WebGlitch: a randomised testing tool for the WebGPU API
File(s)
Published version
Author(s)
Wong, Matthew KL
Donaldson, Alastair F
Type
Conference Paper
Abstract
We report on our experience designing a new technique and tool for fuzzing implementations of WebGPU, a W3C standard JavaScript API for in-browser GPU computing. We also report on our experience using our WebGlitch tool to test industrial-strength implementations of WebGPU, leading to the discovery of numerous bugs. WebGPU enables programmatic access to a device’s graphics processing unit (GPU) for in-browser GPU computing, and is being implemented by Google, Mozilla and Apple for inclusion in all of the major web browsers. Guaranteeing the security and reliability of WebGPU is crucial to avoid wide-reaching browser security vulnerabilities and to facilitate portability by ensuring uniform behaviour across different platforms. To that end - inspired by randomised compiler testing techniques - our approach to fuzzing creates random, valid-by-construction programs by continuously selecting a WebGPU API function, then recursively generating all requirements necessary for that API call to be valid based on careful modelling of the API specification. This is implemented as a new open source tool, WebGlitch, which we designed in consultation with engineers at Google who work on the Chrome WebGPU implementation. WebGlitch identifies bugs through sanitiser-boosted crash oracles, differential testing, and by identifying cases where valid-by-construction API calls lead to runtime errors. We present an evaluation showing that WebGlitch can find bugs missed by an existing WebGPU fuzzer, wg-fuzz, and across the broader WebGPU ecosystem: to date, WebGlitch has found 24 previously-unknown bugs (15 fixed so far in response to our reports). Among these, 17 bugs affected WebGPU implementations from Google, Mozilla, and the Deno project. WebGlitch found an additional 4 bugs in the shader compilers used by the graphics APIs that WebGPU interfaces with. The remaining 3 bugs affect the widely-used JavaScript runtimes Node.js and Deno. Fuzzing with WebGlitch also led us to identify an ambiguity in the specification of the WebGPU shading language, for which we proposed an amendment that was accepted by W3C and which has been adopted in the latest version of the specification. Analysing the line coverage of a WebGPU implementation by WebGlitch-generated programs revealed that WebGlitch covers code missed by wg-fuzz and the official conformance test suite. Our hope is that this report on the design of WebGlitch and its deployment in practice will be useful for practitioners and researchers interested in using API fuzzing to improve the reliability of industrial codebases.
Editor(s)
Aldrich, J
Date Issued
2025-06-25
Date Acceptance
2025-06-01
Citation
Leibniz International Proceedings in Informatics, 2025, 333, pp.39:1-39:26
ISSN
1868-8969
Publisher
Schloss Dagstuhl -- Leibniz-Zentrum fuer Informatik
Start Page
39:1
End Page
39:26
Journal / Book Title
Leibniz International Proceedings in Informatics
Volume
333
Copyright Statement
© Matthew K. L. Wong and Alastair F. Donaldson; licensed under Creative Commons License CC-BY 4.0.
License URL
Identifier
10.4230/DARTS.11.2.14
Source
39th European Conference on Object-Orientated Programming-ECOOP
Subjects
API
Computer Science
Computer Science, Software Engineering
Computer Science, Theory & Methods
Fuzzing
Science & Technology
shaders
Technology
WebGPU
WGSL
Publication Status
Published
Start Date
2025-06-30
Finish Date
2025-07-02
Coverage Spatial
Bergen, Norway