Add SkSL2Pipeline fuzzer

Bug: skia:8876
Change-Id: Ib62da438dec493536c7351eb0c4a06a0275833b4
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/201645
Commit-Queue: Kevin Lubick <kjlubick@google.com>
Reviewed-by: Ethan Nicholas <ethannicholas@google.com>

2 files changed, 54 insertions, 0 deletions

diff --git a/fuzz/FuzzMain.cpp b/fuzz/FuzzMain.cpp
index 970614a14f..a395b8606d 100644
--- a/fuzz/FuzzMain.cpp
+++ b/fuzz/FuzzMain.cpp
@@ -57,6 +57,7 @@ static constexpr char g_type_message[] = "How to interpret --bytes, one of:\n"
                                          "skp\n"
                                          "sksl2glsl\n"
                                          "sksl2metal\n"
+                                         "sksl2pipeline\n"
                                          "sksl2spirv\n"
 #if defined(SK_ENABLE_SKOTTIE)
                                          "skottie_json\n"
@@ -85,6 +86,7 @@ static void fuzz_skp(sk_sp<SkData>);
 static void fuzz_sksl2glsl(sk_sp<SkData>);
 static void fuzz_sksl2metal(sk_sp<SkData>);
 static void fuzz_sksl2spirv(sk_sp<SkData>);
+static void fuzz_sksl2pipeline(sk_sp<SkData>);
 static void fuzz_textblob_deserialize(sk_sp<SkData>);
 
 static void print_api_names();
@@ -216,6 +218,10 @@ static int fuzz_file(SkString path, SkString type) {
         fuzz_sksl2spirv(bytes);
         return 0;
     }
+    if (type.equals("sksl2pipeline")) {
+        fuzz_sksl2pipeline(bytes);
+        return 0;
+    }
     if (type.equals("textblob")) {
         fuzz_textblob_deserialize(bytes);
         return 0;
@@ -256,6 +262,7 @@ static std::map<std::string, std::string> cf_map = {
     {"sksl2glsl", "sksl2glsl"},
     {"sksl2metal", "sksl2metal"},
     {"sksl2spirv", "sksl2spirv"},
+    {"sksl2pipeline", "sksl2pipeline"},
 #if defined(SK_ENABLE_SKOTTIE)
     {"skottie_json", "skottie_json"},
 #endif
@@ -741,3 +748,13 @@ static void fuzz_sksl2metal(sk_sp<SkData> bytes) {
         SkDebugf("[terminated] Could not compile input to Metal.\n");
     }
 }
+
+bool FuzzSKSL2Pipeline(sk_sp<SkData> bytes);
+
+static void fuzz_sksl2pipeline(sk_sp<SkData> bytes) {
+    if (FuzzSKSL2Pipeline(bytes)) {
+        SkDebugf("[terminated] Success! Compiled input to pipeline stage.\n");
+    } else {
+        SkDebugf("[terminated] Could not compile input to pipeline stage.\n");
+    }
+}
diff --git a/fuzz/oss_fuzz/FuzzSKSL2Pipeline.cpp b/fuzz/oss_fuzz/FuzzSKSL2Pipeline.cpp
new file mode 100644
index 0000000000..cc980f7c7f
--- /dev/null
+++ b/fuzz/oss_fuzz/FuzzSKSL2Pipeline.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright 2019 Google, LLC
+ *
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+#include "GrShaderCaps.h"
+#include "SkSLCompiler.h"
+
+#include "../Fuzz.h"
+
+bool FuzzSKSL2Pipeline(sk_sp<SkData> bytes) {
+    SkSL::Compiler compiler;
+    SkSL::String output;
+    SkSL::Program::Settings settings;
+    sk_sp<GrShaderCaps> caps = SkSL::ShaderCapsFactory::Default();
+    settings.fCaps = caps.get();
+    std::unique_ptr<SkSL::Program> program = compiler.convertProgram(
+                                                    SkSL::Program::kPipelineStage_Kind,
+                                                    SkSL::String((const char*) bytes->data(),
+                                                                 bytes->size()),
+                                                    settings);
+    std::vector<SkSL::Compiler::FormatArg> formatArgs;
+    if (!program || !compiler.toPipelineStage(*program, &output, &formatArgs)) {
+        return false;
+    }
+    return true;
+}
+
+#if defined(IS_FUZZING_WITH_LIBFUZZER)
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    auto bytes = SkData::MakeWithoutCopy(data, size);
+    FuzzSKSL2Pipeline(bytes);
+    return 0;
+}
+#endif