spirv-fuzz: Set message consumer in replayer when shrinking (#3591)

Fixes an issue with the shrinker, where the message consumer set for
the shrinker was not being passed on to the replay object that the
shrinker creates.  This meant that messages generated during replay
would cause an exception to be thrown.

source/fuzz/shrinker.cpp

@@ -121,11 +121,13 @@ Shrinker::ShrinkerResultStatus Shrinker::Run(
   // succeeds, (b) get the binary that results from running these
   // transformations, and (c) get the subsequence of the initial transformations
   // that actually apply (in principle this could be a strict subsequence).
-  if (Replayer(impl_->target_env, impl_->validate_during_replay,
-               impl_->validator_options)
-          .Run(binary_in, initial_facts, transformation_sequence_in,
-               transformation_sequence_in.transformation_size(),
-               &current_best_binary, &current_best_transformations) !=
+  Replayer replayer(impl_->target_env, impl_->validate_during_replay,
+                    impl_->validator_options);
+  replayer.SetMessageConsumer(impl_->consumer);
+  if (replayer.Run(binary_in, initial_facts, transformation_sequence_in,
+                   static_cast<uint32_t>(
+                       transformation_sequence_in.transformation_size()),
+                   &current_best_binary, &current_best_transformations) !=
       Replayer::ReplayerResultStatus::kComplete) {
     return ShrinkerResultStatus::kReplayFailed;
   }
@@ -185,7 +187,8 @@ Shrinker::ShrinkerResultStatus Shrinker::Run(
       // Remove a chunk of transformations according to the current index and
       // chunk size.
       auto transformations_with_chunk_removed =
-          RemoveChunk(current_best_transformations, chunk_index, chunk_size);
+          RemoveChunk(current_best_transformations,
+                      static_cast<uint32_t>(chunk_index), chunk_size);
 
       // Replay the smaller sequence of transformations to get a next binary and
       // transformation sequence. Note that the transformations arising from
@@ -194,11 +197,11 @@ Shrinker::ShrinkerResultStatus Shrinker::Run(
       // transformations inapplicable.
       std::vector<uint32_t> next_binary;
       protobufs::TransformationSequence next_transformation_sequence;
-      if (Replayer(impl_->target_env, impl_->validate_during_replay,
-                   impl_->validator_options)
-              .Run(binary_in, initial_facts, transformations_with_chunk_removed,
-                   transformations_with_chunk_removed.transformation_size(),
-                   &next_binary, &next_transformation_sequence) !=
+      if (replayer.Run(
+              binary_in, initial_facts, transformations_with_chunk_removed,
+              static_cast<uint32_t>(
+                  transformations_with_chunk_removed.transformation_size()),
+              &next_binary, &next_transformation_sequence) !=
           Replayer::ReplayerResultStatus::kComplete) {
         // Replay should not fail; if it does, we need to abort shrinking.
         return ShrinkerResultStatus::kReplayFailed;

test/fuzz/fuzzer_shrinker_test.cpp

@@ -1111,6 +1111,18 @@ TEST(FuzzerShrinkerTest, Miscellaneous3) {
     *temp.mutable_constant_uniform_fact() = resolution_y_eq_100;
     *facts.mutable_fact()->Add() = temp;
   }
+  // Also add an invalid fact, which should be ignored.
+  {
+    protobufs::FactConstantUniform bad_fact;
+    // The descriptor set, binding and indices used here deliberately make no
+    // sense.
+    *bad_fact.mutable_uniform_buffer_element_descriptor() =
+        MakeUniformBufferElementDescriptor(22, 33, {44, 55});
+    *bad_fact.mutable_constant_word()->Add() = 100;
+    protobufs::Fact temp;
+    *temp.mutable_constant_uniform_fact() = bad_fact;
+    *facts.mutable_fact()->Add() = temp;
+  }
 
   // Do 2 fuzzer runs, starting from an initial seed of 194 (seed value chosen
   // arbitrarily).