Fuzz AEC field trial killswitches

The fuzzer data is used to configure the field trials of the AEC.

This increases fuzzer coverage of modules/audio_processing/aec3/ by roughly 500 lines of code, ~ 3 % points increase in APM coverage for desktop Chrome.

Bug: webrtc:9413
Change-Id: Iea9059747a8492a7ca2091a359e7883750c45b27
Reviewed-on: https://webrtc-review.googlesource.com/83732
Commit-Queue: Sam Zackrisson <saza@webrtc.org>
Reviewed-by: Gustaf Ullberg <gustaf@webrtc.org>
Reviewed-by: Henrik Lundin <henrik.lundin@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#23650}

2 files changed, 42 insertions, 2 deletions

diff --git a/test/fuzzers/BUILD.gn b/test/fuzzers/BUILD.gn
index 684ce9aab7..84edd480ee 100644
--- a/test/fuzzers/BUILD.gn
+++ b/test/fuzzers/BUILD.gn
@@ -473,6 +473,7 @@ webrtc_fuzzer_test("audio_processing_fuzzer") {
     "../../modules/audio_processing/aec3",
     "../../rtc_base:rtc_base_approved",
     "../../rtc_base:safe_minmax",
+    "../../system_wrappers:field_trial_default",
   ]
   seed_corpus = "corpora/audio_processing-corpus"
 }
diff --git a/test/fuzzers/audio_processing_configs_fuzzer.cc b/test/fuzzers/audio_processing_configs_fuzzer.cc
index 5f61e00499..d0e58af5db 100644
--- a/test/fuzzers/audio_processing_configs_fuzzer.cc
+++ b/test/fuzzers/audio_processing_configs_fuzzer.cc
@@ -8,15 +8,38 @@
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
+#include <bitset>
+#include <string>
+
 #include "api/audio/echo_canceller3_factory.h"
 #include "modules/audio_processing/include/audio_processing.h"
+#include "rtc_base/arraysize.h"
 #include "rtc_base/numerics/safe_minmax.h"
+#include "system_wrappers/include/field_trial_default.h"
 #include "test/fuzzers/audio_processing_fuzzer_helper.h"
 #include "test/fuzzers/fuzz_data_helper.h"
 
 namespace webrtc {
 namespace {
-std::unique_ptr<AudioProcessing> CreateApm(test::FuzzDataHelper* fuzz_data) {
+
+const std::string kFieldTrialNames[] = {
+    "WebRTC-Aec3TransparentModeKillSwitch",
+    "WebRTC-Aec3StationaryRenderImprovementsKillSwitch",
+    "WebRTC-Aec3EnforceDelayAfterRealignmentKillSwitch",
+    "WebRTC-Aec3UseShortDelayEstimatorWindow",
+    "WebRTC-Aec3ReverbBasedOnRenderKillSwitch",
+    "WebRTC-Aec3ReverbModellingKillSwitch",
+    "WebRTC-Aec3FilterAnalyzerPreprocessorKillSwitch",
+    "WebRTC-Aec3TransparencyImprovementsKillSwitch",
+    "WebRTC-Aec3SoftTransparentModeKillSwitch",
+    "WebRTC-Aec3OverrideEchoPathGainKillSwitch",
+    "WebRTC-Aec3ZeroExternalDelayHeadroomKillSwitch",
+    "WebRTC-Aec3DownSamplingFactor8KillSwitch",
+    "WebRTC-Aec3EnforceSkewHysteresis1",
+    "WebRTC-Aec3EnforceSkewHysteresis2"};
+
+std::unique_ptr<AudioProcessing> CreateApm(test::FuzzDataHelper* fuzz_data,
+                                           std::string* field_trial_string) {
   // Parse boolean values for optionally enabling different
   // configurable public components of APM.
   bool exp_agc = fuzz_data->ReadOrDefaultValue(true);
@@ -43,6 +66,19 @@ std::unique_ptr<AudioProcessing> CreateApm(test::FuzzDataHelper* fuzz_data) {
   const float gain_controller2_gain_db =
       rtc::SafeClamp<int>(fuzz_data->ReadOrDefaultValue<int8_t>(0), -50, 50);
 
+  constexpr size_t kNumFieldTrials = arraysize(kFieldTrialNames);
+  // This check ensures the uint16_t that is read has enough bits to cover all
+  // the field trials.
+  RTC_DCHECK_LE(kNumFieldTrials, 16);
+  std::bitset<kNumFieldTrials> field_trial_bitmask(
+      fuzz_data->ReadOrDefaultValue<uint16_t>(0));
+  for (size_t i = 0; i < kNumFieldTrials; ++i) {
+    if (field_trial_bitmask[i]) {
+      *field_trial_string += kFieldTrialNames[i] + "/Enabled/";
+    }
+  }
+  field_trial::InitFieldTrialsFromString(field_trial_string->c_str());
+
   // Ignore a few bytes. Bytes from this segment will be used for
   // future config flag changes. We assume 40 bytes is enough for
   // configuring the APM.
@@ -103,7 +139,10 @@ std::unique_ptr<AudioProcessing> CreateApm(test::FuzzDataHelper* fuzz_data) {
 
 void FuzzOneInput(const uint8_t* data, size_t size) {
   test::FuzzDataHelper fuzz_data(rtc::ArrayView<const uint8_t>(data, size));
-  auto apm = CreateApm(&fuzz_data);
+  // This string must be in scope during execution, according to documentation
+  // for field_trial_default.h. Hence it's created here and not in CreateApm.
+  std::string field_trial_string = "";
+  auto apm = CreateApm(&fuzz_data, &field_trial_string);
 
   if (apm) {
     FuzzAudioProcessing(&fuzz_data, std::move(apm));