From 332604d14b2079b24137bcef109719a6f849ee22 Mon Sep 17 00:00:00 2001 From: Maya Lekova Date: Mon, 19 Sep 2022 17:19:31 +0200 Subject: [PATCH] [test] Guard a few CHECKs against --fuzzing Bug: chromium:1342305, chromium:1354926, chromium:1359709 Change-Id: I5ddedea227669908710b83f808cfb7c4718f0699 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904608 Reviewed-by: Camillo Bruni Commit-Queue: Maya Lekova Cr-Commit-Position: refs/heads/main@{#83326} --- src/d8/d8-test.cc | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/src/d8/d8-test.cc b/src/d8/d8-test.cc index 878693e3c9..9cb9664017 100644 --- a/src/d8/d8-test.cc +++ b/src/d8/d8-test.cc @@ -669,10 +669,12 @@ class FastCApiObject { CHECK_NOT_NULL(self); self->fast_call_count_++; - // Number is in range. - CHECK(in_range && "Number range should have been enforced"); - if (!std::isnan(real_arg)) { - CHECK_EQ(static_cast(real_arg), checked_arg); + if (!i::v8_flags.fuzzing) { + // Number is in range. + CHECK(in_range && "Number range should have been enforced"); + if (!std::isnan(real_arg)) { + CHECK_EQ(static_cast(real_arg), checked_arg); + } } return true; } @@ -688,6 +690,10 @@ class FastCApiObject { HandleScope handle_scope(isolate); + if (i::v8_flags.fuzzing) { + args.GetReturnValue().Set(Boolean::New(isolate, false)); + return; + } double real_arg = 0; if (args.Length() > 1 && args[1]->IsNumber()) { real_arg = args[1]->NumberValue(isolate->GetCurrentContext()).FromJust(); @@ -776,6 +782,10 @@ class FastCApiObject { CHECK_SELF_OR_FALLBACK(false); self->fast_call_count_++; + if (i::v8_flags.fuzzing) { + return true; + } + CHECK_NOT_NULL(options.wasm_memory); uint8_t* memory = nullptr; CHECK(options.wasm_memory->getStorageIfAligned(&memory));