Arbitrary IR fuzzing

Cargo.toml

@@ -14,10 +14,12 @@ resolver = "2"
 [package.metadata.docs.rs]
 all-features = true
 
-[dependencies]
 # MSRV warnings:
 # - bitflags 1.3 requires Rust-1.46
 # - indexmap 1.7 requires Rust-1.49
+
+[dependencies]
+arbitrary = { version = "1", features = ["derive"], optional = true }
 bitflags = "1"
 bit-set = "0.5"
 codespan-reporting = { version = "0.11.0", optional = true }

fuzz/Cargo.toml

@@ -14,7 +14,7 @@ libfuzzer-sys = "0.4"
 
 [dependencies.naga]
 path = ".."
-features = ["spv-in", "wgsl-in", "glsl-in"]
+features = ["arbitrary", "spv-in", "wgsl-in", "glsl-in", "validate"]
 
 # Prevent this from interfering with workspaces
 [workspace]
@@ -37,3 +37,9 @@ name = "glsl_parser"
 path = "fuzz_targets/glsl_parser.rs"
 test = false
 doc = false
+
+[[bin]]
+name = "ir"
+path = "fuzz_targets/ir.rs"
+test = false
+doc = false

fuzz/fuzz_targets/ir.rs

@@ -0,0 +1,10 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|module: naga::Module| {
+    use naga::valid as v;
+    // Check if the module validates without errors.
+    //TODO: may also fuzz the flags and capabilities
+    let mut validator = v::Validator::new(v::ValidationFlags::all(), v::Capabilities::empty());
+    let _result = validator.validate(&module);
+});

fuzz/fuzz_targets/spv_parser.rs

@@ -1,6 +1,6 @@
 #![no_main]
 use libfuzzer_sys::fuzz_target;
-use naga::front::spv::{Parser, Options};
+use naga::front::spv::{Options, Parser};
 
 fuzz_target!(|data: Vec<u32>| {
     // Ensure the parser can handle potentially malformed data without crashing.

src/arena.rs

@@ -17,6 +17,7 @@ use indexmap::set::IndexSet;
     any(feature = "serialize", feature = "deserialize"),
     serde(transparent)
 )]
+#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 pub struct Handle<T> {
     index: Index,
     #[cfg_attr(any(feature = "serialize", feature = "deserialize"), serde(skip))]
@@ -110,6 +111,7 @@ impl<T> Handle<T> {
     any(feature = "serialize", feature = "deserialize"),
     serde(transparent)
 )]
+#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 pub struct Range<T> {
     inner: ops::Range<u32>,
     #[cfg_attr(any(feature = "serialize", feature = "deserialize"), serde(skip))]
@@ -154,6 +156,7 @@ impl<T> Iterator for Range<T> {
 /// a reference to the stored item.
 #[cfg_attr(feature = "serialize", derive(serde::Serialize))]
 #[cfg_attr(feature = "serialize", serde(transparent))]
+#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 #[cfg_attr(test, derive(PartialEq))]
 pub struct Arena<T> {
     /// Values of this arena.
@@ -543,8 +546,7 @@ impl<T> ops::Index<Handle<T>> for UniqueArena<T> {
 #[cfg(feature = "serialize")]
 impl<T> serde::Serialize for UniqueArena<T>
 where
-    T: Eq + hash::Hash,
-    T: serde::Serialize,
+    T: Eq + hash::Hash + serde::Serialize,
 {
     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
     where
@@ -557,8 +559,7 @@ where
 #[cfg(feature = "deserialize")]
 impl<'de, T> serde::Deserialize<'de> for UniqueArena<T>
 where
-    T: Eq + hash::Hash,
-    T: serde::Deserialize<'de>,
+    T: Eq + hash::Hash + serde::Deserialize<'de>,
 {
     fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
     where
@@ -575,3 +576,36 @@ where
         })
     }
 }
+
+//Note: largely borrowed from `HashSet` implementation
+#[cfg(feature = "arbitrary")]
+impl<'a, T> arbitrary::Arbitrary<'a> for UniqueArena<T>
+where
+    T: Eq + hash::Hash + arbitrary::Arbitrary<'a>,
+{
+    fn arbitrary(u: &mut arbitrary::Unstructured<'a>) -> arbitrary::Result<Self> {
+        let mut arena = Self::default();
+        for elem in u.arbitrary_iter()? {
+            arena.set.insert(elem?);
+            #[cfg(feature = "span")]
+            arena.span_info.push(Span::UNDEFINED);
+        }
+        Ok(arena)
+    }
+
+    fn arbitrary_take_rest(u: arbitrary::Unstructured<'a>) -> arbitrary::Result<Self> {
+        let mut arena = Self::default();
+        for elem in u.arbitrary_take_rest_iter()? {
+            arena.set.insert(elem?);
+            #[cfg(feature = "span")]
+            arena.span_info.push(Span::UNDEFINED);
+        }
+        Ok(arena)
+    }
+
+    #[inline]
+    fn size_hint(depth: usize) -> (usize, Option<usize>) {
+        let depth_hint = <usize as arbitrary::Arbitrary>::size_hint(depth);
+        arbitrary::size_hint::and(depth_hint, (0, None))
+    }
+}

src/block.rs

@@ -5,6 +5,7 @@ use std::ops::{Deref, DerefMut, RangeBounds};
 #[derive(Debug, Clone, Default)]
 #[cfg_attr(feature = "serialize", derive(serde::Serialize))]
 #[cfg_attr(feature = "serialize", serde(transparent))]
+#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 pub struct Block {
     body: Vec<Statement>,
     #[cfg(feature = "span")]