From 032ea5aa49c9018102df312e5866162328d992c2 Mon Sep 17 00:00:00 2001 From: Corentin Wallez Date: Wed, 11 Sep 2024 19:01:51 +0000 Subject: [PATCH] Remove Dawn LPM Fuzzer. It hasn't found issues in a while and requires some maintenance when compilation breaks, which we only find when rolling into Chromium. Change-Id: I7af645a8f48ff4cc923d493b5c809880cf97712f Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/206215 Reviewed-by: Brendon Tiszka Reviewed-by: Brandon Jones Commit-Queue: Corentin Wallez --- docs/dawn/codegen.md | 9 - generator/dawn_generator.gni | 22 -- generator/dawn_json_generator.py | 193 +---------- .../dawn/fuzzers/lpmfuzz/DawnLPMConstants.h | 44 --- .../fuzzers/lpmfuzz/DawnLPMSerializer.cpp | 328 ------------------ .../dawn/fuzzers/lpmfuzz/DawnLPMSerializer.h | 60 ---- .../dawn/fuzzers/lpmfuzz/dawn_lpm.proto | 205 ----------- .../lpmfuzz/dawn_object_types_lpm.proto | 35 -- src/dawn/fuzzers/BUILD.gn | 79 ----- src/dawn/fuzzers/dawn_fuzzers.gni | 65 ---- src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzer.cpp | 162 --------- src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzer.h | 48 --- .../lpmfuzz/DawnLPMFuzzerAndVulkanBackend.cpp | 46 --- .../fuzzers/lpmfuzz/DawnLPMObjectStore.cpp | 113 ------ src/dawn/fuzzers/lpmfuzz/DawnLPMObjectStore.h | 56 --- .../lpmfuzz/DawnLPMSerializerCustom.cpp | 116 ------- .../fuzzers/lpmfuzz/DawnLPMSerializerCustom.h | 44 --- .../fuzzers/lpmfuzz/dawn_custom_lpm.proto | 42 --- src/dawn/fuzzers/lpmfuzz/dawn_lpm.json | 62 ---- 19 files changed, 6 insertions(+), 1723 deletions(-) delete mode 100644 generator/templates/dawn/fuzzers/lpmfuzz/DawnLPMConstants.h delete mode 100644 generator/templates/dawn/fuzzers/lpmfuzz/DawnLPMSerializer.cpp delete mode 100644 generator/templates/dawn/fuzzers/lpmfuzz/DawnLPMSerializer.h delete mode 100644 generator/templates/dawn/fuzzers/lpmfuzz/dawn_lpm.proto delete mode 100644 generator/templates/dawn/fuzzers/lpmfuzz/dawn_object_types_lpm.proto delete mode 100644 src/dawn/fuzzers/dawn_fuzzers.gni delete mode 100644 src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzer.cpp delete mode 100644 src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzer.h delete mode 100644 src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzerAndVulkanBackend.cpp delete mode 100644 src/dawn/fuzzers/lpmfuzz/DawnLPMObjectStore.cpp delete mode 100644 src/dawn/fuzzers/lpmfuzz/DawnLPMObjectStore.h delete mode 100644 src/dawn/fuzzers/lpmfuzz/DawnLPMSerializerCustom.cpp delete mode 100644 src/dawn/fuzzers/lpmfuzz/DawnLPMSerializerCustom.h delete mode 100644 src/dawn/fuzzers/lpmfuzz/dawn_custom_lpm.proto delete mode 100644 src/dawn/fuzzers/lpmfuzz/dawn_lpm.json diff --git a/docs/dawn/codegen.md b/docs/dawn/codegen.md index d41eb9a7935..0998f2872a9 100644 --- a/docs/dawn/codegen.md +++ b/docs/dawn/codegen.md @@ -117,12 +117,3 @@ The schema of `dawn_wire.json` is a dictionary with the following keys: ## OpenGL loader generator The code to load OpenGL entrypoints from a `GetProcAddress` function is generated from [`gl.xml`](../../third_party/khronos/gl.xml) and the [list of extensions](../../src/dawn/native/opengl/supported_extensions.json) it supports. - - -## Dawn lpmfuzz generator -One of Dawn's Fuzzers utilizes the information in [`dawn.json`, `dawn_wire.json`, `dawn_lpm.json`] to generate the `.proto` and `.cpp` files required for a [libprotobuf-mutator fuzzer](https://github.com/google/libprotobuf-mutator) that fuzzes Dawn Wire Server's stack with more effectiveness in some areas than plain libfuzzer. - -At this time it is used to generate: - - - the `dawn_lpm.proto` file used to describe the grammar for the fuzzer - - the serializer `DawnLPMSerializer.cpp` that takes an arbitrary number of protobuf structures that were defined in `dawn_lpm.proto` and serializes them to be passed to `DawnWireServer::HandleCommands`. diff --git a/generator/dawn_generator.gni b/generator/dawn_generator.gni index 4a388f59b67..9d8dc9f83ce 100644 --- a/generator/dawn_generator.gni +++ b/generator/dawn_generator.gni @@ -95,25 +95,3 @@ template("dawn_json_generator") { forward_variables_from(invoker, "*", [ "target" ]) } } - -template("dawn_json_lpm_generator") { - dawn_generator(target_name) { - script = "${dawn_root}/generator/dawn_json_generator.py" - - # The base arguments for the generator: from this dawn.json, generate this - # target using templates in this directory. - args = [ - "--dawn-json", - rebase_path("${dawn_root}/src/dawn/dawn.json", root_build_dir), - "--wire-json", - rebase_path("${dawn_root}/src/dawn/dawn_wire.json", root_build_dir), - "--lpm-json", - rebase_path("${dawn_root}/src/dawn/fuzzers/lpmfuzz/dawn_lpm.json", - root_build_dir), - "--targets", - invoker.target, - ] - - forward_variables_from(invoker, "*", [ "target" ]) - } -} diff --git a/generator/dawn_json_generator.py b/generator/dawn_json_generator.py index 8ffa894ecc6..bf7bda03a0b 100644 --- a/generator/dawn_json_generator.py +++ b/generator/dawn_json_generator.py @@ -428,18 +428,6 @@ def linked_record_members(json_data, types): return members -def mark_lengths_non_serializable_lpm(record_members): - # Remove member length values from command metadata, - # these are set to the length of the protobuf array. - for record_member in record_members: - lengths = set() - for member in record_member.members: - lengths.add(member.length) - - for member in record_member.members: - if member in lengths: - member.skip_serialize = True - ############################################################ # PARSE ############################################################ @@ -708,104 +696,6 @@ def compute_wire_params(api_params, wire_json): return wire_params -############################################################ -# DAWN LPM FUZZ STUFF -############################################################ - - -def compute_lpm_params(api_and_wire_params, lpm_json): - # Start with all commands in dawn.json and dawn_wire.json - lpm_params = api_and_wire_params.copy() - - # Commands that are built through codegen - generated_commands = [] - - # All commands, including hand written commands that we can't generate - # through codegen - all_commands = [] - - # Remove blocklisted commands from protobuf generation params - blocklisted_cmds_proto = lpm_json.get('blocklisted_cmds') - custom_cmds_proto = lpm_json.get('custom_cmds') - for command in lpm_params['cmd_records']['command']: - blocklisted = command.name.get() in blocklisted_cmds_proto - custom = command.name.get() in custom_cmds_proto - - if blocklisted: - continue - - if not custom: - generated_commands.append(command) - all_commands.append(command) - - # Set all fields that are marked as the "length" of another field to - # skip_serialize. The values passed by libprotobuf-mutator will cause - # an instant crash during serialization if these don't match the length - # of the data they are passing. These values aren't used in - # deserialization. - mark_lengths_non_serializable_lpm( - api_and_wire_params['cmd_records']['command']) - mark_lengths_non_serializable_lpm( - api_and_wire_params['by_category']['structure']) - - lpm_params['cmd_records'] = { - 'proto_generated_commands': generated_commands, - 'proto_all_commands': all_commands, - 'cpp_generated_commands': generated_commands, - 'lpm_info': lpm_json.get("lpm_info") - } - - return lpm_params - - -def as_protobufTypeLPM(member): - assert 'type' in member.json_data - - if member.type.name.native: - typ = member.json_data['type'] - cpp_to_protobuf_type = { - "bool": "bool", - "float": "float", - "double": "double", - "int8_t": "int32", - "int16_t": "int32", - "int32_t": "int32", - "int64_t": "int64", - "uint8_t": "uint32", - "uint16_t": "uint32", - "uint32_t": "uint32", - "uint64_t": "uint64", - "size_t": "uint64", - } - - assert typ in cpp_to_protobuf_type - - return cpp_to_protobuf_type[typ] - - return member.type.name.CamelCase() - - -# Helper that generates names for protobuf grammars from contents -# of dawn*.json like files. example: membera -def as_protobufNameLPM(*names): - # `descriptor` is a reserved keyword in lib-protobuf-mutator - if (names[0].concatcase() == "descriptor"): - return "desc" - return as_varName(*names) - - -# Helper to generate member accesses within C++ of protobuf objects -# example: cmd.membera().memberb() -def as_protobufMemberNameLPM(*names): - # `descriptor` is a reserved keyword in lib-protobuf-mutator - if (names[0].concatcase() == "descriptor"): - return "desc" - return ''.join([name.concatcase().lower() for name in names]) - - -def unreachable_code(msg="unreachable_code"): - assert False, msg - ############################################################ # KOTLIN STUFF @@ -1122,6 +1012,10 @@ def is_wire_serializable(type): and type.name.get() != 'void *') +def unreachable_code(msg="unreachable_code"): + assert False, msg + + def make_base_render_params(metadata): c_prefix = metadata.c_prefix @@ -1180,7 +1074,7 @@ def as_cProc(type_name, method_name): 'has_callbackInfoStruct': has_callbackInfoStruct, 'find_by_name': find_by_name, 'print': print, - 'unreachable_code': unreachable_code + 'unreachable_code': unreachable_code, } @@ -1191,7 +1085,7 @@ def get_description(self): def add_commandline_arguments(self, parser): allowed_targets = [ 'dawn_headers', 'cpp_headers', 'cpp', 'proc', 'mock_api', 'wire', - 'native_utils', 'dawn_lpmfuzz_cpp', 'dawn_lpmfuzz_proto', 'kotlin' + 'native_utils', 'kotlin' ] parser.add_argument('--dawn-json', @@ -1206,10 +1100,6 @@ def add_commandline_arguments(self, parser): default=None, type=str, help='The KOTLIN JSON definition to use.') - parser.add_argument("--lpm-json", - default=None, - type=str, - help='The DAWN LPM FUZZER definitions to use.') parser.add_argument( '--targets', required=True, @@ -1234,11 +1124,6 @@ def get_outputs(self, args): with open(args.kotlin_json) as f: kotlin_json = json.loads(f.read()) - lpm_json = None - if args.lpm_json: - with open(args.lpm_json) as f: - lpm_json = json.loads(f.read()) - renders = [] imported_templates = [] @@ -1535,70 +1420,6 @@ def get_outputs(self, args): 'src/dawn/wire/server/WGPUTraits_autogen.h', wire_params)) - - if 'dawn_lpmfuzz_proto' in targets: - params_dawn_wire = parse_json( - loaded_json, - enabled_tags=['compat', 'dawn', 'deprecated'], - disabled_tags=['native']) - api_and_wire_params = compute_wire_params(params_dawn_wire, - wire_json) - - fuzzer_params = compute_lpm_params(api_and_wire_params, lpm_json) - - lpm_params = [ - RENDER_PARAMS_BASE, params_dawn_wire, { - 'as_protobufTypeLPM': as_protobufTypeLPM, - 'as_protobufNameLPM': as_protobufNameLPM, - 'unreachable': unreachable_code - }, api_and_wire_params, fuzzer_params - ] - - renders.append( - FileRender('dawn/fuzzers/lpmfuzz/dawn_lpm.proto', - 'src/dawn/fuzzers/lpmfuzz/dawn_lpm_autogen.proto', - lpm_params)) - - renders.append( - FileRender( - 'dawn/fuzzers/lpmfuzz/dawn_object_types_lpm.proto', - 'src/dawn/fuzzers/lpmfuzz/dawn_object_types_lpm_autogen.proto', - lpm_params)) - - if 'dawn_lpmfuzz_cpp' in targets: - params_dawn_wire = parse_json( - loaded_json, - enabled_tags=['compat', 'dawn', 'deprecated'], - disabled_tags=['native']) - api_and_wire_params = compute_wire_params(params_dawn_wire, - wire_json) - - fuzzer_params = compute_lpm_params(api_and_wire_params, lpm_json) - - lpm_params = [ - RENDER_PARAMS_BASE, params_dawn_wire, { - 'as_protobufMemberName': as_protobufMemberNameLPM - }, api_and_wire_params, fuzzer_params - ] - - renders.append( - FileRender( - 'dawn/fuzzers/lpmfuzz/DawnLPMSerializer.cpp', - 'src/dawn/fuzzers/lpmfuzz/DawnLPMSerializer_autogen.cpp', - lpm_params)) - - renders.append( - FileRender( - 'dawn/fuzzers/lpmfuzz/DawnLPMSerializer.h', - 'src/dawn/fuzzers/lpmfuzz/DawnLPMSerializer_autogen.h', - lpm_params)) - - renders.append( - FileRender( - 'dawn/fuzzers/lpmfuzz/DawnLPMConstants.h', - 'src/dawn/fuzzers/lpmfuzz/DawnLPMConstants_autogen.h', - lpm_params)) - if 'kotlin' in targets: params_kotlin = compute_kotlin_params(loaded_json, kotlin_json) kt_file_path = params_kotlin['kotlin_package'].replace('.', '/') @@ -1686,8 +1507,6 @@ def get_dependencies(self, args): deps += [os.path.abspath(args.wire_json)] if args.kotlin_json != None: deps += [os.path.abspath(args.kotlin_json)] - if args.lpm_json != None: - deps += [os.path.abspath(args.lpm_json)] return deps diff --git a/generator/templates/dawn/fuzzers/lpmfuzz/DawnLPMConstants.h b/generator/templates/dawn/fuzzers/lpmfuzz/DawnLPMConstants.h deleted file mode 100644 index 816ea45ef60..00000000000 --- a/generator/templates/dawn/fuzzers/lpmfuzz/DawnLPMConstants.h +++ /dev/null @@ -1,44 +0,0 @@ -// Copyright 2023 The Dawn & Tint Authors -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// 3. Neither the name of the copyright holder nor the names of its -// contributors may be used to endorse or promote products derived from -// this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -#include - -namespace DawnLPMFuzzer { - - -static constexpr int kInstanceObjectId = 1; -static constexpr uint32_t kInvalidObjectId = {{ cmd_records["lpm_info"]["invalid object id"] }}; - -{% for type in by_category["object"] %} - {% if type.name.get() in cmd_records["lpm_info"]["limits"] %} - static constexpr int k{{ type.name.CamelCase() }}Limit = {{ cmd_records["lpm_info"]["limits"][type.name.get()] }}; - {% else %} - static constexpr int k{{ type.name.CamelCase() }}Limit = {{ cmd_records["lpm_info"]["limits"]["default"] }}; - {% endif %} -{% endfor %} - -} // namespace DawnLPMFuzzer diff --git a/generator/templates/dawn/fuzzers/lpmfuzz/DawnLPMSerializer.cpp b/generator/templates/dawn/fuzzers/lpmfuzz/DawnLPMSerializer.cpp deleted file mode 100644 index 17bace68e9c..00000000000 --- a/generator/templates/dawn/fuzzers/lpmfuzz/DawnLPMSerializer.cpp +++ /dev/null @@ -1,328 +0,0 @@ -// Copyright 2023 The Dawn & Tint Authors -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// 3. Neither the name of the copyright holder nor the names of its -// contributors may be used to endorse or promote products derived from -// this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -#include - -#include "dawn/fuzzers/lpmfuzz/DawnLPMConstants_autogen.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMFuzzer.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMObjectStore.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMSerializer_autogen.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMSerializerCustom.h" -#include "dawn/wire/BufferConsumer_impl.h" -#include "dawn/wire/ObjectHandle.h" -#include "dawn/wire/Wire.h" -#include "dawn/wire/WireClient.h" -#include "dawn/wire/WireCmd_autogen.h" -#include "dawn/wire/WireResult.h" -#include "dawn/wire/client/ApiObjects_autogen.h" - -namespace dawn::wire { - -//* Outputs an rvalue that's the number of elements a pointer member points to. -{% macro member_length(member, proto_accessor) -%} - {%- if member.length == "constant" -%} - {{member.constant_length}}u - {%- else -%} - {{proto_accessor}}().size() - {%- endif -%} -{%- endmacro %} - -//* Outputs the type that will be used on the wire for the member -{% macro member_type(member) -%} - {{ assert(as_cType(member.type.name) != "size_t") }} - {{as_cType(member.type.name)}} -{%- endmacro %} - -//* Converts an existing proto string to StringView. -{% macro convert_string(member) %} - {{ assert(member.type.name.get() == "string view" or member.type.name.get() == "nullable string view" ) }} - {% set memberName = as_varName(member.name) %} - {% set protoMember = as_protobufMemberName(member.name) %} - {% if member.type.name.get() == "nullable string view" %} - if (!proto_record.has_{{protoMember}}()) { - mutable_record->{{ memberName }}.data = nullptr; - mutable_record->{{ memberName }}.length = SIZE_MAX; - } else - {% endif %} - { - auto memberLength = static_cast({{member_length(member, "proto_record." + protoMember)}}); - char* memberBuffer; - WIRE_TRY(serializeBuffer->NextN(memberLength, &memberBuffer)); - memcpy(memberBuffer, proto_record.{{protoMember}}().c_str(), memberLength); - mutable_record->{{ memberName }}.data = memberBuffer; - mutable_record->{{ memberName }}.length = memberLength; - } -{% endmacro %} - -//* Outputs the conversion code to put `in` in `out` -{% macro convert_member(member, in, out, in_access="") %} - {% if member.type.name.get() == "string view" or member.type.name.get() == "nullable string view" %} - //* Custom conversion for string view types. - {{ convert_string(member) }} - {% elif member.type.category == "structure" or member.type.category == "callback info" %} - {{ convert_structure(member, in, out, in_access) }} - {% elif member.type in by_category["bitmask"] %} - {{ convert_bitmask(member, in, out, in_access) }} - {% elif member.type in by_category["enum"] %} - {{ convert_enum(member, in, out, in_access) }} - {% elif member.type in by_category["object"] %} - {{ convert_object(member, in, out, in_access) }} - {% elif member.type.name.get() == "ObjectId" %} - {{ convert_objectid(member, in, out, access) }} - {% elif member.type.name.get() == "ObjectHandle" %} - //* Only convert the handle if it maps to an object. Otherwise don't serialize it at all. - {% if member.handle_type %} - {{ convert_objecthandle(member, in, out, in_access) }} - {% endif %} - {% else %} - {{out}} = {{in}}({{in_access}}); - {% endif %} -{% endmacro %} - -//* Helper functions for converting protobufs to specific types -{% macro convert_enum(member, in, out, in_access) %} - {{out}} = static_cast<{{ member_type(member) }}>( - {{in}}({{in_access}}) - ); -{% endmacro %} - -{% macro convert_object(member, in, out, in_access) -%} - {{ out }} = reinterpret_cast<{{ as_cType(member.type.name) }}>( - objectStores[ObjectType::{{ member.type.name.CamelCase() }}].Lookup( - static_cast( - {{in}}({{in_access}}) - ) - ) - ); -{%- endmacro %} - -{% macro convert_objectid(member, in, out, in_access) -%} - {{ out }} = objectStores[ObjectType::{{ member.id_type.name.CamelCase() }}].Lookup( - static_cast( - {{in}}({{ in_access}}) - ) - ); -{%- endmacro %} - -{% macro convert_objecthandle(member, in, out, in_access) -%} - if (objectStores[ObjectType::{{ member.handle_type.name.CamelCase() }}].Size() < DawnLPMFuzzer::k{{ member.handle_type.name.CamelCase() }}Limit) { - {{ out }} = objectStores[ObjectType::{{ member.handle_type.name.CamelCase() }}].ReserveHandle(); - } else { - // Return failure in this case to guide the fuzzer away from generating too many - // objects of this type - return WireResult::FatalError; - } -{%- endmacro %} - -{% macro convert_bitmask(member, in, out, in_access) -%} - {{ out }} = 0; - for (size_t bm = 0; bm < static_cast({{ in }}().size()); bm++) { - {{ out }} |= - static_cast<{{ member_type(member) }}>( - {{ in }}(bm) - ); - } -{%- endmacro %} - -{% macro convert_structure(member, in, out, in_access) -%} - // Serializing a Structure Recursively - WIRE_TRY({{member_type(member)}}ProtoConvert({{in}}({{in_access}}), &{{out}}, serializeBuffer, objectStores)); -{%- endmacro %} - -{% macro write_record_conversion_helpers(record, name, members, is_cmd) %} - {% set overrides = cmd_records["lpm_info"]["overrides"] %} - {% set overrides_key = record.name.canonical_case() %} - {% set name = record.name.CamelCase() %} - {% set Cmd = "Cmd" if is_cmd else "" %} - {% set WGPU = "WGPU" if not is_cmd else "" %} - - WireResult {{WGPU}}{{name}}ProtoConvert(fuzzing::{{ name }} proto_record, {{WGPU}}{{ name }}{{ Cmd }} const *record, SerializeBuffer* serializeBuffer, PerObjectType &objectStores) { - - //* maybe_unused because some commands don't set any members. - [[maybe_unused]] {{WGPU}}{{ name }}{{ Cmd }} *mutable_record = const_cast<{{WGPU}}{{ name }}{{ Cmd }} *>(record); - - //* Clear the entire structure to make optional handling simpler. - memset(mutable_record, 0, sizeof({{WGPU}}{{ name }}{{ Cmd }})); - - //* Pass by Value handling. This mirrors WireCmd with some differences between - //* convert_member and serialize_member - {% for member in members if member.annotation == "value" if not member.skip_serialize %} - {% set memberName = as_varName(member.name) %} - {% set protoMember = as_protobufMemberName(member.name) %} - - {% if member.optional %} - if ( proto_record.has_{{ protoMember }}() ) { - {% else %} - { - {% endif %} - //* Major WireCmd Divergence: Some member values are hardcoded in dawn_lpm.json - {% if overrides_key in overrides and - member.name.canonical_case() in overrides[overrides_key] %} - mutable_record->{{ memberName }} = - {{- overrides[overrides_key][member.name.canonical_case()] }}; - {%- elif member.type.category == "function pointer" or - member.type.category == "callback function" or - member.type.name.get() == "void *" -%} - mutable_record->{{ memberName }} = nullptr; - {% else %} - {{ convert_member(member, 'proto_record.' + protoMember, "mutable_record->" + memberName) }} - {% endif %} - } - {% endfor %} - - //* Chained structures are currently not supported. - {% if record.extensible %} - mutable_record->nextInChain = nullptr; - {% endif %} - - //* TODO(1374747): Create a string type that can be either - //* random bytes or the fixed entrypoint name. - {% for member in members if member.length == "strlen" %} - {% set memberName = as_varName(member.name) %} - { - mutable_record->{{ memberName }} = "main"; - } - {% endfor %} - - //* Pass by Pointer handling. This mirrors WireCmd with some divergences when handling - //* byte arrays. - {% for member in members if member.annotation != "value" and member.length != "strlen" and not member.skip_serialize %} - {% set memberName = as_varName(member.name) %} - {% set protoMember = as_protobufMemberName(member.name) %} - {% set protoAccess = "i" if member.length != "constant" or member.constant_length > 1 else "" %} - - //* Major WireCmd Divergence: DawnLPM handles raw byte arrays uniquely - //* as they don't lead to new coverage, lead to OOMs when allocated with - //* an arbitrary size, and are difficult to work with in protobuf. - {% if member.type.name.get() == 'uint8_t' %} - { - const size_t kDataBufferLength = 128; - auto memberLength = kDataBufferLength; - - {{member_type(member)}}* memberBuffer; - WIRE_TRY(serializeBuffer->NextN(memberLength, &memberBuffer)); - memset(memberBuffer, 0, kDataBufferLength); - mutable_record->{{ memberName }} = memberBuffer; - - {% if member.length != "constant" -%} - mutable_record->{{ member.length.name.camelCase() }} = memberLength; - {%- endif %} - } - {% else %} - {% set is_fixed_array = true if (member.length == "constant" and member.constant_length > 1) else false %} - - {% if member.optional and not is_fixed_array %} - if ( proto_record.has_{{ protoMember }}() ) { - {% else %} - { - {% endif %} - auto memberLength = static_cast({{member_length(member, "proto_record." + protoMember)}}); - - //* Needed for the edge cases in "external texture descriptor" - //* where we want to fuzzer to fill the fixed-length float arrays - //* with values, but the length of the protobuf buffer might not - //* be large enough for "src transfer function parameters". - {% if is_fixed_array %} - memberLength = std::min(memberLength, static_cast({{"proto_record." + protoMember}}().size())); - {% endif %} - - {{member_type(member)}}* memberBuffer; - WIRE_TRY(serializeBuffer->NextN(memberLength, &memberBuffer)); - - for (decltype(memberLength) i = 0; i < memberLength; ++i) { - {{convert_member(member, "proto_record." + protoMember, "memberBuffer[i]", protoAccess )}} - } - - mutable_record->{{ memberName }} = memberBuffer; - - //* Major WireCmd Divergence: Within the serializer the length member is - //* set by using record.length. Here we aren't receiving any data - //* and set it to the number of protobuf objects in proto_record. - {% if member.length != "constant" -%} - mutable_record->{{ member.length.name.camelCase() }} = memberLength; - {%- endif %} - } - {% endif %} - {% endfor %} - - return WireResult::Success; - } -{% endmacro %} - -//* Output structure conversion first because it is used by commands. -{% for type in by_category["callback info"] + by_category["structure"] %} - {% if type.name.get() != "string view" and type.name.get() != "nullable string view" %} - {% set name = as_cType(type.name) %} - {% if type.name.CamelCase() not in client_side_structures %} - {{ write_record_conversion_helpers(type, name, type.members, False) }} - {% endif %} - {% endif %} -{% endfor %} - -//* Output command conversion functions. -{% for command in cmd_records["cpp_generated_commands"] %} - {% set name = command.name.CamelCase() %} - {{ write_record_conversion_helpers(command, name, command.members, True) }} -{% endfor %} - -WireResult SerializedData(const fuzzing::Program& program, dawn::wire::ChunkedCommandSerializer serializer) { - DawnLPMObjectIdProvider provider; - PerObjectType objectStores; - - // Allocate a scoped buffer allocation - const size_t kMaxSerializeBufferSize = 65536; - std::unique_ptr allocatedBuffer( - new char[kMaxSerializeBufferSize]() - ); - - for (const fuzzing::Command& command : program.commands()) { - switch (command.command_case()) { - - {% for command in cmd_records["cpp_generated_commands"] %} - {% set name = command.name.CamelCase() %} - case fuzzing::Command::k{{name}}: { - SerializeBuffer serializeBuffer(allocatedBuffer.get(), kMaxSerializeBufferSize); - {{ name }}Cmd *cmd = nullptr; - WIRE_TRY(serializeBuffer.Next(&cmd)); - - WIRE_TRY({{name}}ProtoConvert(command.{{ command.name.concatcase() }}(), cmd, &serializeBuffer, objectStores)); - - serializer.SerializeCommand(*cmd, provider); - break; - } - {% endfor %} - default: { - GetCustomSerializedData(command, serializer, objectStores, provider); - break; - } - } - } - - return WireResult::Success; -} - -} // namespace dawn::wire diff --git a/generator/templates/dawn/fuzzers/lpmfuzz/DawnLPMSerializer.h b/generator/templates/dawn/fuzzers/lpmfuzz/DawnLPMSerializer.h deleted file mode 100644 index bea9a30a289..00000000000 --- a/generator/templates/dawn/fuzzers/lpmfuzz/DawnLPMSerializer.h +++ /dev/null @@ -1,60 +0,0 @@ -// Copyright 2023 The Dawn & Tint Authors -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// 3. Neither the name of the copyright holder nor the names of its -// contributors may be used to endorse or promote products derived from -// this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -#ifndef SRC_DAWN_FUZZERS_DAWNLPMSERIALIZER_H_ -#define SRC_DAWN_FUZZERS_DAWNLPMSERIALIZER_H_ - -#include "dawn/fuzzers/lpmfuzz/dawn_lpm_autogen.pb.h" -#include "dawn/wire/ChunkedCommandSerializer.h" -#include "dawn/wire/WireCmd_autogen.h" -#include "dawn/wire/WireResult.h" - -namespace dawn::wire { - -class DawnLPMObjectIdProvider : public ObjectIdProvider { - private: - - // Implementation of the ObjectIdProvider interface - {% for type in by_category["object"] %} - WireResult GetId({{as_cType(type.name)}} object, ObjectId* out) const final { - *out = reinterpret_cast(object); - return WireResult::Success; - } - WireResult GetOptionalId({{as_cType(type.name)}} object, ObjectId* out) const final { - *out = reinterpret_cast(object); - return WireResult::Success; - } - {% endfor %} - -}; - -WireResult SerializedData(const fuzzing::Program& program, - dawn::wire::ChunkedCommandSerializer serializer); - -} // namespace dawn::wire - -#endif // SRC_DAWN_FUZZERS_DAWNLPMSERIALIZER_H_ diff --git a/generator/templates/dawn/fuzzers/lpmfuzz/dawn_lpm.proto b/generator/templates/dawn/fuzzers/lpmfuzz/dawn_lpm.proto deleted file mode 100644 index cc21bbabf91..00000000000 --- a/generator/templates/dawn/fuzzers/lpmfuzz/dawn_lpm.proto +++ /dev/null @@ -1,205 +0,0 @@ -// Copyright 2023 The Dawn & Tint Authors -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// 3. Neither the name of the copyright holder nor the names of its -// contributors may be used to endorse or promote products derived from -// this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -syntax = "proto2"; -package fuzzing; - -import "third_party/dawn/src/dawn/fuzzers/lpmfuzz/dawn_custom_lpm.proto"; - - -// These are hardcoded limits for Dawn Object allocations based on type to help -// guide the fuzzer towards reusing existing objects. -{% for type in by_category["object"] %} - {% set type_key = type.name.canonical_case() %} - enum {{ type.name.CamelCase() }}Id { - {% if type_key in cmd_records["lpm_info"]["limits"] %} - {% for n in range(cmd_records["lpm_info"]["limits"][type_key]) %} - {{ type.name.SNAKE_CASE() }}_{{ loop.index }} = {{ loop.index }}; - {% endfor %} - {% else %} - {% for n in range(cmd_records["lpm_info"]["limits"]["default"]) %} - {{ type.name.SNAKE_CASE() }}_{{ loop.index }} = {{ loop.index }}; - {% endfor %} - {% endif %} - INVALID_{{ type.name.SNAKE_CASE() }} = {{ cmd_records["lpm_info"]["invalid object id"] }}; - }; -{% endfor %} - -{% for type in by_category["enum"] %} - enum {{as_cppType(type.name)}} { - {% for value in type.values %} - {{ as_cppType(type.name) }}{{as_cppEnum(value.name)}} = {{ value.value }}; - {% endfor %} - }; -{% endfor %} - - -{% for type in by_category["bitmask"] %} - enum {{as_cppType(type.name)}} { - {% for value in type.values %} - {{ as_cppType(type.name) }}{{as_cppEnum(value.name)}} = {{ value.value }}; - {% endfor %} - }; -{% endfor %} - -{% macro optionality(member) -%} - {%- if member.optional -%} - optional - {%- else -%} - required - {%- endif -%} -{%- endmacro %} - -{% macro lift_string_proto_member(member, count) -%} - {{ optionality(member) }} string {{ as_protobufNameLPM(member.name) }} = {{ count.value }}; - {% set count.value = count.value + 1 %} - -{%- endmacro %} - - -{% macro lift_float_array_proto_member(member, count) -%} - repeated float {{ as_varName(member.name) }} = {{ count.value }}; - {% set count.value = count.value + 1 %} -{%- endmacro %} - - -{% macro lift_object_member(member, count) %} - {{ member.type.name.CamelCase() }}Id {{ as_protobufNameLPM(member.name) }} -{% endmacro %} - - -{% macro lift_objectid_member(member, count) %} - {{ member.id_type.name.CamelCase() }}Id {{ as_protobufNameLPM(member.name) }} -{% endmacro %} - - -{% macro lift_varlength_proto_member(member, count) -%} - {% if member.type in by_category["object"] %} - repeated {{ lift_object_member(member, count) }} = {{ count.value }}; - {% set count.value = count.value + 1 %} - {% elif member.type.name.get() == "object id" %} - repeated {{ lift_objectid_member(member, count) }} = {{ count.value }}; - {% set count.value = count.value + 1 %} - {% else %} - repeated {{ as_protobufTypeLPM(member) }} {{ as_protobufNameLPM(member.name) }} = {{ count.value }}; - {% set count.value = count.value + 1 %} - {% endif %} -{%- endmacro %} - - -{% macro lift_dawn_member_pass_by_value(record, name, member, count) %} - {% if member.type.name.get() == "ObjectHandle" or - member.type.category == "function pointer" or - member.type.category == "callback function" or - member.type.name.get() == "void *" %} - //* These types should not be serialized using protobuf structures. - //* Handled by the serializer. - {% elif member.type in by_category["bitmask"] %} - repeated {{ as_protobufTypeLPM(member) }} {{ as_protobufNameLPM(member.name) }} = {{ count.value }}; - {% set count.value = count.value + 1 %} - {% elif member.type in by_category["object"] %} - {{ optionality(member) }} {{ lift_object_member(member, count) }} = {{ count.value }}; - {% set count.value = count.value + 1 %} - {% elif member.type.name.get() == "ObjectId" %} - {{ optionality(member) }} {{ lift_objectid_member(member, count) }} = {{ count.value }}; - {% set count.value = count.value + 1 %} - {% elif member.type.name.get() == "string view" %} - required string {{ as_protobufNameLPM(member.name) }} = {{ count.value }}; - {% elif member.type.name.get() == "nullable string view" %} - optional string {{ as_protobufNameLPM(member.name) }} = {{ count.value }}; - {% elif member.type in by_category["structure"] or - member.type in by_category["enum"] %} - {{ optionality(member) }} {{ as_protobufTypeLPM(member) }} {{ as_protobufNameLPM(member.name) }} = {{ count.value }}; - {% set count.value = count.value + 1 %} - {% else %} - {{ optionality(member) }} {{ as_protobufTypeLPM(member) }} {{ as_protobufNameLPM(member.name) }} = {{ count.value }}; - {% set count.value = count.value + 1 %} - {% endif %} -{% endmacro %} - -{% macro lift_dawn_member_pass_by_pointer(record, name, member, count) %} - {% if member.type.name.get() == "uint8_t" %} - //* This types should not be serialized using protobuf structures. - //* Handled by the serializer. - {% elif member.type in by_category["structure"] and - member.length == "constant" and - member.constant_length == 1 %} - {{ optionality(member) }} {{ as_protobufTypeLPM(member) }} {{ as_protobufNameLPM(member.name) }} = {{ count.value }}; - {% set count.value = count.value + 1 %} - {% elif member.type.name.get() == "char" and - member.length == 'strlen' %} - {{ lift_string_proto_member(member, count) }} - {% elif member.type.name.get() == "float" %} - {{ lift_float_array_proto_member(member, count) }} - {% elif member.length != 'constant' %} - {{ lift_varlength_proto_member(member, count) }} - {% else %} - //* There shouldn't be any other pass-by-pointer types in - //* dawn*.json, if any are added we would like to know at compile time - {{ unreachable_code() }} - {% endif %} -{% endmacro %} - -{% macro lift_proto_members_helper(record, name, members) %} - {% set count = namespace(value=1) %} - {% for member in members %} - {% if member.skip_serialize == True %} - // {{ member.name.camelCase()}}.skip_serialize - {% elif member.annotation == 'value' %} - {{ lift_dawn_member_pass_by_value(record, name, member, count) }} - {% elif member.annotation == 'const*' %} - {{ lift_dawn_member_pass_by_pointer(record, name, member, count) }} - {% endif %} - {% endfor %} -{% endmacro %} - -{% for structure in by_category["callback info"] + by_category["structure"] %} - {% if structure.name.get() != "string view" and structure.name.get() != "nullable string view" %} - message {{structure.name.CamelCase()}} { - {{ lift_proto_members_helper(structure, structure.name, structure.members) }} - } - {% endif %} -{% endfor %} - - -{% for command in cmd_records["proto_generated_commands"] %} - message {{command.name.CamelCase()}} { - {{ lift_proto_members_helper(command, command.name, command.members) }} - } -{% endfor %} - -message Command { - oneof command { - {% for command in cmd_records["proto_all_commands"] %} - {{command.name.CamelCase()}} {{command.name.camelCase()}} = {{ loop.index }}; - {% endfor %} - } -} - -message Program { - repeated Command commands = 1; -} diff --git a/generator/templates/dawn/fuzzers/lpmfuzz/dawn_object_types_lpm.proto b/generator/templates/dawn/fuzzers/lpmfuzz/dawn_object_types_lpm.proto deleted file mode 100644 index 40ff483deb7..00000000000 --- a/generator/templates/dawn/fuzzers/lpmfuzz/dawn_object_types_lpm.proto +++ /dev/null @@ -1,35 +0,0 @@ -// Copyright 2023 The Dawn & Tint Authors -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// 3. Neither the name of the copyright holder nor the names of its -// contributors may be used to endorse or promote products derived from -// this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -syntax = "proto2"; -package fuzzing; - -enum ObjectType { - {% for type in by_category["object"] %} - {{ type.name.CamelCase() }} = {{ loop.index - 1}}; - {% endfor %} -}; diff --git a/src/dawn/fuzzers/BUILD.gn b/src/dawn/fuzzers/BUILD.gn index 6a490bf729a..24eb04852b8 100644 --- a/src/dawn/fuzzers/BUILD.gn +++ b/src/dawn/fuzzers/BUILD.gn @@ -31,7 +31,6 @@ if (dawn_has_fuzzers) { import("//build_overrides/build.gni") import("//testing/libfuzzer/fuzzer_test.gni") import("${dawn_root}/scripts/dawn_features.gni") - import("${dawn_root}/src/dawn/fuzzers/dawn_fuzzers.gni") static_library("dawn_wire_server_fuzzer_common") { sources = [ @@ -74,84 +73,6 @@ if (dawn_has_fuzzers) { additional_configs = [ "${dawn_root}/src/dawn/common:internal_config" ] } - if (is_dawn_lpm_fuzzer && build_with_chromium && dawn_use_swiftshader && - !disable_libfuzzer && use_fuzzing_engine) { - import("//third_party/protobuf/proto_library.gni") - import("${dawn_root}/generator/dawn_generator.gni") - - # Generate the fuzzer's serializer in `.cpp` - dawn_json_lpm_generator("dawn_lpmfuzz_cpp") { - target = "dawn_lpmfuzz_cpp" - outputs = [ - "src/dawn/fuzzers/lpmfuzz/DawnLPMSerializer_autogen.cpp", - "src/dawn/fuzzers/lpmfuzz/DawnLPMSerializer_autogen.h", - "src/dawn/fuzzers/lpmfuzz/DawnLPMConstants_autogen.h", - ] - } - - # Generate the `.proto` files - dawn_json_lpm_generator("dawn_lpmfuzz_proto") { - target = "dawn_lpmfuzz_proto" - outputs = [ - "src/dawn/fuzzers/lpmfuzz/dawn_lpm_autogen.proto", - "src/dawn/fuzzers/lpmfuzz/dawn_object_types_lpm_autogen.proto", - ] - } - - # Copy handwritten `.proto` file to build directory - copy("copy_dawn_custom_lpm") { - sources = - [ "${dawn_root}/src/dawn/fuzzers/lpmfuzz/dawn_custom_lpm.proto" ] - outputs = [ "$root_out_dir/gen/third_party/dawn/src/dawn/fuzzers/lpmfuzz/dawn_custom_lpm.proto" ] - } - - # Generate the `.pb.h` and `.pb.cc` files - proto_library("dawn_lpm_proto") { - proto_in_dir = "$root_out_dir/gen" - proto_out_dir = "//" - sources = get_target_outputs(":dawn_lpmfuzz_proto") - sources += get_target_outputs(":copy_dawn_custom_lpm") - - generate_python = false - use_protobuf_full = true - deps = [ - ":copy_dawn_custom_lpm", - ":dawn_lpmfuzz_proto", - "//third_party/protobuf:protobuf_full", - ] - } - - # Compile dawnlpm fuzzer with extensive tint coverage - dawn_lpm_template("dawn_lpm_fuzzer_vulkan_backend_with_tint") { - defines = [ "DAWNLPM_FUZZ_TINT=1" ] - dawn_lpm_sources = get_target_outputs(":dawn_lpmfuzz_cpp") - dawn_lpm_sources += [ - "lpmfuzz/DawnLPMFuzzer.cpp", - "lpmfuzz/DawnLPMFuzzer.h", - "lpmfuzz/DawnLPMFuzzerAndVulkanBackend.cpp", - "lpmfuzz/DawnLPMObjectStore.cpp", - "lpmfuzz/DawnLPMObjectStore.h", - "lpmfuzz/DawnLPMSerializerCustom.cpp", - "lpmfuzz/DawnLPMSerializerCustom.h", - ] - } - - # Compile dawnlpm api fuzzer - dawn_lpm_template("dawn_lpm_fuzzer_vulkan_backend") { - defines = [ "DAWNLPM_FUZZ_TINT=0" ] - dawn_lpm_sources = get_target_outputs(":dawn_lpmfuzz_cpp") - dawn_lpm_sources += [ - "lpmfuzz/DawnLPMFuzzer.cpp", - "lpmfuzz/DawnLPMFuzzer.h", - "lpmfuzz/DawnLPMFuzzerAndVulkanBackend.cpp", - "lpmfuzz/DawnLPMObjectStore.cpp", - "lpmfuzz/DawnLPMObjectStore.h", - "lpmfuzz/DawnLPMSerializerCustom.cpp", - "lpmfuzz/DawnLPMSerializerCustom.h", - ] - } - } - # A group target to build all the fuzzers group("fuzzers") { testonly = true diff --git a/src/dawn/fuzzers/dawn_fuzzers.gni b/src/dawn/fuzzers/dawn_fuzzers.gni deleted file mode 100644 index 01b40be637e..00000000000 --- a/src/dawn/fuzzers/dawn_fuzzers.gni +++ /dev/null @@ -1,65 +0,0 @@ -# Copyright 2023 The Dawn & Tint Authors -# -# Redistribution and use in source and binary forms, with or without -# modification, are permitted provided that the following conditions are met: -# -# 1. Redistributions of source code must retain the above copyright notice, this -# list of conditions and the following disclaimer. -# -# 2. Redistributions in binary form must reproduce the above copyright notice, -# this list of conditions and the following disclaimer in the documentation -# and/or other materials provided with the distribution. -# -# 3. Neither the name of the copyright holder nor the names of its -# contributors may be used to endorse or promote products derived from -# this software without specific prior written permission. -# -# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -# Build flag for dawn lpm fuzzers - -import("../../../scripts/dawn_overrides_with_defaults.gni") - -import("//build_overrides/build.gni") -import("//testing/libfuzzer/fuzzer_test.gni") - -declare_args() { - is_dawn_lpm_fuzzer = is_linux -} - -template("dawn_lpm_template") { - # Extract some common parameters (if needed) - assert(is_dawn_lpm_fuzzer) - assert(defined(invoker.dawn_lpm_sources)) - assert(defined(invoker.defines)) - - fuzzer_test("${target_name}") { - sources = invoker.dawn_lpm_sources - defines = invoker.defines - deps = [ - ":dawn_lpm_proto", - ":dawn_lpmfuzz_cpp", - "${dawn_root}/include/dawn:cpp_headers", - "${dawn_root}/src/dawn:proc", - "${dawn_root}/src/dawn/common", - "${dawn_root}/src/dawn/native:static", - "${dawn_root}/src/dawn/utils", - "${dawn_root}/src/dawn/wire:static", - "//third_party/libprotobuf-mutator", - ] - - libfuzzer_options = [ - "max_len=2111000", - "len_control=0", - ] - } -} diff --git a/src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzer.cpp b/src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzer.cpp deleted file mode 100644 index 43d046c3891..00000000000 --- a/src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzer.cpp +++ /dev/null @@ -1,162 +0,0 @@ -// Copyright 2023 The Dawn & Tint Authors -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// 3. Neither the name of the copyright holder nor the names of its -// contributors may be used to endorse or promote products derived from -// this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -#include - -#include -#include -#include - -#include "dawn/common/Assert.h" -#include "dawn/common/Log.h" -#include "dawn/common/SystemUtils.h" -#include "dawn/dawn_proc.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMConstants_autogen.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMFuzzer.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMSerializer_autogen.h" -#include "dawn/fuzzers/lpmfuzz/dawn_lpm_autogen.pb.h" -#include "dawn/native/DawnNative.h" -#include "dawn/utils/SystemUtils.h" -#include "dawn/utils/TerribleCommandBuffer.h" -#include "dawn/wire/ChunkedCommandSerializer.h" -#include "dawn/wire/WireClient.h" -#include "dawn/wire/WireResult.h" -#include "dawn/wire/WireServer.h" -#include "testing/libfuzzer/libfuzzer_exports.h" - -namespace { - -class DevNull : public dawn::wire::CommandSerializer { - public: - size_t GetMaximumAllocationSize() const override { - // Some fuzzer bots have a 2GB allocation limit. Pick a value reasonably below that. - return 1024 * 1024 * 1024; - } - void* GetCmdSpace(size_t size) override { - if (size > buf.size()) { - buf.resize(size); - } - return buf.data(); - } - bool Flush() override { return true; } - - private: - std::vector buf; -}; - -// We need this static function pointer to make AdapterSupported accessible in -// instanceRequestAdapter -static bool (*sAdapterSupported)(const dawn::native::Adapter&) = nullptr; - -} // namespace - -namespace DawnLPMFuzzer { - -int Initialize(int* argc, char*** argv) { - return 0; -} - -int Run(const fuzzing::Program& program, bool (*AdapterSupported)(const dawn::native::Adapter&)) { - std::unique_ptr instance = std::make_unique(); - sAdapterSupported = AdapterSupported; - DawnProcTable procs = dawn::native::GetProcs(); - - // Override requestAdapter to find an adapter that the fuzzer supports. - // TODO: crbug.com/42241461 - Remove overrides once older entry points are deprecated. - static constexpr auto RequestAdapter = [](WGPUInstance cInstance, - WGPURequestAdapterCallback2 callback, void* userdata1, - void* userdata2) -> WGPUFuture { - std::vector adapters = - dawn::native::Instance(reinterpret_cast(cInstance)) - .EnumerateAdapters(); - for (dawn::native::Adapter adapter : adapters) { - if (sAdapterSupported(adapter)) { - WGPUAdapter cAdapter = adapter.Get(); - dawn::native::GetProcs().adapterAddRef(cAdapter); - callback(WGPURequestAdapterStatus_Success, cAdapter, nullptr, userdata1, userdata2); - return {}; - } - } - callback(WGPURequestAdapterStatus_Unavailable, nullptr, "No supported adapter.", userdata1, - userdata2); - return {}; - }; - procs.instanceRequestAdapter = [](WGPUInstance cInstance, const WGPURequestAdapterOptions*, - WGPURequestAdapterCallback callback, void* userdata) { - RequestAdapter( - cInstance, - [](WGPURequestAdapterStatus status, WGPUAdapter adapter, const char* message, - void* callback, void* userdata) { - auto cb = reinterpret_cast(callback); - cb(status, adapter, message, userdata); - }, - reinterpret_cast(callback), userdata); - }; - procs.instanceRequestAdapterF = [](WGPUInstance cInstance, const WGPURequestAdapterOptions*, - WGPURequestAdapterCallbackInfo callbackInfo) -> WGPUFuture { - return RequestAdapter( - cInstance, - [](WGPURequestAdapterStatus status, WGPUAdapter adapter, const char* message, - void* callback, void* userdata) { - auto cb = reinterpret_cast(callback); - cb(status, adapter, message, userdata); - }, - reinterpret_cast(callbackInfo.callback), callbackInfo.userdata); - }; - procs.instanceRequestAdapter2 = [](WGPUInstance cInstance, const WGPURequestAdapterOptions*, - WGPURequestAdapterCallbackInfo2 callbackInfo) -> WGPUFuture { - return RequestAdapter(cInstance, callbackInfo.callback, callbackInfo.userdata1, - callbackInfo.userdata2); - }; - - dawnProcSetProcs(&procs); - - DevNull devNull; - dawn::wire::WireServerDescriptor serverDesc = {}; - serverDesc.procs = &procs; - serverDesc.serializer = &devNull; - - std::unique_ptr wireServer(new dawn::wire::WireServer(serverDesc)); - wireServer->InjectInstance(instance->Get(), {kInstanceObjectId, 0}); - - static dawn::utils::TerribleCommandBuffer* mCommandBuffer = - new dawn::utils::TerribleCommandBuffer(); - static dawn::wire::ChunkedCommandSerializer mSerializer = - dawn::wire::ChunkedCommandSerializer(mCommandBuffer); - mCommandBuffer->SetHandler(wireServer.get()); - - dawn::wire::WireResult result = dawn::wire::SerializedData(program, mSerializer); - - mCommandBuffer->Flush(); - - // Note: Deleting the server will release all created objects. - // Deleted devices will wait for idle on destruction. - mCommandBuffer->SetHandler(nullptr); - return result == dawn::wire::WireResult::FatalError; -} - -} // namespace DawnLPMFuzzer diff --git a/src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzer.h b/src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzer.h deleted file mode 100644 index 2103f7530c8..00000000000 --- a/src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzer.h +++ /dev/null @@ -1,48 +0,0 @@ -// Copyright 2023 The Dawn & Tint Authors -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// 3. Neither the name of the copyright holder nor the names of its -// contributors may be used to endorse or promote products derived from -// this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -#ifndef SRC_DAWN_FUZZERS_DAWNLPMFUZZER_H_ -#define SRC_DAWN_FUZZERS_DAWNLPMFUZZER_H_ - -#include - -#include "dawn/fuzzers/lpmfuzz/dawn_lpm_autogen.pb.h" - -namespace dawn::native { - -class Adapter; - -} // namespace dawn::native - -namespace DawnLPMFuzzer { - -int Initialize(int* argc, char*** argv); - -int Run(const fuzzing::Program& program, bool (*AdapterSupported)(const dawn::native::Adapter&)); -} // namespace DawnLPMFuzzer - -#endif // SRC_DAWN_FUZZERS_DAWNLPMFUZZER_H_ diff --git a/src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzerAndVulkanBackend.cpp b/src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzerAndVulkanBackend.cpp deleted file mode 100644 index ba4335fdd8e..00000000000 --- a/src/dawn/fuzzers/lpmfuzz/DawnLPMFuzzerAndVulkanBackend.cpp +++ /dev/null @@ -1,46 +0,0 @@ -// Copyright 2023 The Dawn & Tint Authors -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// 3. Neither the name of the copyright holder nor the names of its -// contributors may be used to endorse or promote products derived from -// this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -#include "dawn/common/GPUInfo.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMFuzzer.h" -#include "dawn/fuzzers/lpmfuzz/dawn_lpm_autogen.pb.h" -#include "dawn/native/DawnNative.h" -#include "testing/libfuzzer/libfuzzer_exports.h" -#include "testing/libfuzzer/proto/lpm_interface.h" - -extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) { - return DawnLPMFuzzer::Initialize(argc, argv); -} - -DEFINE_PROTO_FUZZER(const fuzzing::Program& program) { - DawnLPMFuzzer::Run(program, [](const dawn::native::Adapter& adapter) { - wgpu::AdapterInfo info; - adapter.GetInfo(&info); - - return dawn::gpu_info::IsGoogleSwiftshader(info.vendorID, info.deviceID); - }); -} diff --git a/src/dawn/fuzzers/lpmfuzz/DawnLPMObjectStore.cpp b/src/dawn/fuzzers/lpmfuzz/DawnLPMObjectStore.cpp deleted file mode 100644 index 9b1565e2f55..00000000000 --- a/src/dawn/fuzzers/lpmfuzz/DawnLPMObjectStore.cpp +++ /dev/null @@ -1,113 +0,0 @@ -// Copyright 2023 The Dawn & Tint Authors -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// 3. Neither the name of the copyright holder nor the names of its -// contributors may be used to endorse or promote products derived from -// this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -#include -#include -#include -#include - -#include "dawn/fuzzers/lpmfuzz/DawnLPMConstants_autogen.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMObjectStore.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMSerializer_autogen.h" -#include "dawn/wire/ObjectHandle.h" - -namespace dawn::wire { - -DawnLPMObjectStore::DawnLPMObjectStore() { - mCurrentId = 1; -} - -ObjectHandle DawnLPMObjectStore::ReserveHandle() { - if (mFreeHandles.empty()) { - Insert(mCurrentId); - return {mCurrentId++, 0}; - } - ObjectHandle handle = mFreeHandles.back(); - mFreeHandles.pop_back(); - Insert(handle.id); - return handle; -} - -void DawnLPMObjectStore::Insert(ObjectId id) { - std::vector::iterator iter = - std::lower_bound(mObjects.begin(), mObjects.end(), id, std::greater()); - mObjects.insert(iter, id); -} - -void DawnLPMObjectStore::Free(ObjectId id) { - if (id == DawnLPMFuzzer::kInvalidObjectId) { - return; - } - - for (size_t i = 0; i < mObjects.size(); i++) { - if (mObjects[i] == id) { - mFreeHandles.push_back({id, 0}); - mObjects.erase(mObjects.begin() + i); - } - } -} - -/* - * Consistent hashing inspired map for fuzzer state. - * If we store the Dawn objects in a hash table mapping FuzzInt -> ObjectId - * then it would be highly unlikely that any subsequence UnregisterObject command - * would come up with an ID that would correspond to a valid ObjectId in the - * hash table. - * - * One solution is to modulo the FuzzInt with the length of the hash table, but - * it does not work well with libfuzzer's minimization techniques because - * deleting a single ObjectId from the hash table changes the index of every - * entry from then on. - * - * So we use consistent hashing. we take the entry in the table that - * has the next highest id (wrapping when there is no higher entry). - */ -ObjectId DawnLPMObjectStore::Lookup(uint32_t id) const { - // CreateBindGroup relies on sending invalid object ids - if (id == DawnLPMFuzzer::kInvalidObjectId) { - return 0; - } - - auto iter = std::lower_bound(mObjects.begin(), mObjects.end(), id, std::greater()); - if (iter != mObjects.end()) { - return *iter; - } - - // Wrap to 0 - iter = std::lower_bound(mObjects.begin(), mObjects.end(), 0, std::greater()); - if (iter != mObjects.end()) { - return *iter; - } - - return 0; -} - -size_t DawnLPMObjectStore::Size() const { - return mObjects.size(); -} - -} // namespace dawn::wire diff --git a/src/dawn/fuzzers/lpmfuzz/DawnLPMObjectStore.h b/src/dawn/fuzzers/lpmfuzz/DawnLPMObjectStore.h deleted file mode 100644 index b7cf43d5c6b..00000000000 --- a/src/dawn/fuzzers/lpmfuzz/DawnLPMObjectStore.h +++ /dev/null @@ -1,56 +0,0 @@ -// Copyright 2023 The Dawn & Tint Authors -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// 3. Neither the name of the copyright holder nor the names of its -// contributors may be used to endorse or promote products derived from -// this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -#ifndef SRC_DAWN_WIRE_CLIENT_DAWNLPMOBJECTSTORE_H_ -#define SRC_DAWN_WIRE_CLIENT_DAWNLPMOBJECTSTORE_H_ - -#include - -#include "dawn/wire/client/ObjectBase.h" - -namespace dawn::wire { - -class DawnLPMObjectStore { - public: - DawnLPMObjectStore(); - - ObjectHandle ReserveHandle(); - void Free(ObjectId handle); - void Insert(ObjectId handle); - ObjectId Lookup(ObjectId id) const; - size_t Size() const; - - uint32_t mCurrentId; - std::vector mFreeHandles; - - // TODO(tiszka): refactor into a vector of ObjectHandles - std::vector mObjects; -}; - -} // namespace dawn::wire - -#endif // SRC_DAWN_WIRE_CLIENT_DAWNLPMOBJECTSTORE_H_ diff --git a/src/dawn/fuzzers/lpmfuzz/DawnLPMSerializerCustom.cpp b/src/dawn/fuzzers/lpmfuzz/DawnLPMSerializerCustom.cpp deleted file mode 100644 index e6ca97efd59..00000000000 --- a/src/dawn/fuzzers/lpmfuzz/DawnLPMSerializerCustom.cpp +++ /dev/null @@ -1,116 +0,0 @@ -// Copyright 2023 The Dawn & Tint Authors -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// 3. Neither the name of the copyright holder nor the names of its -// contributors may be used to endorse or promote products derived from -// this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -#include - -#include - -#include "dawn/fuzzers/lpmfuzz/DawnLPMConstants_autogen.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMObjectStore.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMSerializerCustom.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMSerializer_autogen.h" -#include "dawn/wire/ChunkedCommandSerializer.h" -#include "dawn/wire/ObjectType_autogen.h" - -namespace dawn::wire { - -void GetCustomSerializedData(const fuzzing::Command& command, - dawn::wire::ChunkedCommandSerializer serializer, - PerObjectType& objectStores, - DawnLPMObjectIdProvider& provider) { - switch (command.command_case()) { - case fuzzing::Command::kDeviceCreateShaderModule: { - DeviceCreateShaderModuleCmd cmd; - memset(&cmd, 0, sizeof(DeviceCreateShaderModuleCmd)); - - ObjectId cmd_self_id = - objectStores[ObjectType::Device].Lookup(command.devicecreateshadermodule().self()); - - if (cmd_self_id == static_cast(DawnLPMFuzzer::kInvalidObjectId)) { - break; - } - - cmd.self = reinterpret_cast(cmd_self_id); - - WGPUShaderModuleDescriptor cmd_descriptor; - memset(&cmd_descriptor, 0, sizeof(struct WGPUShaderModuleDescriptor)); - - WGPUShaderSourceWGSL wgsl_desc = {}; - wgsl_desc.chain.sType = WGPUSType_ShaderSourceWGSL; - - if (DAWNLPM_FUZZ_TINT && command.devicecreateshadermodule().has_code()) { - wgsl_desc.code = command.devicecreateshadermodule().code().c_str(); - } else { - wgsl_desc.code = - "@group(0) @binding(0)\n" - "var output: array;\n" - "@compute @workgroup_size(64)\n" - "fn main( \n" - " @builtin(global_invocation_id) global_id : vec3,\n" - " @builtin(local_invocation_id) local_id : vec3,\n" - ") { \n" - "output[global_id.x] = \n" - " f32(global_id.x) * 1000. + f32(local_id.x);\n" - "}"; - } - cmd_descriptor.nextInChain = reinterpret_cast(&wgsl_desc); - - cmd.descriptor = &cmd_descriptor; - if (objectStores[ObjectType::ShaderModule].Size() >= - DawnLPMFuzzer::kShaderModuleLimit) { - break; - } - - cmd.result = objectStores[ObjectType::ShaderModule].ReserveHandle(); - serializer.SerializeCommand(cmd, provider); - break; - } - case fuzzing::Command::kUnregisterObject: { - UnregisterObjectCmd cmd; - memset(&cmd, 0, sizeof(UnregisterObjectCmd)); - - cmd.objectType = - static_cast(command.unregisterobject().objecttype() % kObjectTypes); - - cmd.objectId = objectStores[static_cast(cmd.objectType)].Lookup( - command.unregisterobject().objectid()); - - if (cmd.objectId == static_cast(DawnLPMFuzzer::kInvalidObjectId)) { - break; - } - - objectStores[cmd.objectType].Free(cmd.objectId); - serializer.SerializeCommand(cmd, provider); - break; - } - default: { - break; - } - } -} - -} // namespace dawn::wire diff --git a/src/dawn/fuzzers/lpmfuzz/DawnLPMSerializerCustom.h b/src/dawn/fuzzers/lpmfuzz/DawnLPMSerializerCustom.h deleted file mode 100644 index 4f05bf3a515..00000000000 --- a/src/dawn/fuzzers/lpmfuzz/DawnLPMSerializerCustom.h +++ /dev/null @@ -1,44 +0,0 @@ -// Copyright 2023 The Dawn & Tint Authors -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// 3. Neither the name of the copyright holder nor the names of its -// contributors may be used to endorse or promote products derived from -// this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -#ifndef SRC_DAWN_FUZZERS_DAWNLPMCUSTOMSERIALIZER_H_ -#define SRC_DAWN_FUZZERS_DAWNLPMCUSTOMSERIALIZER_H_ - -#include "dawn/fuzzers/lpmfuzz/DawnLPMObjectStore.h" -#include "dawn/fuzzers/lpmfuzz/DawnLPMSerializer_autogen.h" -#include "dawn/wire/ChunkedCommandSerializer.h" -#include "dawn/wire/ObjectType_autogen.h" - -namespace dawn::wire { -void GetCustomSerializedData( - const fuzzing::Command& command, - dawn::wire::ChunkedCommandSerializer serializer, - ityp::array& gObjectStores, - DawnLPMObjectIdProvider& provider); -} - -#endif // SRC_DAWN_FUZZERS_DAWNLPMCUSTOMSERIALIZER_H_ diff --git a/src/dawn/fuzzers/lpmfuzz/dawn_custom_lpm.proto b/src/dawn/fuzzers/lpmfuzz/dawn_custom_lpm.proto deleted file mode 100644 index ed24fb8641f..00000000000 --- a/src/dawn/fuzzers/lpmfuzz/dawn_custom_lpm.proto +++ /dev/null @@ -1,42 +0,0 @@ -// Copyright 2023 The Dawn & Tint Authors -// -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are met: -// -// 1. Redistributions of source code must retain the above copyright notice, this -// list of conditions and the following disclaimer. -// -// 2. Redistributions in binary form must reproduce the above copyright notice, -// this list of conditions and the following disclaimer in the documentation -// and/or other materials provided with the distribution. -// -// 3. Neither the name of the copyright holder nor the names of its -// contributors may be used to endorse or promote products derived from -// this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" -// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -syntax = "proto2"; -package fuzzing; - -import "third_party/dawn/src/dawn/fuzzers/lpmfuzz/dawn_object_types_lpm_autogen.proto"; - -// Custom commands -message DeviceCreateShaderModule { - required uint32 self = 1; - optional bytes code = 2; -} - -message UnregisterObject { - required ObjectType objectType = 1; - required uint32 objectId = 2; -} diff --git a/src/dawn/fuzzers/lpmfuzz/dawn_lpm.json b/src/dawn/fuzzers/lpmfuzz/dawn_lpm.json deleted file mode 100644 index ec978653045..00000000000 --- a/src/dawn/fuzzers/lpmfuzz/dawn_lpm.json +++ /dev/null @@ -1,62 +0,0 @@ -{ - "_comment": [ - "Copyright 2023 The Dawn & Tint Authors", - "", - "Redistribution and use in source and binary forms, with or without", - "modification, are permitted provided that the following conditions are met:", - "", - " 1. Redistributions of source code must retain the above copyright notice, this", - " list of conditions and the following disclaimer.", - "", - " 2. Redistributions in binary form must reproduce the above copyright notice,", - " this list of conditions and the following disclaimer in the documentation", - " and/or other materials provided with the distribution.", - "", - " 3. Neither the name of the copyright holder nor the names of its", - " contributors may be used to endorse or promote products derived from", - " this software without specific prior written permission.", - " ", - "THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"", - "AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE", - "IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE", - "DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE", - "FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL", - "DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR", - "SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER", - "CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,", - "OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE", - "OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE." - ], - - "_doc": "See docs/dawn/codegen.md", - - "custom_cmds": [ - "device create shader module", - "unregister object" - ], - - "blocklisted_cmds": [ - "surface descriptor from windows core window", - "surface descriptor from windows swap chain panel", - "surface descriptor from canvas html selector", - "surface get current texture" - ], - - "lpm_info": { - "overrides": { - "instance request adapter": { - "instance id": 1 - } - }, - - "limits": { - "adapter": 2, - "bind group": 512, - "bind group layout": 512, - "device": 2, - "default": 16 - }, - - "invalid object id": 2147483647 - } -}