2016-10-24 11:14:35 +00:00
|
|
|
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
|
|
// found in the LICENSE file.
|
|
|
|
|
|
|
|
#include <stddef.h>
|
|
|
|
#include <stdint.h>
|
|
|
|
|
|
|
|
#include "include/v8.h"
|
|
|
|
#include "src/isolate.h"
|
2017-02-13 09:52:26 +00:00
|
|
|
#include "src/objects-inl.h"
|
2016-10-24 11:14:35 +00:00
|
|
|
#include "src/objects.h"
|
2016-10-24 12:43:25 +00:00
|
|
|
#include "src/utils.h"
|
2016-10-24 11:14:35 +00:00
|
|
|
#include "src/wasm/wasm-interpreter.h"
|
|
|
|
#include "src/wasm/wasm-module-builder.h"
|
|
|
|
#include "src/wasm/wasm-module.h"
|
|
|
|
#include "test/common/wasm/test-signatures.h"
|
|
|
|
#include "test/common/wasm/wasm-module-runner.h"
|
|
|
|
#include "test/fuzzer/fuzzer-support.h"
|
2017-05-08 09:22:54 +00:00
|
|
|
#include "test/fuzzer/wasm-fuzzer-common.h"
|
2016-10-24 11:14:35 +00:00
|
|
|
|
|
|
|
#define MAX_NUM_FUNCTIONS 3
|
|
|
|
#define MAX_NUM_PARAMS 3
|
|
|
|
|
2017-08-09 08:11:21 +00:00
|
|
|
#if __clang__
|
|
|
|
// TODO(mostynb@opera.com): remove the using statements and these pragmas.
|
|
|
|
#pragma clang diagnostic push
|
|
|
|
#pragma clang diagnostic ignored "-Wheader-hygiene"
|
|
|
|
#endif
|
|
|
|
|
2017-05-08 09:22:54 +00:00
|
|
|
using namespace v8::internal;
|
2016-10-24 11:14:35 +00:00
|
|
|
using namespace v8::internal::wasm;
|
2017-05-08 09:22:54 +00:00
|
|
|
using namespace v8::internal::wasm::fuzzer;
|
|
|
|
|
2017-08-09 08:11:21 +00:00
|
|
|
#if __clang__
|
|
|
|
// TODO(mostynb@opera.com): remove the using statements and these pragmas.
|
|
|
|
#pragma clang diagnostic pop
|
|
|
|
#endif
|
|
|
|
|
2017-05-08 09:22:54 +00:00
|
|
|
class WasmCallFuzzer : public WasmExecutionFuzzer {
|
|
|
|
template <typename V>
|
|
|
|
static inline V read_value(const uint8_t** data, size_t* size, bool* ok) {
|
|
|
|
// The status flag {ok} checks that the decoding up until now was okay, and
|
|
|
|
// that a value of type V can be read without problems.
|
|
|
|
*ok &= (*size > sizeof(V));
|
|
|
|
if (!(*ok)) return 0;
|
|
|
|
V result = v8::internal::ReadLittleEndianValue<V>(*data);
|
|
|
|
*data += sizeof(V);
|
|
|
|
*size -= sizeof(V);
|
|
|
|
return result;
|
2016-10-24 11:14:35 +00:00
|
|
|
}
|
|
|
|
|
2017-05-08 09:22:54 +00:00
|
|
|
static void add_argument(
|
2017-07-14 13:49:01 +00:00
|
|
|
v8::internal::Isolate* isolate, ValueType type,
|
|
|
|
WasmValue* interpreter_args,
|
2017-05-08 09:22:54 +00:00
|
|
|
v8::internal::Handle<v8::internal::Object>* compiler_args, int* argc,
|
|
|
|
const uint8_t** data, size_t* size, bool* ok) {
|
|
|
|
if (!(*ok)) return;
|
|
|
|
switch (type) {
|
|
|
|
case kWasmF32: {
|
|
|
|
float value = read_value<float>(data, size, ok);
|
2017-07-14 13:49:01 +00:00
|
|
|
interpreter_args[*argc] = WasmValue(value);
|
2017-05-08 09:22:54 +00:00
|
|
|
compiler_args[*argc] =
|
|
|
|
isolate->factory()->NewNumber(static_cast<double>(value));
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case kWasmF64: {
|
|
|
|
double value = read_value<double>(data, size, ok);
|
2017-07-14 13:49:01 +00:00
|
|
|
interpreter_args[*argc] = WasmValue(value);
|
2017-05-08 09:22:54 +00:00
|
|
|
compiler_args[*argc] = isolate->factory()->NewNumber(value);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case kWasmI32: {
|
|
|
|
int32_t value = read_value<int32_t>(data, size, ok);
|
2017-07-14 13:49:01 +00:00
|
|
|
interpreter_args[*argc] = WasmValue(value);
|
2017-05-08 09:22:54 +00:00
|
|
|
compiler_args[*argc] =
|
|
|
|
isolate->factory()->NewNumber(static_cast<double>(value));
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
default:
|
|
|
|
UNREACHABLE();
|
|
|
|
}
|
|
|
|
(*argc)++;
|
2016-10-24 11:14:35 +00:00
|
|
|
}
|
|
|
|
|
2017-05-08 09:22:54 +00:00
|
|
|
virtual bool GenerateModule(
|
|
|
|
Isolate* isolate, Zone* zone, const uint8_t* data, size_t size,
|
|
|
|
ZoneBuffer& buffer, int32_t& num_args,
|
2017-07-14 13:49:01 +00:00
|
|
|
std::unique_ptr<WasmValue[]>& interpreter_args,
|
2017-05-08 09:22:54 +00:00
|
|
|
std::unique_ptr<Handle<Object>[]>& compiler_args) override {
|
|
|
|
bool ok = true;
|
|
|
|
uint8_t num_functions =
|
|
|
|
(read_value<uint8_t>(&data, &size, &ok) % MAX_NUM_FUNCTIONS) + 1;
|
|
|
|
|
|
|
|
ValueType types[] = {kWasmF32, kWasmF64, kWasmI32, kWasmI64};
|
|
|
|
|
2017-07-14 13:49:01 +00:00
|
|
|
interpreter_args.reset(new WasmValue[3]);
|
2017-05-08 09:22:54 +00:00
|
|
|
compiler_args.reset(new Handle<Object>[3]);
|
|
|
|
|
|
|
|
WasmModuleBuilder builder(zone);
|
|
|
|
for (int fun = 0; fun < num_functions; fun++) {
|
|
|
|
size_t num_params = static_cast<size_t>(
|
|
|
|
(read_value<uint8_t>(&data, &size, &ok) % MAX_NUM_PARAMS) + 1);
|
|
|
|
FunctionSig::Builder sig_builder(zone, 1, num_params);
|
|
|
|
sig_builder.AddReturn(kWasmI32);
|
|
|
|
for (size_t param = 0; param < num_params; param++) {
|
|
|
|
// The main function cannot handle int64 parameters.
|
|
|
|
ValueType param_type = types[(read_value<uint8_t>(&data, &size, &ok) %
|
|
|
|
(arraysize(types) - (fun == 0 ? 1 : 0)))];
|
|
|
|
sig_builder.AddParam(param_type);
|
|
|
|
if (fun == 0) {
|
|
|
|
add_argument(isolate, param_type, interpreter_args.get(),
|
|
|
|
compiler_args.get(), &num_args, &data, &size, &ok);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
v8::internal::wasm::WasmFunctionBuilder* f =
|
|
|
|
builder.AddFunction(sig_builder.Build());
|
|
|
|
uint32_t code_size = static_cast<uint32_t>(size / num_functions);
|
|
|
|
f->EmitCode(data, code_size);
|
|
|
|
uint8_t end_opcode = kExprEnd;
|
|
|
|
f->EmitCode(&end_opcode, 1);
|
|
|
|
data += code_size;
|
|
|
|
size -= code_size;
|
2016-10-24 11:14:35 +00:00
|
|
|
if (fun == 0) {
|
2017-05-12 11:06:25 +00:00
|
|
|
builder.AddExport(v8::internal::CStrVector("main"), f);
|
2016-10-24 11:14:35 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-05-08 09:22:54 +00:00
|
|
|
builder.WriteTo(buffer);
|
2016-10-24 11:14:35 +00:00
|
|
|
|
2017-05-08 09:22:54 +00:00
|
|
|
if (!ok) {
|
|
|
|
// The input data was too short.
|
|
|
|
return 0;
|
2016-10-24 11:14:35 +00:00
|
|
|
}
|
2017-05-08 09:22:54 +00:00
|
|
|
return true;
|
2016-10-24 11:14:35 +00:00
|
|
|
}
|
2017-05-08 09:22:54 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
|
|
|
return WasmCallFuzzer().FuzzWasmModule(data, size);
|
2016-10-24 11:14:35 +00:00
|
|
|
}
|