AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[wasm] Add a fuzzer for async compilation

Browse Source 
The new fuzzer takes the fuzzer input as module bytes and compiles them
with WebAssembly asynchronous compilation.

R=mtrofin@chromium.org

Change-Id: I9740edec68e26c04d011d85c68521e340be13c4c
Reviewed-on: https://chromium-review.googlesource.com/506156
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45912}
This commit is contained in:
Andreas Haas 2017-06-13 16:41:54 +02:00 committed by Commit Bot
parent 849a08b871
commit 70c6830795
8 changed files with 206 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
BUILD.gn
View File

@ -2781,6 +2781,7 @@ group("v8_fuzzers") {
":v8_simple_parser_fuzzer",
":v8_simple_regexp_fuzzer",
":v8_simple_wasm_asmjs_fuzzer",
":v8_simple_wasm_async_fuzzer",
":v8_simple_wasm_call_fuzzer",
":v8_simple_wasm_code_fuzzer",
":v8_simple_wasm_compile_fuzzer",
@ -3132,6 +3133,26 @@ v8_source_set("wasm_asmjs_fuzzer") {
v8_fuzzer("wasm_asmjs_fuzzer") {
}
v8_source_set("wasm_async_fuzzer") {
sources = [
"test/fuzzer/wasm-async.cc",
]
deps = [
":fuzzer_support",
":lib_wasm_fuzzer_common",
":wasm_module_runner",
]
configs = [
":external_config",
":internal_config_base",
]
}
v8_fuzzer("wasm_async_fuzzer") {
}
v8_source_set("wasm_code_fuzzer") {
sources = [
"test/common/wasm/test-signatures.h",

9
test/fuzzer/fuzzer-support.cc
View File

@ -46,12 +46,14 @@ FuzzerSupport::FuzzerSupport(int* argc, char*** argv) {
v8::HandleScope handle_scope(isolate_);
context_.Reset(isolate_, v8::Context::New(isolate_));
}
v8::platform::EnsureEventLoopInitialized(platform_, isolate_);
}
FuzzerSupport::~FuzzerSupport() {
{
v8::Isolate::Scope isolate_scope(isolate_);
while (v8::platform::PumpMessageLoop(platform_, isolate_)) /* empty */
while (PumpMessageLoop()) /* empty */
;
v8::HandleScope handle_scope(isolate_);
@ -85,6 +87,11 @@ v8::Local<v8::Context> FuzzerSupport::GetContext() {
return handle_scope.Escape(context);
}
bool FuzzerSupport::PumpMessageLoop(
v8::platform::MessageLoopBehavior behavior) {
return v8::platform::PumpMessageLoop(platform_, isolate_, behavior);
}
} // namespace v8_fuzzer
extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) {

3
test/fuzzer/fuzzer-support.h
View File

@ -5,6 +5,7 @@
#ifndef TEST_FUZZER_FUZZER_SUPPORT_H_
#define TEST_FUZZER_FUZZER_SUPPORT_H_
#include "include/libplatform/libplatform.h"
#include "include/v8.h"
namespace v8_fuzzer {
@ -18,6 +19,8 @@ class FuzzerSupport {
v8::Isolate* GetIsolate() const;
v8::Local<v8::Context> GetContext();
bool PumpMessageLoop(v8::platform::MessageLoopBehavior =
v8::platform::MessageLoopBehavior::kDoNotWait);
private:
// Prevent copying. Not implemented.

44
test/fuzzer/fuzzer.gyp
View File

@ -25,6 +25,7 @@
'target_name': 'json_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -51,6 +52,7 @@
'target_name': 'parser_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -77,6 +79,7 @@
'target_name': 'regexp_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -103,6 +106,7 @@
'target_name': 'wasm_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -131,6 +135,7 @@
'target_name': 'wasm_asmjs_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -142,6 +147,35 @@
'../common/wasm/wasm-module-runner.h',
],
},
{
'target_name': 'v8_simple_wasm_async_fuzzer',
'type': 'executable',
'dependencies': [
'wasm_async_fuzzer_lib',
],
'include_dirs': [
'../..',
],
'sources': [
'fuzzer.cc',
],
},
{
'target_name': 'wasm_async_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
'../..',
],
'sources': [ ### gcmole(all) ###
'wasm-async.cc',
'../common/wasm/wasm-module-runner.cc',
'../common/wasm/wasm-module-runner.h',
],
},
{
'target_name': 'v8_simple_wasm_call_fuzzer',
'type': 'executable',
@ -159,6 +193,7 @@
'target_name': 'wasm_call_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -190,6 +225,7 @@
'target_name': 'wasm_code_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -221,6 +257,7 @@
'target_name': 'wasm_compile_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -252,6 +289,7 @@
'target_name': 'wasm_data_section_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -282,6 +320,7 @@
'target_name': 'wasm_function_sigs_section_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -312,6 +351,7 @@
'target_name': 'wasm_globals_section_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -342,6 +382,7 @@
'target_name': 'wasm_imports_section_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -372,6 +413,7 @@
'target_name': 'wasm_memory_section_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -402,6 +444,7 @@
'target_name': 'wasm_names_section_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [
@ -432,6 +475,7 @@
'target_name': 'wasm_types_section_fuzzer_lib',
'type': 'static_library',
'dependencies': [
'../../src/v8.gyp:v8_libplatform',
'fuzzer_support',
],
'include_dirs': [

2
test/fuzzer/fuzzer.isolate
View File

@ -10,6 +10,7 @@
'<(PRODUCT_DIR)/v8_simple_regexp_fuzzer<(EXECUTABLE_SUFFIX)',
'<(PRODUCT_DIR)/v8_simple_wasm_fuzzer<(EXECUTABLE_SUFFIX)',
'<(PRODUCT_DIR)/v8_simple_wasm_asmjs_fuzzer<(EXECUTABLE_SUFFIX)',
'<(PRODUCT_DIR)/v8_simple_wasm_async_fuzzer<(EXECUTABLE_SUFFIX)',
'<(PRODUCT_DIR)/v8_simple_wasm_call_fuzzer<(EXECUTABLE_SUFFIX)',
'<(PRODUCT_DIR)/v8_simple_wasm_code_fuzzer<(EXECUTABLE_SUFFIX)',
'<(PRODUCT_DIR)/v8_simple_wasm_compile_fuzzer<(EXECUTABLE_SUFFIX)',
@ -27,6 +28,7 @@
'./regexp/',
'./wasm/',
'./wasm_asmjs/',
'./wasm_async/',
'./wasm_call/',
'./wasm_code/',
'./wasm_compile/',

4
test/fuzzer/testcfg.py
View File

@ -18,8 +18,8 @@ class FuzzerVariantGenerator(testsuite.VariantGenerator):
class FuzzerTestSuite(testsuite.TestSuite):
SUB_TESTS = ( 'json', 'parser', 'regexp', 'wasm', 'wasm_asmjs', 'wasm_call',
'wasm_code', 'wasm_compile', 'wasm_data_section',
SUB_TESTS = ( 'json', 'parser', 'regexp', 'wasm', 'wasm_asmjs', 'wasm_async',
'wasm_call', 'wasm_code', 'wasm_compile', 'wasm_data_section',
'wasm_function_sigs_section', 'wasm_globals_section',
'wasm_imports_section', 'wasm_memory_section', 'wasm_names_section',
'wasm_types_section' )

122
test/fuzzer/wasm-async.cc Normal file
View File

@ -0,0 +1,122 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <limits.h>
#include <stddef.h>
#include <stdint.h>
#include "include/v8.h"
#include "src/factory.h"
#include "src/isolate-inl.h"
#include "src/isolate.h"
#include "src/objects-inl.h"
#include "src/objects.h"
#include "src/wasm/wasm-module.h"
#include "test/common/wasm/flag-utils.h"
#include "test/common/wasm/wasm-module-runner.h"
#include "test/fuzzer/fuzzer-support.h"
using namespace v8::internal;
using namespace v8::internal::wasm;
using namespace v8::internal::wasm::testing;
#define ASSIGN(type, var, expr) \
v8::Local<type> var; \
do { \
if (!expr.ToLocal(&var)) { \
DCHECK(i_isolate->has_scheduled_exception()); \
return 0; \
} else { \
DCHECK(!i_isolate->has_scheduled_exception()); \
} \
} while (false)
namespace v8 {
namespace internal {
class WasmModuleObject;
}
}
namespace {
// We need this helper function because we cannot use
// Handle<WasmModuleObject>::cast here. To use this function we would have to
// mark it with V8_EXPORT_PRIVATE, which is quite ugly in this case.
Handle<WasmModuleObject> ToWasmModuleObjectUnchecked(Handle<Object> that) {
return handle(reinterpret_cast<WasmModuleObject*>(*that));
}
}
void InstantiateCallback(const v8::FunctionCallbackInfo<v8::Value>& args) {
DCHECK_GE(args.Length(), 1);
v8::Isolate* isolate = args.GetIsolate();
v8::MicrotasksScope does_not_run_microtasks(
isolate, v8::MicrotasksScope::kDoNotRunMicrotasks);
v8::HandleScope scope(isolate);
v8::Local<v8::Value> module = args[0];
i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
ErrorThrower thrower(i_isolate, "WebAssembly Instantiation");
i::Handle<i::WasmModuleObject> module_obj = ToWasmModuleObjectUnchecked(
v8::Utils::OpenHandle(v8::Object::Cast(*module)));
i::MaybeHandle<WasmInstanceObject> maybe_instance =
i::wasm::SyncInstantiate(i_isolate, &thrower, module_obj,
Handle<JSReceiver>::null(), // imports
MaybeHandle<JSArrayBuffer>()); // memory
Handle<WasmInstanceObject> instance;
if (!maybe_instance.ToHandle(&instance)) {
return;
}
RunWasmModuleForTesting(i_isolate, instance, 0, nullptr, kWasmOrigin);
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
v8::internal::FlagScope<bool> turn_on_async_compile(
&v8::internal::FLAG_wasm_async_compilation, true);
v8::internal::FlagScope<uint32_t> max_mem_flag_scope(
&v8::internal::FLAG_wasm_max_mem_pages, 32);
v8::internal::FlagScope<uint32_t> max_table_size_scope(
&v8::internal::FLAG_wasm_max_table_size, 100);
v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
v8::Isolate* isolate = support->GetIsolate();
v8::internal::Isolate* i_isolate =
reinterpret_cast<v8::internal::Isolate*>(isolate);
// Clear any pending exceptions from a prior run.
if (i_isolate->has_pending_exception()) {
i_isolate->clear_pending_exception();
}
v8::Isolate::Scope isolate_scope(isolate);
v8::HandleScope handle_scope(isolate);
HandleScope internal_scope(i_isolate);
v8::Context::Scope context_scope(support->GetContext());
v8::TryCatch try_catch(isolate);
v8::internal::wasm::testing::SetupIsolateForWasmModule(i_isolate);
// Get the promise for async compilation.
ASSIGN(v8::Promise::Resolver, resolver,
v8::Promise::Resolver::New(support->GetContext()));
v8::Local<v8::Promise> promise = resolver->GetPromise();
AsyncCompile(i_isolate, v8::Utils::OpenHandle(*promise),
ModuleWireBytes(data, data + size));
ASSIGN(v8::Function, instantiate_impl,
v8::Function::New(support->GetContext(), &InstantiateCallback,
v8::Undefined(isolate)));
ASSIGN(v8::Promise, result,
promise->Then(support->GetContext(), instantiate_impl));
// Wait for the promise to resolve.
while (result->State() == v8::Promise::kPending) {
support->PumpMessageLoop(v8::platform::MessageLoopBehavior::kWaitForWork);
isolate->RunMicrotasks();
}
return 0;
}

4
test/fuzzer/wasm_async/README.md Normal file
View File

@ -0,0 +1,4 @@
All files in this directory are used by the trybots to check that the fuzzer
executes correctly, see
https://github.com/v8/v8/blob/master/test/fuzzer/README.md. There should be at
least one file in this directory, e.g. this README file.