Add gpu_angle_passthrough_fuzzer.

gpu/command_buffer/tests/fuzzer_main.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include <stddef.h>
 #include <stdint.h>
 
 #include <memory>
 #include <vector>
 
 #include "base/at_exit.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/memory/ref_counted.h"
 #include "build/build_config.h"
 #include "gpu/command_buffer/common/constants.h"
 #include "gpu/command_buffer/common/gles2_cmd_utils.h"
 #include "gpu/command_buffer/common/sync_token.h"
 #include "gpu/command_buffer/service/buffer_manager.h"
 #include "gpu/command_buffer/service/command_buffer_service.h"
 #include "gpu/command_buffer/service/command_executor.h"
 #include "gpu/command_buffer/service/context_group.h"
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
+#include "gpu/command_buffer/service/gpu_switches.h"
 #include "gpu/command_buffer/service/logger.h"
 #include "gpu/command_buffer/service/mailbox_manager_impl.h"
 #include "gpu/command_buffer/service/sync_point_manager.h"
 #include "gpu/command_buffer/service/transfer_buffer_manager.h"
 #include "ui/gfx/geometry/size.h"
 #include "ui/gl/gl_context.h"
 #include "ui/gl/gl_context_egl.h"
 #include "ui/gl/gl_context_stub.h"
 #include "ui/gl/gl_image_ref_counted_memory.h"
 #include "ui/gl/gl_share_group.h"
@@ skipping 54 matching lines @@
   CommandBufferSetup()
       : atexit_manager_(),
         sync_point_manager_(new SyncPointManager(false)),
         sync_point_order_data_(SyncPointOrderData::Create()),
         mailbox_manager_(new gles2::MailboxManagerImpl),
         share_group_(new gl::GLShareGroup),
         command_buffer_id_(CommandBufferId::FromUnsafeValue(1)) {
     logging::SetMinLogLevel(logging::LOG_FATAL);
     base::CommandLine::Init(0, NULL);
 
+    auto* command_line = base::CommandLine::ForCurrentProcess();
+    (void)command_line;

[piman, 2017/03/09 18:15:13]

nit: ALLOW_UNUSED_LOCAL

[Geoff Lang, 2017/03/09 19:29:10]

Done.

+
+#if defined(GPU_FUZZER_USE_PASSTHROUGH_CMD_DECODER)
+    command_line->AppendSwitch(switches::kUsePassthroughCmdDecoder);
+    gpu_preferences_.use_passthrough_cmd_decoder = true;
+#endif
+
 #if defined(GPU_FUZZER_USE_ANGLE)
-    auto* command_line = base::CommandLine::ForCurrentProcess();
     command_line->AppendSwitchASCII(switches::kUseGL,
                                     gl::kGLImplementationANGLEName);
     command_line->AppendSwitchASCII(switches::kUseANGLE,
                                     gl::kANGLEImplementationNullName);
     gl::init::InitializeGLOneOffImplementation(gl::kGLImplementationEGLGLES2,
                                                false, false, false);
+#else
+    gl::GLSurfaceTestSupport::InitializeOneOffWithMockBindings();
+#endif
+
+    sync_point_client_ = sync_point_manager_->CreateSyncPointClient(
+        sync_point_order_data_, CommandBufferNamespace::IN_PROCESS,
+        command_buffer_id_);
+
+    translator_cache_ = new gles2::ShaderTranslatorCache(gpu_preferences_);
+    completeness_cache_ = new gles2::FramebufferCompletenessCache;
+
+    InitDecoder();
+  }
+
+  void InitDecoder() {
+    if (decoder_initialized_) {
+      return;
+    }
+
+#if defined(GPU_FUZZER_USE_ANGLE)
     surface_ = new gl::PbufferGLSurfaceEGL(gfx::Size());
     surface_->Initialize();
 
     context_ = new gl::GLContextEGL(share_group_.get());
     context_->Initialize(surface_.get(), gl::GLContextAttribs());

[piman, 2017/03/09 18:15:13]

Did you intend to recreate the context on every test string run? It feels
heavyweight. Does it make a measurable difference on the execution rate?

[Geoff Lang, 2017/03/09 19:29:10]

Yea, it didn't seem to have too much of an effect on the runtime but I don't
have the numbers on hand so I'll re-verify when I get back to the office.  The
problem was that I encountered a fuzzer failure that was not reproducible with
the test case that the fuzzer gave because it depended on prior state of the
context.

 #else
     surface_ = new gl::GLSurfaceStub;
     scoped_refptr<gl::GLContextStub> context_stub =
         new gl::GLContextStub(share_group_.get());
     context_stub->SetGLVersionString("OpenGL ES 3.1");
     context_stub->SetExtensionsString(kExtensions);
     context_stub->SetUseStubApi(true);
     context_ = context_stub;
-    gl::GLSurfaceTestSupport::InitializeOneOffWithMockBindings();
 #endif
 
-    sync_point_client_ = sync_point_manager_->CreateSyncPointClient(
-        sync_point_order_data_, CommandBufferNamespace::IN_PROCESS,
-        command_buffer_id_);
-
-    translator_cache_ = new gles2::ShaderTranslatorCache(gpu_preferences_);
-    completeness_cache_ = new gles2::FramebufferCompletenessCache;
-  }
-
-  void InitDecoder() {
     context_->MakeCurrent(surface_.get());
     scoped_refptr<gles2::FeatureInfo> feature_info =
         new gles2::FeatureInfo();
     scoped_refptr<gles2::ContextGroup> context_group = new gles2::ContextGroup(
         gpu_preferences_, mailbox_manager_.get(), nullptr, translator_cache_,
         completeness_cache_, feature_info, true /* bind_generates_resource */,
         nullptr /* image_factory */, nullptr /* progress_reporter */);
     command_buffer_.reset(
         new CommandBufferService(context_group->transfer_buffer_manager()));
     command_buffer_->SetPutOffsetChangeCallback(
@@ skipping 28 matching lines @@
     CHECK(result);
     decoder_->set_max_bucket_size(8 << 20);
     context_group->buffer_manager()->set_max_buffer_size(8 << 20);
     if (!vertex_translator_) {
       // Keep a reference to the translators, which keeps them in the cache even
       // after the decoder is reset. They are expensive to initialize, but they
       // don't keep state.
       vertex_translator_ = decoder_->GetTranslator(GL_VERTEX_SHADER);
       fragment_translator_ = decoder_->GetTranslator(GL_FRAGMENT_SHADER);
     }
+
+    decoder_initialized_ = true;

[piman, 2017/03/09 18:15:13]

Why the need for this? Before this change, we initialize and reset in
RunCommandBuffer. Here you added a call to InitDecoder in the constructor, but
it seems redundant with the one in RunCommandBuffer.

[Geoff Lang, 2017/03/09 19:29:10]

I added this due to the comment referenced below.  It looks like there were
issues when the context was not initialized before the first run because some of
the sanitizers require that the ANGLE DLLs are loaded first.  The decoder is now
initialized in the constructor when it wasn't before but shouldn't be re-created
redundantly because of the early-out check at the top of InitDecoder.

[piman, 2017/03/09 22:12:35]

Right, the important part is that the ANGLE DLL is loaded, and as long as
InitializeGLOneOffImplementation is called in the constructor, that should be
enough. So I think, even if we move the context creation to InitDecoder, we
don't need to call that in the constructor, and then shouldn't need this bool
and related functionality.

[Geoff Lang, 2017/03/09 22:22:13]

Sounds good, I'll update that when I get back to Montreal.

[Geoff Lang, 2017/03/16 17:22:08]

Done, I also updated it to only re-create the context for the passthrough fuzzer
so there are no performance issues.

   }
 
   void ResetDecoder() {
+    if (!decoder_initialized_) {
+      return;
+    }
+
     decoder_->Destroy(true);
     decoder_.reset();
     command_buffer_.reset();
+    surface_ = nullptr;
+    context_->ReleaseCurrent(nullptr);
+    context_ = nullptr;
+
+    decoder_initialized_ = false;
   }
 
   ~CommandBufferSetup() {
+    ResetDecoder();
     sync_point_client_ = nullptr;
     if (sync_point_order_data_) {
       sync_point_order_data_->Destroy();
       sync_point_order_data_ = nullptr;
     }
   }
 
   void RunCommandBuffer(const uint8_t* data, size_t size) {
     // The commands are flushed at a uint32_t granularity. If the data is not
     // a full command, we zero-pad it.
@@ skipping 82 matching lines @@
 
   GpuPreferences gpu_preferences_;
 
   std::unique_ptr<SyncPointManager> sync_point_manager_;
   scoped_refptr<SyncPointOrderData> sync_point_order_data_;
   std::unique_ptr<SyncPointClient> sync_point_client_;
   scoped_refptr<gles2::MailboxManager> mailbox_manager_;
   scoped_refptr<gl::GLShareGroup> share_group_;
   const gpu::CommandBufferId command_buffer_id_;
 
+  bool decoder_initialized_ = false;
+
   scoped_refptr<gl::GLSurface> surface_;
   scoped_refptr<gl::GLContext> context_;
 
   scoped_refptr<gles2::ShaderTranslatorCache> translator_cache_;
   scoped_refptr<gles2::FramebufferCompletenessCache> completeness_cache_;
 
   std::unique_ptr<CommandBufferService> command_buffer_;
 
   std::unique_ptr<gles2::GLES2Decoder> decoder_;
   std::unique_ptr<CommandExecutor> executor_;
 
   scoped_refptr<gles2::ShaderTranslatorInterface> vertex_translator_;
   scoped_refptr<gles2::ShaderTranslatorInterface> fragment_translator_;
 
   scoped_refptr<Buffer> buffer_;
   int32_t buffer_id_ = 0;
 };
 
 // Intentionally leaked because asan tries to exit cleanly after a crash, but
 // the decoder is usually in a bad state at that point.
 // We need to load ANGLE libraries before the fuzzer infrastructure starts,
 // because it gets confused about new coverage counters being dynamically
 // registered, causing crashes.
 CommandBufferSetup* g_setup = new CommandBufferSetup();

[Geoff Lang, 2017/03/09 19:29:10]

ref

 
 }  // anonymous namespace
 }  // namespace gpu
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   gpu::g_setup->RunCommandBuffer(data, size);
   return 0;
 }