WebGPU 的规范驱动变异动态一致性测试

中文摘要 AI 辅助

WebGPU 是一种底层图形和计算 API，将现代 GPU 功能暴露给 Web 应用程序。虽然官方 WebGPU 一致性测试套件（CTS）侧重于 WebGPU 规范下的良好形式用法，但其设计并非用于以语义边缘情况或对抗性输入来压力测试实现。相比之下，通用模糊测试器因 WebGPU 复杂的图形栈和多进程架构而难以应对。我们提出了 LANTERN，一个规范引导的动态一致性测试框架，利用从 WebGPU 规范中提取的约束来变异 CTS 测试。LANTERN 从 WebIDL 定义中提取显式语法 API 规则，并从自然语言规范文本中恢复语义约束，如命令排序和对象生命周期。选定的规则指导基于 AST 的文本转换，生成有效和故意无效的 CTS 变体。我们在 AddressSanitizer 插桩的 Chromium 上大规模执行生成的测试以发现错误。我们的评估在研究所时当前的 Chromium 版本中发现了三个可复现的错误，包括一个堆损坏。这些结果表明，语法种子化、语义感知的一致性测试变异为在 WebGPU 测试期间发现浏览器错误提供了一种途径。

英文摘要

WebGPU is a low-level graphics and compute API that exposes modern GPU functionality to web applications. While the official WebGPU Conformance Test Suite (CTS) focuses on well-formed usage under the WebGPU specification, it is not designed to stress implementations with semantic edge cases or adversarial inputs. General-purpose fuzzers, in contrast, struggle with WebGPU because of its complex graphics stack and multi-process architecture. We introduce LANTERN, a specification-guided dynamic conformance testing framework that mutates CTS tests using constraints extracted from the WebGPU specification. LANTERN extracts explicit syntactic API rules from WebIDL definitions and recovers semantic constraints, such as command ordering and object lifetimes, from natural-language specification text. Selected rules guide AST-located textual transformations that generate both valid and intentionally invalid CTS variants. We execute the resulting tests at scale on AddressSanitizer-instrumented Chromium to discover bugs. Our evaluation discovers three reproducible bugs, including a heap corruption, in Chromium versions current at the time of study. These results demonstrate that syntactically seeded, semantics-aware mutation of conformance tests provides a way to uncover browser bugs during WebGPU testing.

发表机构

• New Jersey Institute of Technology（新泽西理工学院）

机构由 AI 辅助整理，请以论文原文为准。