Add json fuzzer

BUG=chromium:577261
R=machenbach@chromium.org,yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1652963002

Cr-Commit-Position: refs/heads/master@{#33673}

BUILD.gn

@@ -1935,6 +1935,24 @@ if ((current_toolchain == host_toolchain && v8_toolset_for_d8 == "host") ||
   }
 }
 
+source_set("json_fuzzer") {
+  sources = [
+    "test/fuzzer/json.cc",
+  ]
+
+  deps = [
+    ":fuzzer_support",
+  ]
+
+  configs -= [ "//build/config/compiler:chromium_code" ]
+  configs += [ "//build/config/compiler:no_chromium_code" ]
+  configs += [
+    ":internal_config",
+    ":features",
+    ":toolchain",
+  ]
+}
+
 source_set("parser_fuzzer") {
   sources = [
     "test/fuzzer/parser.cc",

test/fuzzer/fuzzer.gyp

@@ -8,6 +8,32 @@
   },
   'includes': ['../../build/toolchain.gypi', '../../build/features.gypi'],
   'targets': [
+    {
+      'target_name': 'json_fuzzer',
+      'type': 'executable',
+      'dependencies': [
+        'json_fuzzer_lib',
+      ],
+      'include_dirs': [
+        '../..',
+      ],
+      'sources': [
+        'fuzzer.cc',
+      ],
+    },
+    {
+      'target_name': 'json_fuzzer_lib',
+      'type': 'static_library',
+      'dependencies': [
+        'fuzzer_support',
+      ],
+      'include_dirs': [
+        '../..',
+      ],
+      'sources': [  ### gcmole(all) ###
+        'json.cc',
+      ],
+    },
     {
       'target_name': 'parser_fuzzer',
       'type': 'executable',
@@ -91,6 +117,7 @@
           'target_name': 'fuzzer_run',
           'type': 'none',
           'dependencies': [
+            'json_fuzzer',
             'parser_fuzzer',
             'regexp_fuzzer',
           ],

test/fuzzer/fuzzer.isolate

@@ -5,10 +5,12 @@
 {
   'variables': {
     'files': [
+      '<(PRODUCT_DIR)/json_fuzzer<(EXECUTABLE_SUFFIX)',
       '<(PRODUCT_DIR)/parser_fuzzer<(EXECUTABLE_SUFFIX)',
       '<(PRODUCT_DIR)/regexp_fuzzer<(EXECUTABLE_SUFFIX)',
       './fuzzer.status',
       './testcfg.py',
+      './json/',
       './parser/',
       './regexp/',
     ],

test/fuzzer/json.cc

@@ -0,0 +1,31 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <limits.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#include "include/v8.h"
+#include "test/fuzzer/fuzzer-support.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
+  v8::Isolate* isolate = support->GetIsolate();
+
+  v8::Isolate::Scope isolate_scope(isolate);
+  v8::HandleScope handle_scope(isolate);
+  v8::Context::Scope context_scope(support->GetContext());
+  v8::TryCatch try_catch(isolate);
+
+  if (size > INT_MAX) return 0;
+  v8::Local<v8::String> source;
+  if (!v8::String::NewFromOneByte(isolate, data, v8::NewStringType::kNormal,
+                                  static_cast<int>(size))
+           .ToLocal(&source)) {
+    return 0;
+  }
+
+  v8::JSON::Parse(isolate, source).IsEmpty();
+  return 0;
+}

test/fuzzer/json/json

@@ -0,0 +1 @@
+{"json": 1}

test/fuzzer/json/not-json

@@ -0,0 +1 @@
+not json

test/fuzzer/parser.cc

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <limits.h>
 #include <stddef.h>
 #include <stdint.h>
 

test/fuzzer/regexp.cc

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <limits.h>
 #include <stddef.h>
 #include <stdint.h>
 

test/fuzzer/testcfg.py

@@ -18,7 +18,7 @@ class FuzzerVariantGenerator(testsuite.VariantGenerator):
 
 
 class FuzzerTestSuite(testsuite.TestSuite):
-  SUB_TESTS = ( 'parser', 'regexp', )
+  SUB_TESTS = ( 'json', 'parser', 'regexp', )
 
   def __init__(self, name, root):
     super(FuzzerTestSuite, self).__init__(name, root)