Fuzz the #[cube] macro#1364
Open
LucaCappelletti94 wants to merge 2 commits into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A fuzzer feeds a function huge amounts of random input to find inputs that make it crash. This PR adds one for the
#[cube]procedural macro, plus the small refactor needed to make it possible.It is a preliminary step, building towards a differential fuzzer that runs the same kernel through the CPU and GPU backends and compares results to catch miscompilations. That oracle only means anything once the front end is solid, so
#[cube]has to be stable under fuzzing first. The execution differential comes in a future PR.A
cargo fuzztarget is an ordinary binary, and Rust does not let one call into aproc-macro = truecrate, so the macro logic has been moved into a new normal library,cubecl-macros-core.The target (
fuzz/cube_macro) feeds random source text tocube_impland checks it never panics. The macro should return asyn::Error(rendered as a spannedcompile_error!) for anything it cannot handle, never panic: a panicking proc macro aborts the user's build with an opaque, span-less message and is handled poorly by rust-analyzer.A dictionary of cube and Rust tokens is included to reach the macro internals quickly.
A short run already finds real (and arguably trivial) issues: the macro has a proper error path but a few spots bypass it and panic.
parse/kernel.rs: a trait-object kernel argument hitsunimplemented!("Trait objects are not allowed for kernel args"), a valid rejection done as a panic. Reproducer:fn f(x: dyn Foo) {}.parse/expression.rs: calling an indexed expression likea[0]()hits a leftoverpanic!debug guard, though the surrounding match already has a fallthrough arm. Reproducer:fn f() { a[0](); }.parse/expression.rs: a const-folding path calls.unwrap()onas_const, assuming anything const can be evaluated as const. An actual logic bug, not just a panic that should be an error.Fixes are left for follow-up so they can be reviewed separately.