viz: Add MojoLPM fuzzer for CompositorFrameSink::SubmitCompositorFrame
Adds a libFuzzer target that drives the renderer->Viz CompositorFrameSink
interface (SubmitCompositorFrame, declared [UnlimitedSize] in the mojom)
against a real CompositorFrameSinkSupport backed by a FrameSinkManagerImpl,
so the full CompositorFrame StructTraits::Read + MaybeSubmitCompositorFrame
surface-activation / resource-refcount path is exercised from attacker-shaped
input. No existing in-tree fuzzer covers this surface (hit_test_manager_fuzzer
only submits a fixed MakeDefaultCompositorFrame).
Bug: none
Test: built with is_asan=true use_libfuzzer=true enable_mojom_fuzzer=true; the
seed corpus drives the deserialize + activation path and smoke-runs with no
crashes.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
viz: Add MojoLPM fuzzer for CompositorFrameSink::SubmitCompositorFrame
Adds a libFuzzer target that drives the renderer->Viz CompositorFrameSink
interface (SubmitCompositorFrame, declared [UnlimitedSize] in the mojom)
against a real CompositorFrameSinkSupport backed by a FrameSinkManagerImpl,
so the full CompositorFrame StructTraits::Read + MaybeSubmitCompositorFrame
surface-activation / resource-refcount path is exercised from attacker-shaped
input. No existing in-tree fuzzer covers this surface (hit_test_manager_fuzzer
only submits a fixed MakeDefaultCompositorFrame).
Bug: none
Test: built with is_asan=true use_libfuzzer=true enable_mojom_fuzzer=true; the
seed corpus drives the deserialize + activation path and smoke-runs with no
crashes.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
ᄋᄋ abandoned this change.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
New libFuzzer target driving viz.mojom.CompositorFrameSink::SubmitCompositorFrame (the full CompositorFrame StructTraits::Read + MaybeSubmitCompositorFrame activation path) via a real CompositorFrameSinkSupport. No existing fuzzer exercises an attacker-shaped frame (hit_test_manager_fuzzer only submits a fixed MakeDefaultCompositorFrame). PTAL. Part of a 4-CL fuzzer suite (gpu crrev.com/c/7976442, viz /7977564, media /7976699, network /7976700). First-time external contributor -- happy to adjust to conventions.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
// compositor_frame_sink_support.cc:772 and reach the deeper servicePutting line numbers in comments will get out of date really quickly
u->mutable_new_();should this be a return or am I missing some subtlety
if (!new_pass->has_m_quad_list()) {Not sure if we also want to clamp (or if we generate) the shared quad state list
ack->set_m_sequence_number(1);It seems like we always just want to generate a new compositor frame with a new render pass etc based on the fuzzer input. It's unclear to me what the AsFreshOrNull does or why we need it
class FrameSinkFuzzerHarness {Is it possible for this fuzzer to span several files? Not sure of any precedents
(void)support->MaybeSubmitCompositorFrame(std::ignore = ...
(void)support->DidNotProduceFrame(ack);same
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
// compositor_frame_sink_support.cc:772 and reach the deeper servicePutting line numbers in comments will get out of date really quickly
Done -- removed every source-line-number citation from the comments here and in the .proto, now phrased by symbol/concept instead.
should this be a return or am I missing some subtlety
Made it a direct `return u->mutable_new_();`. No subtlety lost: mutable_new_() switches the union to the kNew arm, so the old code already fell through the next guard and returned the same pointer -- this just makes it explicit.
Not sure if we also want to clamp (or if we generate) the shared quad state list
No separate clamp needed; documented inline. The mojom render pass carries only quad_list; each DrawQuad has an optional inline sqs and the traits rebuild the C++ shared_quad_state_list at most one-per-quad, so the quad clamp already bounds the SQS count.
It seems like we always just want to generate a new compositor frame with a new render pass etc based on the fuzzer input. It's unclear to me what the AsFreshOrNull does or why we need it
Agreed -- dropped the AsFreshOrNull indirection for the top-level frame. ShapeCompositorFrame now unconditionally calls mutable_new_(), so a fresh frame is always built from the input (an 'old' back-reference is cleared; an existing 'new' arm's fields are preserved). Verified the seed still drives a real SubmitCompositorFrame (ft 3330).
Is it possible for this fuzzer to span several files? Not sure of any precedents
There is precedent (ad_auction_service_mojolpm_fuzzer compiles a stringifiers .cc/.h in the same target; content/test/fuzzer shares mojolpm support source_sets). This file is ~400 LOC and self-contained, so I kept it single-file for now -- happy to split if you'd prefer.
(void)support->MaybeSubmitCompositorFrame(ᄋᄋstd::ignore = ...
Done -- `std::ignore = support->MaybeSubmitCompositorFrame(...)` (added #include <tuple>).
(void)support->DidNotProduceFrame(ack);ᄋᄋsame
Done -- `std::ignore = support->DidNotProduceFrame(ack)` as above.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Thanks for the careful review, Vladimir -- all seven addressed in PS2.
PTAL.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
PS3: comment-only cleanup. Removed an accessor-verification banner and a couple of stale section dividers and tightened the wording; no code change. Sorry for bumping the +1, PTAL.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Thanks Vladimir. This is approved and sits on top of the gpu CL 7976442 in the chain, so it's ready to land once that one goes in.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Small cleanup to match the rest of the chain: removed InitGoogleTest and switched the static environment to base::NoDestructor. No functional change, sorry for clearing the +1. PTAL.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Code-Review | +1 |
LGTM as well, thanks for working on it!
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
All threads resolved, Code-Review+1 from Vladimir Levin and Saifuddin Hitawala. This CL is submittable. As a first-time contributor I cannot set Commit-Queue myself — could a committer please trigger CQ? This is the top of a chain: viz → media → network, all three approved.
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
| Commit-Queue | +2 |
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |