blob: 5478cc0887df9d2b0d571f9ff4a14f69a5753435 [file] [log] [blame]
Cary Clark91390c82018-03-09 14:02:46 -05001/*
2 * Copyright 2018 Google Inc.
3 *
4 * Use of this source code is governed by a BSD-style license that can be
5 * found in the LICENSE file.
6 */
7
Mike Kleinc0bd9f92019-04-23 12:05:21 -05008#include "fuzz/Fuzz.h"
9#include "fuzz/FuzzCommon.h"
Cary Clark91390c82018-03-09 14:02:46 -050010
Kevin Lubickbc9a1a82018-09-17 14:46:57 -040011// We don't always want to test NaNs and infinities.
12static void fuzz_nice_float(Fuzz* fuzz, float* f) {
13 float v;
14 fuzz->next(&v);
15 constexpr float kLimit = 1.0e35f; // FLT_MAX?
16 *f = (v == v && v <= kLimit && v >= -kLimit) ? v : 0.0f;
17}
18
19template <typename... Args>
20static void fuzz_nice_float(Fuzz* fuzz, float* f, Args... rest) {
21 fuzz_nice_float(fuzz, f);
22 fuzz_nice_float(fuzz, rest...);
23}
24
Mike Klein7ffa40c2018-09-25 12:16:53 -040025static void fuzz_nice_rect(Fuzz* fuzz, SkRect* r) {
26 fuzz_nice_float(fuzz, &r->fLeft, &r->fTop, &r->fRight, &r->fBottom);
27 r->sort();
28}
Kevin Lubickbc9a1a82018-09-17 14:46:57 -040029
Cary Clark91390c82018-03-09 14:02:46 -050030// allows some float values for path points
Mike Klein7ffa40c2018-09-25 12:16:53 -040031void FuzzNicePath(Fuzz* fuzz, SkPath* path, int maxOps) {
Kevin Lubick96d9dd82018-12-17 12:57:53 -050032 if (maxOps <= 0 || fuzz->exhausted() || path->countPoints() > 100000) {
Robert Phillips5e4e5452018-09-12 12:06:18 -040033 return;
Cary Clark91390c82018-03-09 14:02:46 -050034 }
35 uint8_t fillType;
Mike Reed7d34dc72019-11-26 12:17:17 -050036 fuzz->nextRange(&fillType, 0, (uint8_t)SkPathFillType::kInverseEvenOdd);
37 path->setFillType((SkPathFillType)fillType);
Cary Clark91390c82018-03-09 14:02:46 -050038 uint8_t numOps;
Robert Phillips5e4e5452018-09-12 12:06:18 -040039 fuzz->nextRange(&numOps, 0, maxOps);
Cary Clark91390c82018-03-09 14:02:46 -050040 for (uint8_t i = 0; i < numOps; ++i) {
Kevin Lubick96d9dd82018-12-17 12:57:53 -050041 // When we start adding the path to itself, the fuzzer can make an
42 // exponentially long path, which causes timeouts.
43 if (path->countPoints() > 100000) {
44 return;
45 }
46 // How many items in the switch statement below.
47 constexpr uint8_t PATH_OPERATIONS = 32;
Cary Clark91390c82018-03-09 14:02:46 -050048 uint8_t op;
Kevin Lubick96d9dd82018-12-17 12:57:53 -050049 fuzz->nextRange(&op, 0, PATH_OPERATIONS);
Robert Phillips5e4e5452018-09-12 12:06:18 -040050 bool test;
51 SkPath p;
52 SkMatrix m;
53 SkRRect rr;
54 SkRect r;
Mike Reed30bc5272019-11-22 18:34:02 +000055 SkPathDirection dir;
Robert Phillips5e4e5452018-09-12 12:06:18 -040056 unsigned int ui;
Cary Clark91390c82018-03-09 14:02:46 -050057 SkScalar a, b, c, d, e, f;
58 switch (op) {
59 case 0:
60 fuzz_nice_float(fuzz, &a, &b);
61 path->moveTo(a, b);
62 break;
63 case 1:
64 fuzz_nice_float(fuzz, &a, &b);
Robert Phillips5e4e5452018-09-12 12:06:18 -040065 path->rMoveTo(a, b);
Cary Clark91390c82018-03-09 14:02:46 -050066 break;
67 case 2:
Robert Phillips5e4e5452018-09-12 12:06:18 -040068 fuzz_nice_float(fuzz, &a, &b);
69 path->lineTo(a, b);
70 break;
71 case 3:
72 fuzz_nice_float(fuzz, &a, &b);
73 path->rLineTo(a, b);
74 break;
75 case 4:
Cary Clark91390c82018-03-09 14:02:46 -050076 fuzz_nice_float(fuzz, &a, &b, &c, &d);
77 path->quadTo(a, b, c, d);
78 break;
Robert Phillips5e4e5452018-09-12 12:06:18 -040079 case 5:
80 fuzz_nice_float(fuzz, &a, &b, &c, &d);
81 path->rQuadTo(a, b, c, d);
82 break;
83 case 6:
Cary Clark91390c82018-03-09 14:02:46 -050084 fuzz_nice_float(fuzz, &a, &b, &c, &d, &e);
85 path->conicTo(a, b, c, d, e);
86 break;
Robert Phillips5e4e5452018-09-12 12:06:18 -040087 case 7:
88 fuzz_nice_float(fuzz, &a, &b, &c, &d, &e);
89 path->rConicTo(a, b, c, d, e);
90 break;
91 case 8:
Cary Clark91390c82018-03-09 14:02:46 -050092 fuzz_nice_float(fuzz, &a, &b, &c, &d, &e, &f);
93 path->cubicTo(a, b, c, d, e, f);
94 break;
Robert Phillips5e4e5452018-09-12 12:06:18 -040095 case 9:
96 fuzz_nice_float(fuzz, &a, &b, &c, &d, &e, &f);
97 path->rCubicTo(a, b, c, d, e, f);
98 break;
99 case 10:
Cary Clark91390c82018-03-09 14:02:46 -0500100 fuzz_nice_float(fuzz, &a, &b, &c, &d, &e);
101 path->arcTo(a, b, c, d, e);
102 break;
Robert Phillips5e4e5452018-09-12 12:06:18 -0400103 case 11:
104 fuzz_nice_float(fuzz, &a, &b);
Mike Klein7ffa40c2018-09-25 12:16:53 -0400105 fuzz_nice_rect(fuzz, &r);
106 fuzz->next(&test);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400107 path->arcTo(r, a, b, test);
108 break;
109 case 12:
Cary Clark91390c82018-03-09 14:02:46 -0500110 path->close();
111 break;
Robert Phillips5e4e5452018-09-12 12:06:18 -0400112 case 13:
Mike Klein7ffa40c2018-09-25 12:16:53 -0400113 fuzz_nice_rect(fuzz, &r);
Robert Phillips8051d382018-09-13 08:22:15 -0400114 fuzz->nextRange(&ui, 0, 1);
Mike Reed30bc5272019-11-22 18:34:02 +0000115 dir = static_cast<SkPathDirection>(ui);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400116 path->addRect(r, dir);
117 break;
118 case 14:
Robert Phillips8051d382018-09-13 08:22:15 -0400119 fuzz->nextRange(&ui, 0, 1);
Mike Reed30bc5272019-11-22 18:34:02 +0000120 dir = static_cast<SkPathDirection>(ui);
Mike Klein7ffa40c2018-09-25 12:16:53 -0400121 fuzz_nice_rect(fuzz, &r);
122 fuzz->next(&ui);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400123 path->addRect(r, dir, ui);
124 break;
125 case 15:
Robert Phillips8051d382018-09-13 08:22:15 -0400126 fuzz->nextRange(&ui, 0, 1);
Mike Reed30bc5272019-11-22 18:34:02 +0000127 dir = static_cast<SkPathDirection>(ui);
Mike Klein7ffa40c2018-09-25 12:16:53 -0400128 fuzz_nice_rect(fuzz, &r);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400129 path->addOval(r, dir);
130 break;
131 case 16:
Robert Phillips8051d382018-09-13 08:22:15 -0400132 fuzz->nextRange(&ui, 0, 1);
Mike Reed30bc5272019-11-22 18:34:02 +0000133 dir = static_cast<SkPathDirection>(ui);
Mike Klein7ffa40c2018-09-25 12:16:53 -0400134 fuzz_nice_rect(fuzz, &r);
135 fuzz->next(&ui);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400136 path->addOval(r, dir, ui);
137 break;
138 case 17:
Robert Phillips8051d382018-09-13 08:22:15 -0400139 fuzz->nextRange(&ui, 0, 1);
Mike Reed30bc5272019-11-22 18:34:02 +0000140 dir = static_cast<SkPathDirection>(ui);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400141 fuzz_nice_float(fuzz, &a, &b, &c);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400142 path->addCircle(a, b, c, dir);
143 break;
144 case 18:
Mike Klein7ffa40c2018-09-25 12:16:53 -0400145 fuzz_nice_rect(fuzz, &r);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400146 fuzz_nice_float(fuzz, &a, &b);
147 path->addArc(r, a, b);
148 break;
149 case 19:
150 fuzz_nice_float(fuzz, &a, &b);
Mike Klein7ffa40c2018-09-25 12:16:53 -0400151 fuzz_nice_rect(fuzz, &r);
Robert Phillips8051d382018-09-13 08:22:15 -0400152 fuzz->nextRange(&ui, 0, 1);
Mike Reed30bc5272019-11-22 18:34:02 +0000153 dir = static_cast<SkPathDirection>(ui);
Mike Reed4241f5e2019-09-14 19:13:23 +0000154 path->addRoundRect(r, a, b, dir);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400155 break;
156 case 20:
Mike Klein78c60152018-09-24 11:33:55 -0400157 FuzzNiceRRect(fuzz, &rr);
Robert Phillips8051d382018-09-13 08:22:15 -0400158 fuzz->nextRange(&ui, 0, 1);
Mike Reed30bc5272019-11-22 18:34:02 +0000159 dir = static_cast<SkPathDirection>(ui);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400160 path->addRRect(rr, dir);
161 break;
162 case 21:
Robert Phillips8051d382018-09-13 08:22:15 -0400163 fuzz->nextRange(&ui, 0, 1);
Mike Reed30bc5272019-11-22 18:34:02 +0000164 dir = static_cast<SkPathDirection>(ui);
Mike Klein78c60152018-09-24 11:33:55 -0400165 FuzzNiceRRect(fuzz, &rr);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400166 path->addRRect(rr, dir, ui);
167 break;
168 case 22: {
Robert Phillips8051d382018-09-13 08:22:15 -0400169 fuzz->nextRange(&ui, 0, 1);
170 SkPath::AddPathMode mode = static_cast<SkPath::AddPathMode>(ui);
Mike Klein7ffa40c2018-09-25 12:16:53 -0400171 FuzzNiceMatrix(fuzz, &m);
172 FuzzNicePath(fuzz, &p, maxOps-1);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400173 path->addPath(p, m, mode);
174 break;
175 }
176 case 23: {
Robert Phillips8051d382018-09-13 08:22:15 -0400177 fuzz->nextRange(&ui, 0, 1);
178 SkPath::AddPathMode mode = static_cast<SkPath::AddPathMode>(ui);
Mike Klein7ffa40c2018-09-25 12:16:53 -0400179 FuzzNiceMatrix(fuzz, &m);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400180 path->addPath(*path, m, mode);
181 break;
182 }
183 case 24:
Mike Klein7ffa40c2018-09-25 12:16:53 -0400184 FuzzNicePath(fuzz, &p, maxOps-1);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400185 path->reverseAddPath(p);
186 break;
187 case 25:
188 path->addPath(*path);
189 break;
190 case 26:
191 path->reverseAddPath(*path);
192 break;
193 case 27:
194 fuzz_nice_float(fuzz, &a, &b);
195 path->offset(a, b, path);
196 break;
197 case 28:
Mike Klein7ffa40c2018-09-25 12:16:53 -0400198 FuzzNicePath(fuzz, &p, maxOps-1);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400199 fuzz_nice_float(fuzz, &a, &b);
200 p.offset(a, b, path);
201 break;
202 case 29:
Mike Klein7ffa40c2018-09-25 12:16:53 -0400203 FuzzNiceMatrix(fuzz, &m);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400204 path->transform(m, path);
205 break;
206 case 30:
Mike Klein7ffa40c2018-09-25 12:16:53 -0400207 FuzzNicePath(fuzz, &p, maxOps-1);
208 FuzzNiceMatrix(fuzz, &m);
Robert Phillips5e4e5452018-09-12 12:06:18 -0400209 p.transform(m, path);
210 break;
211 case 31:
212 fuzz_nice_float(fuzz, &a, &b);
213 path->setLastPt(a, b);
214 break;
Kevin Lubick96d9dd82018-12-17 12:57:53 -0500215 case PATH_OPERATIONS:
Robert Phillips5e4e5452018-09-12 12:06:18 -0400216 path->shrinkToFit();
217 break;
218
Cary Clark91390c82018-03-09 14:02:46 -0500219 default:
220 SkASSERT(false);
221 break;
222 }
Mike Klein7ffa40c2018-09-25 12:16:53 -0400223 SkASSERTF( path->isValid(), "path->isValid() failed at op %d, case %d", i, op);
Cary Clark91390c82018-03-09 14:02:46 -0500224 }
225}
226
227// allows all float values for path points
Mike Klein7ffa40c2018-09-25 12:16:53 -0400228void FuzzEvilPath(Fuzz* fuzz, SkPath* path, int last_verb) {
Cary Clark91390c82018-03-09 14:02:46 -0500229 while (!fuzz->exhausted()) {
230 // Use a uint8_t to conserve bytes. This makes our "fuzzed bytes footprint"
231 // smaller, which leads to more efficient fuzzing.
232 uint8_t operation;
233 fuzz->next(&operation);
234 SkScalar a,b,c,d,e,f;
235
236 switch (operation % (last_verb + 1)) {
237 case SkPath::Verb::kMove_Verb:
238 fuzz->next(&a, &b);
239 path->moveTo(a, b);
240 break;
241
242 case SkPath::Verb::kLine_Verb:
243 fuzz->next(&a, &b);
244 path->lineTo(a, b);
245 break;
246
247 case SkPath::Verb::kQuad_Verb:
248 fuzz->next(&a, &b, &c, &d);
249 path->quadTo(a, b, c, d);
250 break;
251
252 case SkPath::Verb::kConic_Verb:
253 fuzz->next(&a, &b, &c, &d, &e);
254 path->conicTo(a, b, c, d, e);
255 break;
256
257 case SkPath::Verb::kCubic_Verb:
258 fuzz->next(&a, &b, &c, &d, &e, &f);
259 path->cubicTo(a, b, c, d, e, f);
260 break;
261
262 case SkPath::Verb::kClose_Verb:
263 path->close();
264 break;
265
266 case SkPath::Verb::kDone_Verb:
267 // In this case, simply exit.
268 return;
269 }
270 }
271}
Kevin Lubickbc9a1a82018-09-17 14:46:57 -0400272
273void FuzzNiceRRect(Fuzz* fuzz, SkRRect* rr) {
274 SkRect r;
Mike Klein7ffa40c2018-09-25 12:16:53 -0400275 fuzz_nice_rect(fuzz, &r);
276
Kevin Lubickbc9a1a82018-09-17 14:46:57 -0400277 SkVector radii[4];
Kevin Lubickbc9a1a82018-09-17 14:46:57 -0400278 for (SkVector& vec : radii) {
279 fuzz->nextRange(&vec.fX, 0.0f, 1.0f);
280 vec.fX *= 0.5f * r.width();
281 fuzz->nextRange(&vec.fY, 0.0f, 1.0f);
282 vec.fY *= 0.5f * r.height();
283 }
284 rr->setRectRadii(r, radii);
Mike Klein78c60152018-09-24 11:33:55 -0400285 SkASSERT(rr->isValid());
Kevin Lubickbc9a1a82018-09-17 14:46:57 -0400286}
287
288void FuzzNiceMatrix(Fuzz* fuzz, SkMatrix* m) {
289 constexpr int kArrayLength = 9;
290 SkScalar buffer[kArrayLength];
291 int matrixType;
292 fuzz->nextRange(&matrixType, 0, 4);
293 switch (matrixType) {
294 case 0: // identity
295 *m = SkMatrix::I();
296 return;
297 case 1: // translate
298 fuzz->nextRange(&buffer[0], -4000.0f, 4000.0f);
299 fuzz->nextRange(&buffer[1], -4000.0f, 4000.0f);
300 *m = SkMatrix::MakeTrans(buffer[0], buffer[1]);
301 return;
302 case 2: // translate + scale
303 fuzz->nextRange(&buffer[0], -400.0f, 400.0f);
304 fuzz->nextRange(&buffer[1], -400.0f, 400.0f);
305 fuzz->nextRange(&buffer[2], -4000.0f, 4000.0f);
306 fuzz->nextRange(&buffer[3], -4000.0f, 4000.0f);
307 *m = SkMatrix::MakeScale(buffer[0], buffer[1]);
308 m->postTranslate(buffer[2], buffer[3]);
309 return;
310 case 3: // affine
311 fuzz->nextN(buffer, 6);
312 m->setAffine(buffer);
313 return;
314 case 4: // perspective
315 fuzz->nextN(buffer, kArrayLength);
316 m->set9(buffer);
317 return;
318 default:
319 SkASSERT(false);
320 return;
321 }
322}
323
324void FuzzNiceRegion(Fuzz* fuzz, SkRegion* region, int maxN) {
325 uint8_t N;
326 fuzz->nextRange(&N, 0, maxN);
327 for (uint8_t i = 0; i < N; ++i) {
328 SkIRect r;
329 SkRegion::Op op;
330 // Avoid the sentinal value used by Region.
331 fuzz->nextRange(&r.fLeft, -2147483646, 2147483646);
332 fuzz->nextRange(&r.fTop, -2147483646, 2147483646);
333 fuzz->nextRange(&r.fRight, -2147483646, 2147483646);
334 fuzz->nextRange(&r.fBottom, -2147483646, 2147483646);
335 r.sort();
Mike Kleinf88f5ef2018-11-19 12:21:46 -0500336 fuzz->nextRange(&op, 0, SkRegion::kLastOp);
Kevin Lubickbc9a1a82018-09-17 14:46:57 -0400337 if (!region->op(r, op)) {
338 return;
339 }
340 }
341}