzzers/DawnSPIRVCrossFuzzer.cpp
@@ -20,6 +20,9 @@
 #include <vector>
 
 #include <spirv-tools/libspirv.hpp>
+#ifdef DAWN_ENABLE_WGSL
+#    include <tint/tint.h>
+#endif  // DAWN_ENABLE_WGSL
 
 #include "DawnSPIRVCrossFuzzer.h"
 
@@ -31,7 +34,7 @@ namespace {
     // Handler to trap signals, so that it doesn't crash the fuzzer when running
     // the code under test. The code being fuzzed uses abort() to report errors
     // like bad input instead of returning an error code.
-    [[noreturn]] static void sigabrt_trap(int sig) {
+    [[noreturn]] static void sigabrt_trap(int) {
         std::longjmp(jump_buffer, 1);
     }
 
@@ -68,18 +71,47 @@ namespace DawnSPIRVCrossFuzzer {
         const uint32_t* u32Data = reinterpret_cast<const uint32_t*>(data);
         std::vector<uint32_t> input(u32Data, u32Data + sizeInU32);
 
+        // Using Tint SPIRV->SPIRV to normalize inputs if supported.
+#ifdef DAWN_ENABLE_WGSL
+        tint::Context context;
+        tint::reader::spirv::Parser parser(&context, input);
+
+        if (!parser.Parse()) {
+            return 0;
+        }
+
+        tint::ast::Module module = parser.module();
+        if (!module.IsValid()) {
+            return 0;
+        }
+
+        tint::TypeDeterminer type_determiner(&context, &module);
+        if (!type_determiner.Determine()) {
+            return 0;
+        }
+
+        tint::writer::spirv::Generator generator(std::move(module));
+        if (!generator.Generate()) {
+            return 0;
+        }
+
+        std::vector<uint32_t> spirv = generator.result();
+#else
+        std::vector<uint32_t> spirv = std::move(input);
+#endif
+
         spvtools::SpirvTools spirvTools(SPV_ENV_VULKAN_1_1);
         spirvTools.SetMessageConsumer(
             [](spv_message_level_t, const char*, const spv_position_t&, const char*) {});
 
-        // Dawn is responsible to validating input before it goes into
+        // Dawn is responsible to validating inputs before they go to
         // SPIRV-Cross.
-        if (!spirvTools.Validate(input.data(), input.size())) {
+        if (!spirvTools.Validate(spirv.data(), spirv.size())) {
             return 0;
         }
 
-        if (input.size() != 0) {
-            task(input);
+        if (spirv.size() != 0) {
+            task(spirv);
         }
 
         return 0;