SetImplementation takes a pointer and would be shimmed by browsers so we
skip the call in the fuzzer, otherwise we'd dereference arbitrary
pointers.
BUG=chromium:906391
Change-Id: I61d8d729d3fb242e8ddf7452a88a653e05a82cc2
Reviewed-on: https://dawn-review.googlesource.com/c/2562
Reviewed-by: Dan Sinclair <dsinclair@google.com>
Reviewed-by: Kai Ninomiya <kainino@chromium.org>
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
The dawn::Device(dawnDevice) constructor was adding a reference which
caused the device to leak. Fix this by using dawn::Device::Acquire
instead.
BUG=chromium:904734
Change-Id: Id641459f9285c9da51a0d2a1f88126197bfd79a5
Reviewed-on: https://dawn-review.googlesource.com/c/2561
Reviewed-by: Dan Sinclair <dsinclair@google.com>
Reviewed-by: Kai Ninomiya <kainino@chromium.org>
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Due the jump within the signal trap used in these fuzzers, local scope
allocations cannot occur while the signal trap is on, otherwise there
is a possibility of leaks. This CL rewrites how the code under test is
run, so that the potentially aborting code is tightly wrapped by
signal trap without any local scope allocations.
BUG=chromium:906416
Change-Id: Ie52647433dcac57e3ea065d5bdcb6e14c5929494
Reviewed-on: https://dawn-review.googlesource.com/c/2521
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Otherwise UBSan complains that C++ types are different between the
shared libraries because libc++ is linked statically.
BUG=chromium:904736
Change-Id: I51ef40d1f7910fd693a4585c74ff404812472d2e
Reviewed-on: https://dawn-review.googlesource.com/c/2380
Reviewed-by: Dan Sinclair <dsinclair@google.com>
Reviewed-by: Kai Ninomiya <kainino@chromium.org>
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
These fuzzers currently depend on being able to change the signal
handler at runtime, but the default flags being used forbid this. This
CL overrides the upstream default to allow changing the handler.
BUG=chromium:904725,chromium:904712
Change-Id: I68423564981b7f2e39f7c00744b92da982cf19e9
Reviewed-on: https://dawn-review.googlesource.com/c/2361
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
This will avoid compilation to break, and adds standalone reproducers
for the fuzzer_tests.
BUG=chromium:903380
BUG=dawn:34
Change-Id: I9995a852076d9f6d1ebdee5b999989c2d74d4709
Reviewed-on: https://dawn-review.googlesource.com/c/2321
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Dan Sinclair <dsinclair@google.com>
This CL adds in fuzzers for SPIRV-Cross for HLSL, GLSL, and MSL
outputs. These fuzzers live in Dawn because there is not appropriate
location in the Chromium source repo for them and it is unlikely they
would be land-able in the SPIRV-Cross repo, because it is not coupled
with Chromium's build system and thus Clusterfuzz so would be
effectively dead code. Dawn depends on this code, but it is also
integrated into the Chromium build system, so this was the best place
I could find for them
The code under fuzz unfortunately uses exceptions/aborting as its
error reporting mechanism. This is an acknowledge short coming and
there are efforts to remove this behaviour. To work around this and
reduce the number of false positives found by the fuzzers, a signal
trap has been implemented which will be removed once the code under
fuzz has been updated.
The trap replaces the existing signal handler and silencing signals
while running the code under test. This allows the code under test to
call abort() and not crash the fuzzing process. Theoretically, only
SIGABRT should need to be trapped, but something is causing the signal
from abort() to be converted to SIGSEGV when running under ASAN.
This signal trap has been tested with the fuzzing/sanitizers by
intentionally inserting bad calls that will occur after a few thousand
test cases. It was confirmed that the fuzzer detected the issue and
stops fuzzing.
The alternate to implementing this signal trap would be to turn on
exceptions for the fuzzer. This was attempted, but proved to be
fruitless due to what was reported as an ODR issue, but couldn't
couldn't be silenced. The likely underlying issue was a pre-built
library or other object being built without exceptions was causing
different versions of symbols or the exception version of the standard
library not being instrumented by ASAN. Given the majority of Chromium
eco-system turns off exceptions, fixing this issue would not be
helpful to the larger community and was looking like it would require
significant effort.
BUG=chromium:903380
Change-Id: I63a5595383f99b7a0e150d72bb04c89b8d722631
Reviewed-on: https://dawn-review.googlesource.com/c/2260
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Corentin Wallez
Ryan Harrison