Merge "Simplify NN fuzz tests" am: eb644dfb0c am: f49d3c4613

Original change: https://android-review.googlesource.com/c/platform/frameworks/ml/+/1353808

Change-Id: I99937b6ac3c9b2eaf254418f471511594f60a375

5 files changed, 105 insertions, 63 deletions

diff --git a/nn/runtime/test/Android.bp b/nn/runtime/test/Android.bp
index c86c26aa1..c94abf12e 100644
--- a/nn/runtime/test/Android.bp
+++ b/nn/runtime/test/Android.bp
@@ -194,7 +194,10 @@ cc_test {
 
 cc_fuzz {
     name: "libneuralnetworks_fuzzer",
-    defaults: ["NeuralNetworksTest_default_libs"],
+    defaults: [
+        "NeuralNetworksTest_default_libs",
+        "libneuralnetworks_fuzzer_defaults",
+    ],
     owner: "google",
     fuzz_config: {
         cc: ["butlermichael@google.com"],
@@ -203,24 +206,21 @@ cc_fuzz {
         fuzz_on_haiku_device: false,
     },
     srcs: [
-        "android_fuzzing/Converter.cpp",
         "android_fuzzing/FuzzTest.cpp",
-        "android_fuzzing/StaticAssert.cpp",
     ],
-    corpus: ["android_fuzzing/corpus/*"],
-    shared_libs: ["libprotobuf-cpp-full"],
     static_libs: [
         "libneuralnetworks_common",
-        "libneuralnetworks_fuzzer_proto",
         "libneuralnetworks_generated_test_harness",
         "libneuralnetworks_static",
-        "libprotobuf-mutator",
     ],
 }
 
 cc_fuzz {
     name: "libneuralnetworks_driver_fuzzer",
-    defaults: ["NeuralNetworksTest_default_libs"],
+    defaults: [
+        "NeuralNetworksTest_default_libs",
+        "libneuralnetworks_fuzzer_defaults",
+    ],
     owner: "google",
     fuzz_config: {
         cc: ["butlermichael@google.com"],
@@ -229,19 +229,13 @@ cc_fuzz {
         fuzz_on_haiku_device: false,
     },
     srcs: [
-        "android_fuzzing/Converter.cpp",
         "android_fuzzing/DriverFuzzTest.cpp",
-        "android_fuzzing/StaticAssert.cpp",
     ],
-    corpus: ["android_fuzzing/corpus/*"],
-    shared_libs: ["libprotobuf-cpp-full"],
     static_libs: [
         "libSampleDriver",
         "libneuralnetworks_common",
-        "libneuralnetworks_fuzzer_proto",
         "libneuralnetworks_generated_test_harness",
         "libneuralnetworks_static",
-        "libprotobuf-mutator",
     ],
 }
 
diff --git a/nn/runtime/test/android_fuzzing/Android.bp b/nn/runtime/test/android_fuzzing/Android.bp
index 84e69f03d..02a32256f 100644
--- a/nn/runtime/test/android_fuzzing/Android.bp
+++ b/nn/runtime/test/android_fuzzing/Android.bp
@@ -25,6 +25,44 @@ cc_library_static {
     shared_libs: ["libprotobuf-cpp-full"],
 }
 
+cc_library_static {
+    name: "libneuralnetworks_fuzzer_harness",
+    owner: "google",
+    srcs: [
+        "Converter.cpp",
+        "FuzzHarness.cpp",
+        "StaticAssert.cpp",
+    ],
+    shared_libs: [
+        "android.hidl.memory@1.0",
+        "libhidlmemory",
+        "libnativewindow",
+        "libprotobuf-cpp-full",
+    ],
+    static_libs: [
+        "android.hardware.neuralnetworks@1.3",
+        "libneuralnetworks_common",
+        "libneuralnetworks_generated_test_harness",
+        "libneuralnetworks_static",
+    ],
+    whole_static_libs: [
+        "libneuralnetworks_fuzzer_proto",
+        "libprotobuf-mutator",
+    ],
+}
+
+filegroup {
+    name: "libneuralnetworks_fuzzer_corpus",
+    srcs: ["corpus/*"],
+}
+
+cc_defaults {
+    name: "libneuralnetworks_fuzzer_defaults",
+    shared_libs: ["libprotobuf-cpp-full"],
+    static_libs: ["libneuralnetworks_fuzzer_harness"],
+    corpus: [":libneuralnetworks_fuzzer_corpus"],
+}
+
 // The following host binary is disabled because the genrule that uses this
 // binary (below) is disabled and because this binary is 300MB large currently.
 cc_binary_host {
diff --git a/nn/runtime/test/android_fuzzing/DriverFuzzTest.cpp b/nn/runtime/test/android_fuzzing/DriverFuzzTest.cpp
index 957757560..a103728be 100644
--- a/nn/runtime/test/android_fuzzing/DriverFuzzTest.cpp
+++ b/nn/runtime/test/android_fuzzing/DriverFuzzTest.cpp
@@ -26,19 +26,14 @@
 #include <utility>
 #include <vector>
 
-#include "Converter.h"
 #include "MemoryUtils.h"
-#include "Model.pb.h"
 #include "SampleDriverFull.h"
 #include "TestHarness.h"
 #include "Utils.h"
-#include "src/libfuzzer/libfuzzer_macro.h"
 
 namespace {
 
 using ::android::hidl::memory::V1_0::IMemory;
-using ::android::nn::fuzz::convertToTestModel;
-using ::android_nn_fuzz::Test;
 using ::test_helper::TestModel;
 using namespace test_helper;
 using namespace android;
@@ -307,29 +302,9 @@ void execute(const sp<V1_3::IPreparedModel>& preparedModel, const V1_3::Request&
     preparedModel->executeSynchronously_1_3(request, V1_2::MeasureTiming::YES, {}, {}, cb);
 }
 
-bool operandOverflows(const TestOperand& operand) {
-    const auto operandType = static_cast<V1_3::OperandType>(operand.type);
-    const std::vector<uint32_t> dims = {1};
-    uint64_t product = nn::nonExtensionOperandSizeOfData(operandType, dims);
-    for (uint32_t dim : operand.dimensions) {
-        // Only check non-zero dimensions.
-        if (dim == 0) {
-            continue;
-        }
-
-        product *= dim;
-        if (product >= std::numeric_limits<uint32_t>::max()) {
-            return true;
-        }
-    }
-    return false;
-}
-
-bool shouldSkip(const TestModel& model) {
-    return std::any_of(model.main.operands.begin(), model.main.operands.end(), operandOverflows);
-}
+}  // anonymous namespace
 
-void runTest(const TestModel& testModel) {
+void nnapiFuzzTest(const TestModel& testModel) {
     // Set up device.
     const auto device = getDevice();
     CHECK(device != nullptr);
@@ -347,12 +322,3 @@ void runTest(const TestModel& testModel) {
     // Perform execution.
     execute(preparedModel, request);
 }
-
-}  // anonymous namespace
-
-DEFINE_PROTO_FUZZER(const Test& model) {
-    const TestModel testModel = convertToTestModel(model);
-    if (!shouldSkip(testModel)) {
-        runTest(testModel);
-    }
-}
diff --git a/nn/runtime/test/android_fuzzing/FuzzHarness.cpp b/nn/runtime/test/android_fuzzing/FuzzHarness.cpp
new file mode 100644
index 000000000..3d787d68f
--- /dev/null
+++ b/nn/runtime/test/android_fuzzing/FuzzHarness.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android/hardware/neuralnetworks/1.3/types.h>
+#include <src/libfuzzer/libfuzzer_macro.h>
+
+#include <algorithm>
+
+#include "Converter.h"
+#include "Model.pb.h"
+#include "TestHarness.h"
+#include "Utils.h"
+
+// Fuzz test logic. This function will either run to completion and return, or crash.
+extern void nnapiFuzzTest(const ::test_helper::TestModel& testModel);
+
+namespace {
+
+using ::android::nn::nonExtensionOperandSizeOfDataOverflowsUInt32;
+using ::android::nn::fuzz::convertToTestModel;
+using ::android::nn::hal::OperandType;
+using ::test_helper::TestModel;
+using ::test_helper::TestOperand;
+
+bool operandOverflows(const TestOperand& operand) {
+    const auto operandType = static_cast<OperandType>(operand.type);
+    return nonExtensionOperandSizeOfDataOverflowsUInt32(operandType, operand.dimensions);
+}
+
+bool shouldSkip(const TestModel& model) {
+    return std::any_of(model.main.operands.begin(), model.main.operands.end(), operandOverflows);
+}
+
+}  // namespace
+
+DEFINE_PROTO_FUZZER(const ::android_nn_fuzz::Test& model) {
+    const TestModel testModel = convertToTestModel(model);
+    if (!shouldSkip(testModel)) {
+        nnapiFuzzTest(testModel);
+    }
+}
diff --git a/nn/runtime/test/android_fuzzing/FuzzTest.cpp b/nn/runtime/test/android_fuzzing/FuzzTest.cpp
index ebf3d3ac5..a6fc108bd 100644
--- a/nn/runtime/test/android_fuzzing/FuzzTest.cpp
+++ b/nn/runtime/test/android_fuzzing/FuzzTest.cpp
@@ -20,16 +20,11 @@
 #include <optional>
 #include <utility>
 
-#include "Converter.h"
-#include "Model.pb.h"
 #include "NeuralNetworksWrapper.h"
 #include "TestHarness.h"
-#include "src/libfuzzer/libfuzzer_macro.h"
 
 namespace {
 
-using ::android::nn::fuzz::convertToTestModel;
-using ::android_nn_fuzz::Test;
 using ::test_helper::TestModel;
 using namespace ::android::nn::wrapper;
 using namespace test_helper;
@@ -130,7 +125,9 @@ std::optional<Execution> CreateExecution(const Compilation& compilation,
     return execution;
 }
 
-void runTest(const TestModel& testModel) {
+}  // anonymous namespace
+
+void nnapiFuzzTest(const TestModel& testModel) {
     // set up model
     auto model = CreateModel(testModel);
     if (!model.has_value()) {
@@ -152,10 +149,3 @@ void runTest(const TestModel& testModel) {
     // perform execution
     execution->compute();
 }
-
-}  // anonymous namespace
-
-DEFINE_PROTO_FUZZER(const Test& model) {
-    const TestModel testModel = convertToTestModel(model);
-    runTest(testModel);
-}