encounter
/
dawn-cmake
mirror of https://github.com/encounter/dawn-cmake.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
dawn-cmake/fuzzers/tint_common_fuzzer.cc

336 lines
11 KiB
C++
Raw Blame History

// Copyright 2021 The Tint Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#include "fuzzers/tint_common_fuzzer.h"
#include <cassert>
#include <cstring>
#include <fstream>
#include <memory>
#include <sstream>
#include <string>
#include <utility>
#include <vector>
#if TINT_BUILD_SPV_READER
#include "spirv-tools/libspirv.hpp"
#endif // TINT_BUILD_SPV_READER
#include "src/ast/module.h"
#include "src/diagnostic/formatter.h"
#include "src/program.h"
#include "src/utils/hash.h"
namespace tint {
namespace fuzzers {
namespace {
// A macro is used to avoid FATAL_ERROR creating its own stack frame. This leads
// to better de-duplication of bug reports, because ClusterFuzz only uses the
// top few stack frames for de-duplication, and a FATAL_ERROR stack frame
// provides no useful information.
#define FATAL_ERROR(diags, msg_string) \
do { \
std::string msg = msg_string; \
auto printer = tint::diag::Printer::create(stderr, true); \
if (!msg.empty()) { \
printer->write(msg + "\n", {diag::Color::kRed, true}); \
} \
tint::diag::Formatter().format(diags, printer.get()); \
__builtin_trap(); \
} while (false)
[[noreturn]] void TintInternalCompilerErrorReporter(
const tint::diag::List& diagnostics) {
FATAL_ERROR(diagnostics, "");
}
// Wrapping this in a macro so it can be a one-liner in the code, but not
// introducing another level in the stack trace. This will help with de-duping
// ClusterFuzz issues.
#define CHECK_INSPECTOR(inspector) \
do { \
if (inspector.has_error()) { \
FATAL_ERROR(program->Diagnostics(), \
"Inspector failed: " + inspector.error()); \
} \
} while (false)
bool SPIRVToolsValidationCheck(const tint::Program& program,
const std::vector<uint32_t>& spirv) {
spvtools::SpirvTools tools(SPV_ENV_VULKAN_1_1);
const tint::diag::List& diags = program.Diagnostics();
tools.SetMessageConsumer([diags](spv_message_level_t, const char*,
const spv_position_t& pos, const char* msg) {
std::stringstream out;
out << "Unexpected spirv-val error:\n"
<< (pos.line + 1) << ":" << (pos.column + 1) << ": " << msg
<< std::endl;
auto printer = tint::diag::Printer::create(stderr, true);
printer->write(out.str(), {diag::Color::kYellow, false});
tint::diag::Formatter().format(diags, printer.get());
});
return tools.Validate(spirv.data(), spirv.size(),
spvtools::ValidatorOptions());
}
} // namespace
void GenerateSpirvOptions(DataBuilder* b, writer::spirv::Options* options) {
*options = b->build<writer::spirv::Options>();
}
void GenerateWgslOptions(DataBuilder* b, writer::wgsl::Options* options) {
*options = b->build<writer::wgsl::Options>();
}
void GenerateHlslOptions(DataBuilder* b, writer::hlsl::Options* options) {
*options = b->build<writer::hlsl::Options>();
}
void GenerateMslOptions(DataBuilder* b, writer::msl::Options* options) {
*options = b->build<writer::msl::Options>();
}
CommonFuzzer::CommonFuzzer(InputFormat input, OutputFormat output)
: input_(input), output_(output) {}
CommonFuzzer::~CommonFuzzer() = default;
int CommonFuzzer::Run(const uint8_t* data, size_t size) {
tint::SetInternalCompilerErrorReporter(&TintInternalCompilerErrorReporter);
#if TINT_BUILD_WGSL_WRITER
tint::Program::printer = [](const tint::Program* program) {
auto result = tint::writer::wgsl::Generate(program, {});
if (!result.error.empty()) {
return "error: " + result.error;
}
return result.wgsl;
};
#endif // TINT_BUILD_WGSL_WRITER
Program program;
#if TINT_BUILD_SPV_READER
std::vector<uint32_t> spirv_input(size / sizeof(uint32_t));
#endif // TINT_BUILD_SPV_READER
#if TINT_BUILD_WGSL_READER || TINT_BUILD_SPV_READER
auto dump_input_data = [&](auto& content, const char* extension) {
size_t hash = utils::Hash(content);
auto filename = "fuzzer_input_" + std::to_string(hash) + extension; //
std::ofstream fout(filename, std::ios::binary);
fout.write(reinterpret_cast<const char*>(data),
static_cast<std::streamsize>(size));
std::cout << "Dumped input data to " << filename << std::endl;
};
#endif
switch (input_) {
#if TINT_BUILD_WGSL_READER
case InputFormat::kWGSL: {
// Clear any existing diagnostics, as these will hold pointers to file_,
// which we are about to release.
diagnostics_ = {};
std::string str(reinterpret_cast<const char*>(data), size);
file_ = std::make_unique<Source::File>("test.wgsl", str);
if (dump_input_) {
dump_input_data(str, ".wgsl");
}
program = reader::wgsl::Parse(file_.get());
break;
}
#endif // TINT_BUILD_WGSL_READER
#if TINT_BUILD_SPV_READER
case InputFormat::kSpv: {
// `spirv_input` has been initialized with the capacity to store `size /
// sizeof(uint32_t)` uint32_t values. If `size` is not a multiple of
// sizeof(uint32_t) then not all of `data` can be copied into
// `spirv_input`, and any trailing bytes are discarded.
std::memcpy(spirv_input.data(), data,
spirv_input.size() * sizeof(uint32_t));
if (spirv_input.empty()) {
return 0;
}
if (dump_input_) {
dump_input_data(spirv_input, ".spv");
}
program = reader::spirv::Parse(spirv_input);
break;
}
#endif // TINT_BUILD_SPV_READER
}
if (!program.IsValid()) {
diagnostics_ = program.Diagnostics();
return 0;
}
#if TINT_BUILD_SPV_READER
if (input_ == InputFormat::kSpv &&
!SPIRVToolsValidationCheck(program, spirv_input)) {
FATAL_ERROR(
program.Diagnostics(),
"Fuzzing detected invalid input spirv not being caught by Tint");
}
#endif // TINT_BUILD_SPV_READER
RunInspector(&program);
if (transform_manager_) {
auto out = transform_manager_->Run(&program, *transform_inputs_);
if (!out.program.IsValid()) {
// Transforms can produce error messages for bad input.
// Catch ICEs and errors from non transform systems.
for (const auto& diag : out.program.Diagnostics()) {
if (diag.severity > diag::Severity::Error ||
diag.system != diag::System::Transform) {
FATAL_ERROR(out.program.Diagnostics(),
"Fuzzing detected valid input program being transformed "
"into an invalid output program");
}
}
}
program = std::move(out.program);
RunInspector(&program);
}
switch (output_) {
case OutputFormat::kWGSL: {
#if TINT_BUILD_WGSL_WRITER
auto result = writer::wgsl::Generate(&program, options_wgsl_);
generated_wgsl_ = std::move(result.wgsl);
if (!result.success) {
FATAL_ERROR(program.Diagnostics(),
"WGSL writer errored on validated input:\n" + result.error);
}
#endif // TINT_BUILD_WGSL_WRITER
break;
}
case OutputFormat::kSpv: {
#if TINT_BUILD_SPV_WRITER
auto result = writer::spirv::Generate(&program, options_spirv_);
generated_spirv_ = std::move(result.spirv);
if (!result.success) {
FATAL_ERROR(
program.Diagnostics(),
"SPIR-V writer errored on validated input:\n" + result.error);
}
if (!SPIRVToolsValidationCheck(program, generated_spirv_)) {
FATAL_ERROR(program.Diagnostics(),
"Fuzzing detected invalid spirv being emitted by Tint");
}
#endif // TINT_BUILD_SPV_WRITER
break;
}
case OutputFormat::kHLSL: {
#if TINT_BUILD_HLSL_WRITER
auto result = writer::hlsl::Generate(&program, options_hlsl_);
generated_hlsl_ = std::move(result.hlsl);
if (!result.success) {
FATAL_ERROR(program.Diagnostics(),
"HLSL writer errored on validated input:\n" + result.error);
}
#endif // TINT_BUILD_HLSL_WRITER
break;
}
case OutputFormat::kMSL: {
#if TINT_BUILD_MSL_WRITER
auto result = writer::msl::Generate(&program, options_msl_);
generated_msl_ = std::move(result.msl);
if (!result.success) {
FATAL_ERROR(program.Diagnostics(),
"MSL writer errored on validated input:\n" + result.error);
}
#endif // TINT_BUILD_MSL_WRITER
break;
}
}
return 0;
}
void CommonFuzzer::RunInspector(Program* program) {
inspector::Inspector inspector(program);
auto entry_points = inspector.GetEntryPoints();
CHECK_INSPECTOR(inspector);
auto constant_ids = inspector.GetConstantIDs();
CHECK_INSPECTOR(inspector);
auto constant_name_to_id = inspector.GetConstantNameToIdMap();
CHECK_INSPECTOR(inspector);
for (auto& ep : entry_points) {
inspector.GetRemappedNameForEntryPoint(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetStorageSize(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetResourceBindings(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetUniformBufferResourceBindings(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetStorageBufferResourceBindings(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetReadOnlyStorageBufferResourceBindings(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetSamplerResourceBindings(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetComparisonSamplerResourceBindings(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetSampledTextureResourceBindings(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetMultisampledTextureResourceBindings(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetWriteOnlyStorageTextureResourceBindings(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetDepthTextureResourceBindings(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetDepthMultisampledTextureResourceBindings(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetExternalTextureResourceBindings(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetSamplerTextureUses(ep.name);
CHECK_INSPECTOR(inspector);
inspector.GetWorkgroupStorageSize(ep.name);
CHECK_INSPECTOR(inspector);
}
}
} // namespace fuzzers
} // namespace tint
Reference in New Issue View Git Blame Copy Permalink