blob: d8d6550fb1f21613a8a36ef23992bd75d09063b8 [file] [log] [blame]
// Copyright 2021 The Tint Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#include <memory>
#include <string>
#include "src/tint/fuzzers/tint_spirv_tools_fuzzer/cli.h"
#include "src/tint/fuzzers/tint_spirv_tools_fuzzer/mutator.h"
#include "src/tint/fuzzers/tint_spirv_tools_fuzzer/spirv_fuzz_mutator.h"
#include "src/tint/fuzzers/tint_spirv_tools_fuzzer/spirv_opt_mutator.h"
#include "src/tint/fuzzers/tint_spirv_tools_fuzzer/spirv_reduce_mutator.h"
#include "src/tint/fuzzers/tint_spirv_tools_fuzzer/util.h"
/// This tool is used to debug *mutators*. It uses CLI arguments similar to the
/// ones used by the fuzzer. To debug some mutator you just need to specify the
/// mutator type, the seed and the path to the SPIR-V binary that triggered the
/// error. This tool will run the mutator on the binary until the error is
/// produced or the mutator returns `kLimitReached`.
///
/// Note that this is different from debugging the fuzzer by specifying input
/// files to test. The difference is that the latter will not execute any
/// mutator (it will only run the LLVMFuzzerTestOneInput function) whereas this
/// tool is useful when one of the spirv-tools mutators crashes or produces an
/// invalid binary in LLVMFuzzerCustomMutator.
int main(int argc, const char** argv) {
auto params = tint::fuzzers::spvtools_fuzzer::ParseMutatorDebuggerCliParams(argc, argv);
std::unique_ptr<tint::fuzzers::spvtools_fuzzer::Mutator> mutator;
const auto& mutator_params = params.mutator_params;
switch (params.mutator_type) {
case tint::fuzzers::spvtools_fuzzer::MutatorType::kFuzz:
mutator = std::make_unique<tint::fuzzers::spvtools_fuzzer::SpirvFuzzMutator>(
mutator_params.target_env, params.original_binary, params.seed,
mutator_params.donors, mutator_params.enable_all_fuzzer_passes,
mutator_params.repeated_pass_strategy,
mutator_params.validate_after_each_fuzzer_pass,
mutator_params.transformation_batch_size);
break;
case tint::fuzzers::spvtools_fuzzer::MutatorType::kReduce:
mutator = std::make_unique<tint::fuzzers::spvtools_fuzzer::SpirvReduceMutator>(
mutator_params.target_env, params.original_binary, params.seed,
mutator_params.reduction_batch_size, mutator_params.enable_all_reduce_passes,
mutator_params.validate_after_each_reduce_pass);
break;
case tint::fuzzers::spvtools_fuzzer::MutatorType::kOpt:
mutator = std::make_unique<tint::fuzzers::spvtools_fuzzer::SpirvOptMutator>(
mutator_params.target_env, params.seed, params.original_binary,
mutator_params.validate_after_each_opt_pass, mutator_params.opt_batch_size);
break;
default:
assert(false && "All mutator types must've been handled");
return 1;
}
while (true) {
auto result = mutator->Mutate();
if (result.GetStatus() == tint::fuzzers::spvtools_fuzzer::Mutator::Status::kInvalid) {
std::cerr << mutator->GetErrors() << std::endl;
return 0;
}
if (result.GetStatus() == tint::fuzzers::spvtools_fuzzer::Mutator::Status::kLimitReached) {
break;
}
}
}