Automated testing of graphics shader compilers
Automated testing of graphics shader compilers
复制标题
DOI：
10.1145/3133917
复制
发表时间：
2017-10
影响因子：
--
通讯作者：
Alastair F. Donaldson;Hugues Evrard;Andrei Lascu;Paul Thomson
中科院分区：
文献类型：
--
作者：
Alastair F. Donaldson;Hugues Evrard;Andrei Lascu;Paul Thomson
我们提出了一种自动查找图形着色语言编译器中的缺陷的技术。编译器测试中的关键挑战是缺乏将输出分类为正确或不正确的Oracle；这在图形着色器编译器中尤其相关，其中输出是通常未指定的渲染图像。我们的方法建立在最近成功的基于变形测试的编译器验证技术的基础上，并利用现有的高价值图形着色器来创建应该在语义上等价的转换后的着色器集。渲染不匹配则表示着色器编译错误。异常着色器将自动最小化，以在每种情况下标识对原始高值着色器的最小更改，从而导致着色器编译器错误。我们已经将该方法作为一个工具GLFuzz来实现，该工具针对OpenGL着色语言GLSL。我们在一组17个GPU和驱动程序配置上的实验，跨越了主要的7个GPU设计者，导致我们发现并报告了60多个不同的错误，涵盖了所有测试的配置。除了有缺陷的渲染，这些问题还确定了影响WebGL的安全关键漏洞，包括一个严重的远程信息泄漏安全漏洞，在该漏洞中，恶意网页可以捕获其他浏览器选项卡的内容，以及一个漏洞，通过该漏洞访问恶意网页可以导致Windows 10下的“蓝屏死亡”。我们的发现表明，着色器编译器缺陷非常普遍，变形测试提供了自动检测这些缺陷的有效方法。
We present an automated technique for finding defects in compilers for graphics shading languages. key challenge in compiler testing is the lack of an oracle that classifies an output as correct or incorrect; this is particularly pertinent in graphics shader compilers where the output is a rendered image that is typically under-specified. Our method builds on recent successful techniques for compiler validation based on metamorphic testing, and leverages existing high-value graphics shaders to create sets of transformed shaders that should be semantically equivalent. Rendering mismatches are then indicative of shader compilation bugs. Deviant shaders are automatically minimized to identify, in each case, a minimal change to an original high-value shader that induces a shader compiler bug. We have implemented the approach as a tool, GLFuzz, targeting the OpenGL shading language, GLSL. Our experiments over a set of 17 GPU and driver configurations, spanning the main 7 GPU designers, have led to us finding and reporting more than 60 distinct bugs, covering all tested configurations. As well as defective rendering, these issues identify security-critical vulnerabilities that affect WebGL, including a significant remote information leak security bug where a malicious web page can capture the contents of other browser tabs, and a bug whereby visiting a malicious web page can lead to a ``blue screen of death'' under Windows 10. Our findings show that shader compiler defects are prevalent, and that metamorphic testing provides an effective means for detecting them automatically.