These fuzzers currently depend on being able to change the signal
handler at runtime, but the default flags being used forbid this. This
CL overrides the upstream default to allow changing the handler.
BUG=chromium:904725,chromium:904712
Change-Id: I68423564981b7f2e39f7c00744b92da982cf19e9
Reviewed-on: https://dawn-review.googlesource.com/c/2361
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
This will avoid compilation to break, and adds standalone reproducers
for the fuzzer_tests.
BUG=chromium:903380
BUG=dawn:34
Change-Id: I9995a852076d9f6d1ebdee5b999989c2d74d4709
Reviewed-on: https://dawn-review.googlesource.com/c/2321
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Dan Sinclair <dsinclair@google.com>
This CL adds in fuzzers for SPIRV-Cross for HLSL, GLSL, and MSL
outputs. These fuzzers live in Dawn because there is not appropriate
location in the Chromium source repo for them and it is unlikely they
would be land-able in the SPIRV-Cross repo, because it is not coupled
with Chromium's build system and thus Clusterfuzz so would be
effectively dead code. Dawn depends on this code, but it is also
integrated into the Chromium build system, so this was the best place
I could find for them
The code under fuzz unfortunately uses exceptions/aborting as its
error reporting mechanism. This is an acknowledge short coming and
there are efforts to remove this behaviour. To work around this and
reduce the number of false positives found by the fuzzers, a signal
trap has been implemented which will be removed once the code under
fuzz has been updated.
The trap replaces the existing signal handler and silencing signals
while running the code under test. This allows the code under test to
call abort() and not crash the fuzzing process. Theoretically, only
SIGABRT should need to be trapped, but something is causing the signal
from abort() to be converted to SIGSEGV when running under ASAN.
This signal trap has been tested with the fuzzing/sanitizers by
intentionally inserting bad calls that will occur after a few thousand
test cases. It was confirmed that the fuzzer detected the issue and
stops fuzzing.
The alternate to implementing this signal trap would be to turn on
exceptions for the fuzzer. This was attempted, but proved to be
fruitless due to what was reported as an ODR issue, but couldn't
couldn't be silenced. The likely underlying issue was a pre-built
library or other object being built without exceptions was causing
different versions of symbols or the exception version of the standard
library not being instrumented by ASAN. Given the majority of Chromium
eco-system turns off exceptions, fixing this issue would not be
helpful to the larger community and was looking like it would require
significant effort.
BUG=chromium:903380
Change-Id: I63a5595383f99b7a0e150d72bb04c89b8d722631
Reviewed-on: https://dawn-review.googlesource.com/c/2260
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Ryan Harrison
Corentin Wallez