tint IR fuzzer: run DXC against generated HLSL

Bug: 380270956 Change-Id: I48751593f701ea42456bd7330aa3fb23dddabf95 Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/218714 Reviewed-by: James Price <[email protected]> Commit-Queue: Antonio Maiorano <[email protected]>
google · Dec 9, 2024 · 67e21d0 · 67e21d0
1 parent aebf760
commit 67e21d0
Show file tree

Hide file tree

Showing 5 changed files with 23 additions and 5 deletions.
diff --git a/src/tint/cmd/fuzz/ir/fuzz.cc b/src/tint/cmd/fuzz/ir/fuzz.cc
@@ -93,6 +93,7 @@ void Register(const IRFuzzer& fuzzer) {
             ir_context.options.filter = context.options.filter;
             ir_context.options.run_concurrently = context.options.run_concurrently;
             ir_context.options.verbose = context.options.verbose;
+            ir_context.options.dxc = context.options.dxc;
             ir_context.options.dump = context.options.dump;
             [[maybe_unused]] auto result = fn(ir.Get(), ir_context, data);
         },

diff --git a/src/tint/cmd/fuzz/ir/fuzz.h b/src/tint/cmd/fuzz/ir/fuzz.h
@@ -53,6 +53,8 @@ struct Options {
     bool run_concurrently = false;
     /// If true, print the fuzzer name to stdout before running.
     bool verbose = false;
+    /// If not empty, load DXC from this path when fuzzing HLSL generation.
+    std::string dxc;
     /// If true, dump shader input/output text to stdout
     bool dump = false;
 };

diff --git a/src/tint/cmd/fuzz/wgsl/fuzz.cc b/src/tint/cmd/fuzz/wgsl/fuzz.cc
@@ -150,7 +150,7 @@ void Run(std::string_view wgsl, const Options& options, Slice<const std::byte> d
 #endif
 
     if (options.dump) {
-        std::cout << "Dumping input WGSL:\n" << wgsl << std::endl;
+        std::cout << "Dumping input WGSL:\n" << wgsl << "\n";
     }
 
     // Ensure that fuzzers are sorted. Without this, the fuzzers may be registered in any order,

diff --git a/src/tint/cmd/fuzz/wgsl/fuzz.h b/src/tint/cmd/fuzz/wgsl/fuzz.h
@@ -49,8 +49,7 @@ struct Options {
     bool run_concurrently = false;
     /// If true, print the fuzzer name to stdout before running.
     bool verbose = false;
-    /// If not empty, load DXC from this path when fuzzing HLSL generation, and fail the fuzzer if
-    /// not found, or if DXC fails to compile.
+    /// If not empty, load DXC from this path when fuzzing HLSL generation.
     std::string dxc;
     /// If true, dump shader input/output text to stdout
     bool dump = false;

diff --git a/src/tint/lang/hlsl/writer/writer_fuzz.cc b/src/tint/lang/hlsl/writer/writer_fuzz.cc
@@ -32,9 +32,10 @@
 #include "src/tint/lang/core/ir/var.h"
 #include "src/tint/lang/core/type/input_attachment.h"
 #include "src/tint/lang/core/type/pointer.h"
+#include "src/tint/lang/hlsl/validate/validate.h"
 #include "src/tint/lang/hlsl/writer/helpers/generate_bindings.h"
 #include "src/tint/lang/hlsl/writer/writer.h"
-
+#include "src/tint/utils/command/command.h"
 namespace tint::hlsl::writer {
 namespace {
 
@@ -115,7 +116,22 @@ Result<SuccessType> IRFuzzer(core::ir::Module& module,
     if (output == Success && context.options.dump) {
         std::cout << "Dumping generated HLSL:\n" << output->hlsl << "\n";
     }
-    // TODO(42251292): Fuzz DXC with HLSL output
+
+    // Run DXC against generated HLSL in order to fuzz it. Note that we ignore whether it succeeds
+    // as DXC may fail on valid HLSL emitted by Tint. For example: post optimization infinite loops
+    // will fail to compile, but these are beyond Tint's analysis capabilities.
+    const char* dxc_path = validate::kDxcDLLName;
+    if (!context.options.dxc.empty()) {
+        dxc_path = context.options.dxc.c_str();
+    }
+    auto dxc = tint::Command::LookPath(dxc_path);
+    if (dxc.Found()) {
+        uint32_t hlsl_shader_model = 66;
+        bool require_16bit_types = true;
+        [[maybe_unused]] auto validate_res = validate::ValidateUsingDXC(
+            dxc.Path(), output->hlsl, output->entry_points, require_16bit_types, hlsl_shader_model);
+    }
+
     return Success;
 }