[wasm] Create a new fuzzer for wasm code.
The new fuzzer constructs a dummy module header and uses the fuzzer data only as function code. R=titzer@chromium.org, jochen@chromium.org Review-Url: https://codereview.chromium.org/2280623002 Cr-Commit-Position: refs/heads/master@{#38983}
This commit is contained in:
parent
25e2d1588e
commit
cb259fbd39
15
BUILD.gn
15
BUILD.gn
@ -2584,3 +2584,18 @@ v8_source_set("wasm_asmjs_fuzzer") {
|
||||
|
||||
v8_fuzzer("wasm_asmjs_fuzzer") {
|
||||
}
|
||||
|
||||
v8_source_set("wasm_code_fuzzer") {
|
||||
sources = [
|
||||
"test/fuzzer/wasm-code.cc",
|
||||
]
|
||||
|
||||
deps = [
|
||||
":fuzzer_support",
|
||||
]
|
||||
|
||||
configs = [ ":internal_config" ]
|
||||
}
|
||||
|
||||
v8_fuzzer("wasm_code_fuzzer") {
|
||||
}
|
||||
|
@ -138,6 +138,32 @@
|
||||
'wasm-asmjs.cc',
|
||||
],
|
||||
},
|
||||
{
|
||||
'target_name': 'v8_simple_wasm_code_fuzzer',
|
||||
'type': 'executable',
|
||||
'dependencies': [
|
||||
'wasm_code_fuzzer_lib',
|
||||
],
|
||||
'include_dirs': [
|
||||
'../..',
|
||||
],
|
||||
'sources': [
|
||||
'fuzzer.cc',
|
||||
],
|
||||
},
|
||||
{
|
||||
'target_name': 'wasm_code_fuzzer_lib',
|
||||
'type': 'static_library',
|
||||
'dependencies': [
|
||||
'fuzzer_support',
|
||||
],
|
||||
'include_dirs': [
|
||||
'../..',
|
||||
],
|
||||
'sources': [ ### gcmole(all) ###
|
||||
'wasm-code.cc',
|
||||
],
|
||||
},
|
||||
{
|
||||
'target_name': 'fuzzer_support',
|
||||
'type': 'static_library',
|
||||
|
@ -10,6 +10,7 @@
|
||||
'<(PRODUCT_DIR)/v8_simple_regexp_fuzzer<(EXECUTABLE_SUFFIX)',
|
||||
'<(PRODUCT_DIR)/v8_simple_wasm_fuzzer<(EXECUTABLE_SUFFIX)',
|
||||
'<(PRODUCT_DIR)/v8_simple_wasm_asmjs_fuzzer<(EXECUTABLE_SUFFIX)',
|
||||
'<(PRODUCT_DIR)/v8_simple_wasm_code_fuzzer<(EXECUTABLE_SUFFIX)',
|
||||
'./fuzzer.status',
|
||||
'./testcfg.py',
|
||||
'./json/',
|
||||
@ -17,6 +18,7 @@
|
||||
'./regexp/',
|
||||
'./wasm/',
|
||||
'./wasm_asmjs/',
|
||||
'./wasm_code/',
|
||||
],
|
||||
},
|
||||
'includes': [
|
||||
|
@ -18,7 +18,7 @@ class FuzzerVariantGenerator(testsuite.VariantGenerator):
|
||||
|
||||
|
||||
class FuzzerTestSuite(testsuite.TestSuite):
|
||||
SUB_TESTS = ( 'json', 'parser', 'regexp', 'wasm', 'wasm_asmjs', )
|
||||
SUB_TESTS = ( 'json', 'parser', 'regexp', 'wasm', 'wasm_asmjs', 'wasm_code' )
|
||||
|
||||
def __init__(self, name, root):
|
||||
super(FuzzerTestSuite, self).__init__(name, root)
|
||||
|
54
test/fuzzer/wasm-code.cc
Normal file
54
test/fuzzer/wasm-code.cc
Normal file
@ -0,0 +1,54 @@
|
||||
// Copyright 2016 the V8 project authors. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style license that can be
|
||||
// found in the LICENSE file.
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include "include/v8.h"
|
||||
#include "src/isolate.h"
|
||||
#include "src/wasm/encoder.h"
|
||||
#include "src/wasm/wasm-js.h"
|
||||
#include "src/wasm/wasm-module.h"
|
||||
#include "test/cctest/wasm/test-signatures.h"
|
||||
#include "test/fuzzer/fuzzer-support.h"
|
||||
|
||||
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
||||
v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
|
||||
v8::Isolate* isolate = support->GetIsolate();
|
||||
v8::internal::Isolate* i_isolate =
|
||||
reinterpret_cast<v8::internal::Isolate*>(isolate);
|
||||
|
||||
// Clear any pending exceptions from a prior run.
|
||||
if (i_isolate->has_pending_exception()) {
|
||||
i_isolate->clear_pending_exception();
|
||||
}
|
||||
|
||||
v8::Isolate::Scope isolate_scope(isolate);
|
||||
v8::HandleScope handle_scope(isolate);
|
||||
v8::Context::Scope context_scope(support->GetContext());
|
||||
v8::TryCatch try_catch(isolate);
|
||||
|
||||
v8::base::AccountingAllocator allocator;
|
||||
v8::internal::Zone zone(&allocator);
|
||||
|
||||
v8::internal::wasm::TestSignatures sigs;
|
||||
|
||||
v8::internal::wasm::WasmModuleBuilder builder(&zone);
|
||||
|
||||
uint16_t f1_index = builder.AddFunction();
|
||||
v8::internal::wasm::WasmFunctionBuilder* f = builder.FunctionAt(f1_index);
|
||||
f->SetSignature(sigs.i_iii());
|
||||
f->EmitCode(data, static_cast<uint32_t>(size));
|
||||
f->SetExported();
|
||||
f->SetName("main", 4);
|
||||
|
||||
v8::internal::wasm::ZoneBuffer buffer(&zone);
|
||||
builder.WriteTo(buffer);
|
||||
|
||||
v8::internal::WasmJs::InstallWasmFunctionMap(i_isolate,
|
||||
i_isolate->native_context());
|
||||
v8::internal::wasm::testing::CompileAndRunWasmModule(
|
||||
i_isolate, buffer.begin(), buffer.end(), false);
|
||||
return 0;
|
||||
}
|
0
test/fuzzer/wasm_code/foo
Normal file
0
test/fuzzer/wasm_code/foo
Normal file
Loading…
Reference in New Issue
Block a user