[tint][fuzz][ir] Add BuiltinPolyfill fuzzer

Bug: tint:2223
Change-Id: Ia055841fdaeb2660136f75c1340aebe7cb7fbcae
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/185111
Reviewed-by: James Price <jrprice@google.com>
Commit-Queue: Ben Clayton <bclayton@google.com>
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
diff --git a/src/tint/lang/core/ir/transform/BUILD.cmake b/src/tint/lang/core/ir/transform/BUILD.cmake
index a81c7ec..f06f94d 100644
--- a/src/tint/lang/core/ir/transform/BUILD.cmake
+++ b/src/tint/lang/core/ir/transform/BUILD.cmake
@@ -190,6 +190,7 @@
   lang/core/ir/transform/binary_polyfill_fuzz.cc
   lang/core/ir/transform/binding_remapper_fuzz.cc
   lang/core/ir/transform/block_decorated_structs_fuzz.cc
+  lang/core/ir/transform/builtin_polyfill_fuzz.cc
 )
 
 tint_target_add_dependencies(tint_lang_core_ir_transform_fuzz fuzz
diff --git a/src/tint/lang/core/ir/transform/BUILD.gn b/src/tint/lang/core/ir/transform/BUILD.gn
index 79f72d2..8e2c57c 100644
--- a/src/tint/lang/core/ir/transform/BUILD.gn
+++ b/src/tint/lang/core/ir/transform/BUILD.gn
@@ -183,6 +183,7 @@
     "binary_polyfill_fuzz.cc",
     "binding_remapper_fuzz.cc",
     "block_decorated_structs_fuzz.cc",
+    "builtin_polyfill_fuzz.cc",
   ]
   deps = [
     "${tint_src_dir}/api/common",
diff --git a/src/tint/lang/core/ir/transform/builtin_polyfill.h b/src/tint/lang/core/ir/transform/builtin_polyfill.h
index 13ac4fe..9795a9c 100644
--- a/src/tint/lang/core/ir/transform/builtin_polyfill.h
+++ b/src/tint/lang/core/ir/transform/builtin_polyfill.h
@@ -30,6 +30,7 @@
 
 #include <string>
 
+#include "src/tint/utils/reflection/reflection.h"
 #include "src/tint/utils/result/result.h"
 
 // Forward declarations.
@@ -77,6 +78,21 @@
     /// Should `pack4xU8Clamp()` be polyfilled?
     /// TODO(tint:1497): remove the option once the bug in DXC is fixed.
     bool pack_4xu8_clamp = false;
+
+    /// Reflection for this class
+    TINT_REFLECT(BuiltinPolyfillConfig,
+                 clamp_int,
+                 count_leading_zeros,
+                 count_trailing_zeros,
+                 extract_bits,
+                 first_leading_bit,
+                 first_trailing_bit,
+                 insert_bits,
+                 saturate,
+                 texture_sample_base_clamp_to_edge_2d_f32,
+                 dot_4x8_packed,
+                 pack_unpack_4x8,
+                 pack_4xu8_clamp);
 };
 
 /// BuiltinPolyfill is a transform that replaces calls to builtin functions and uses of other core
@@ -88,4 +104,11 @@
 
 }  // namespace tint::core::ir::transform
 
+namespace tint {
+
+/// Reflection for BuiltinPolyfillLevel
+TINT_REFLECT_ENUM_RANGE(tint::core::ir::transform::BuiltinPolyfillLevel, kNone, kFull);
+
+}  // namespace tint
+
 #endif  // SRC_TINT_LANG_CORE_IR_TRANSFORM_BUILTIN_POLYFILL_H_
diff --git a/src/tint/lang/core/ir/transform/builtin_polyfill_fuzz.cc b/src/tint/lang/core/ir/transform/builtin_polyfill_fuzz.cc
new file mode 100644
index 0000000..298bbaa
--- /dev/null
+++ b/src/tint/lang/core/ir/transform/builtin_polyfill_fuzz.cc
@@ -0,0 +1,50 @@
+// Copyright 2024 The Dawn & Tint Authors
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its
+//    contributors may be used to endorse or promote products derived from
+//    this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "src/tint/lang/core/ir/transform/builtin_polyfill.h"
+
+#include "src/tint/cmd/fuzz/ir/fuzz.h"
+#include "src/tint/lang/core/ir/validator.h"
+
+namespace tint::core::ir::transform {
+namespace {
+
+void BuiltinPolyfillFuzzer(Module& module, BuiltinPolyfillConfig config) {
+    if (auto res = BuiltinPolyfill(module, config); res != Success) {
+        return;
+    }
+
+    Capabilities capabilities;
+    if (auto res = Validate(module, capabilities); res != Success) {
+        TINT_ICE() << "result of BuiltinPolyfill failed IR validation\n" << res.Failure();
+    }
+}
+
+}  // namespace
+}  // namespace tint::core::ir::transform
+
+TINT_IR_MODULE_FUZZER(tint::core::ir::transform::BuiltinPolyfillFuzzer);