Commit Graph

25 Commits

Author SHA1 Message Date
ahaas
19522d8e0f [wasm] Pass the same parameters to the interpreter and the compiled module in the fuzzer.
BUG=chromium:646564

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2336363003
Cr-Commit-Position: refs/heads/master@{#39405}
2016-09-14 08:26:53 +00:00
mtrofin
8e5ac62ddf [wasm] Compilation/Instantiation pipeline works off module object
Moved the compilation/instantiation pipeline to work off the
module object (JSObject), making the compiled module data (the
FixedArray) an implementation detail. This:
- simplifies the code by removing duplicate decode->compile->instantiate
sequences
- sets up the stage for "dressing up" the runtime model with
stronger typed APIs
- helps relanding this CL: https://codereview.chromium.org/2305903002/.
  It turns out that GCs during the cloning/instantiation events cause
trouble, and centering the source of truth on the module object helps
address this issue.

In the process, clarified cctest setup for wasm-capable isolates,
and changed signatures for consistency (using ModuleOrigin througout).

BUG=

Review-Url: https://codereview.chromium.org/2320723005
Cr-Commit-Position: refs/heads/master@{#39360}
2016-09-12 22:11:56 +00:00
ahaas
1521fe9c3c [wasm] Call the wasm interpreter from the wasm-code-fuzzer.
With this CL the wasm-code-fuzzer first decodes and interprets the test
case generated by the fuzzer. It then compiles the test case, but only
executes the compiled instance if the interpretation of the test case
was successful. If the compiled instance is executed, then the result of
the execution is compared with the result of the interpretation.

Additionally this CL refactors the CompileAndRunWasmModule function in
wasm-module.cc to resuse code in the call to the interpreter.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2321443002
Cr-Commit-Position: refs/heads/master@{#39351}
2016-09-12 12:26:46 +00:00
bradnelson
b42e12cd4a [wasm] Pull in fresher fuzzer binaries.
BUG=None
TEST=None
R=mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2290803002
Cr-Commit-Position: refs/heads/master@{#38989}
2016-08-29 19:44:23 +00:00
bradnelson
08639b5b77 [WASM] Adding fuzzing binaries for wasm, and script to update them.
This adds:
* A script (tools/update-wasm-fuzzers.sh), which creates a new fuzzing seed
  corpus and uploads to google storage (you must have the right credentials).
* A new pair of DEPS entries to pull in the current version of the corpus
  based on a checked in pair of hash files.

BUG=None
TEST=None
R=ahaas@chromium.org,kcc@chromium.org,mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2273303002
Cr-Commit-Position: refs/heads/master@{#38987}
2016-08-29 19:01:48 +00:00
ahaas
cb259fbd39 [wasm] Create a new fuzzer for wasm code.
The new fuzzer constructs a dummy module header and uses the fuzzer
data only as function code.

R=titzer@chromium.org, jochen@chromium.org

Review-Url: https://codereview.chromium.org/2280623002
Cr-Commit-Position: refs/heads/master@{#38983}
2016-08-29 13:56:00 +00:00
marja
f9d6076115 Cleanup: Move ParseInfo to a separate file.
This makes us able to get rid of dependencies to parser.h from places
which only need the ParseInfo, and also gets rid of the curious Parser
<-> Compiler circular dependency.

Also IWYUd where necessary.

BUG=

Review-Url: https://codereview.chromium.org/2268513002
Cr-Commit-Position: refs/heads/master@{#38777}
2016-08-22 11:33:58 +00:00
jgruber
a53d468747 Properly handle exceptions in cctests
Thrown exceptions must be handled before another exception is thrown.
This fixes all remaining test failures exposed by not clearing pending
exceptions in JSEntryStub.

BUG=v8:5259

Review-Url: https://codereview.chromium.org/2207923002
Cr-Commit-Position: refs/heads/master@{#38324}
2016-08-04 07:22:11 +00:00
jochen
356a85be5d Provide a convenience array buffer allocator
BUG=none
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2101413002
Cr-Commit-Position: refs/heads/master@{#37365}
2016-06-29 07:42:40 +00:00
adamk
c7eb436d09 Remove all harmony runtime flags which shipped in M51
Flags removed (all begin with "harmony-"):
  function-name
  instanceof
  iterator-close
  unicode-regexps
  regexp-exec
  regexp-subclass
  species

BUG=v8:3566, v8:3648, v8:3699, v8:4093, v8:4447, v8:4602

Review-Url: https://codereview.chromium.org/2096933002
Cr-Commit-Position: refs/heads/master@{#37235}
2016-06-24 01:13:10 +00:00
mtrofin
0b98dbcc1e [wasm] Consolidate CompileAndRunWasmModule
Remove second wasm module compilation and instantiation path that
we had in CompileAndRunWasmModule and reuse the same path used
by user code.

BUG=

Review-Url: https://codereview.chromium.org/2091533002
Cr-Commit-Position: refs/heads/master@{#37203}
2016-06-22 21:39:14 +00:00
machenbach
cec0ed0f77 [icu] Support loading data file from default location
This allows using icu data, bundled in the icudtl.dat file,
to be loaded automatically from a default location
side-by-side with the executable.

The v8 stand-alone default is still to use statically
linked ICU data, but this will be switched in a separate
follow-up CL.

BUG=chromium:616033
LOG=y

Review-Url: https://codereview.chromium.org/2042253002
Cr-Commit-Position: refs/heads/master@{#36823}
2016-06-08 12:11:34 +00:00
machenbach
63526069c2 [gn] Add fuzzer targets.
This adds the v8-side fuzzer executables for smoke testing.
This also renames the old gyp targets to stay consistent
with chromium.

Naming convention for type X after the rename:
library: X_fuzzer (gn), X_fuzzer_lib (gyp)
executable v8: v8_simple_X_fuzzer
executable chromium: v8_X_fuzzer

BUG=chromium:474921

Review-Url: https://codereview.chromium.org/2032363002
Cr-Commit-Position: refs/heads/master@{#36713}
2016-06-03 13:12:58 +00:00
jochen
fbe0f303a2 [fuzzer] Force a GC before shutting down isolates
We just deleted a persistent the line before, so make sure the context
is cleared up before disposing the isolate

R=ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1953253003
Cr-Commit-Position: refs/heads/master@{#36078}
2016-05-06 12:53:29 +00:00
machenbach
3bf44848c3 [gn] Move build to gypfiles
This prepares for pulling chromium's build as dependency for
gn. After this, the files in build and gypfiles need to stay
in sync until chromium is updated.

BUG=chromium:474921
LOG=n

Review-Url: https://codereview.chromium.org/1848553003
Cr-Commit-Position: refs/heads/master@{#35898}
2016-04-29 10:11:11 +00:00
mmoroz
6474898082 Add GC request to libFuzzers in attempt to avoid parasitic coverage.
R=aizatsky@chromium.org, jochen@chromium.org, kcc@chromium.org, ochang@chromium.org
BUG=584819
LOG=Y

Review-Url: https://codereview.chromium.org/1927933002
Cr-Commit-Position: refs/heads/master@{#35866}
2016-04-28 13:32:28 +00:00
machenbach
cb855fe728 [build] Prepare moving v8.gyp to src/
This will allow to pull in gyp as a deps to the same location
as chromium (tools/gyp not build/gyp), needed for gn switch.

This is the first step of a 3-way move.
1) Copy v8.gyp in v8
2) Update references in embedders (follow up)
3) Remove old v8.gyp (follow up)

BUG=chromium:474921
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1920793002

Cr-Commit-Position: refs/heads/master@{#35760}
2016-04-25 12:20:24 +00:00
haavardm
0ba934d7bf Expose JSON stringifier through V8 API
BUG=602659
LOG=N

Review URL: https://codereview.chromium.org/1891203002

Cr-Commit-Position: refs/heads/master@{#35543}
2016-04-15 18:24:28 +00:00
jochen
cb7aa79b12 Expose a lower bound of malloc'd memory via heap statistics
We expect that the majority of malloc'd memory held by V8 is allocated
in Zone objects. Introduce an Allocator class that is used by Zones to
manage memory, and allows for querying the current usage.

BUG=none
R=titzer@chromium.org,bmeurer@chromium.org,jarin@chromium.org
LOG=n
TBR=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1847543002

Cr-Commit-Position: refs/heads/master@{#35196}
2016-04-01 10:01:56 +00:00
bradnelson
f521e7e43e Reset isolate exceptions in libfuzzer wasm tests.
BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=wasm-fuzzer
R=titzer@chromium.org,kcc@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1760033002

Cr-Commit-Position: refs/heads/master@{#34451}
2016-03-03 00:05:03 +00:00
bradnelson
cb028ac0e4 Adding Wasm + Wasm-asm variant fuzzer.
Fixing a memory leak in CompileAndRunModule.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=wasm-fuzzer
R=jochen@chromium.org,jarin@chromium.org,kcc@chromium.org,machenbach@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1738943004

Cr-Commit-Position: refs/heads/master@{#34415}
2016-03-02 00:54:08 +00:00
jochen
52f6c85468 Add json fuzzer
BUG=chromium:577261
R=machenbach@chromium.org,yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1652963002

Cr-Commit-Position: refs/heads/master@{#33673}
2016-02-02 11:29:01 +00:00
yangguo
4da26845d0 [regexp, fuzzer] improve regexp fuzzer coverage.
R=jochen@chromium.org, machenbach@chromium.org
BUG=chromium:577261
LOG=N

Review URL: https://codereview.chromium.org/1660463002

Cr-Commit-Position: refs/heads/master@{#33661}
2016-02-02 09:23:42 +00:00
yangguo
9f5dca8faa [regexp] add fuzzer support for regexp parser and compiler.
R=jochen@chromium.org
BUG=chromium:577261
LOG=N

Review URL: https://codereview.chromium.org/1655853002

Cr-Commit-Position: refs/heads/master@{#33640}
2016-02-01 14:00:38 +00:00
jochen
cf0435881c Add a library suitable for libfuzzer with a small unit test runner shell
BUG=chromium:577261
R=machenbach@chromium.org,jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1604203002

Cr-Commit-Position: refs/heads/master@{#33508}
2016-01-26 10:39:03 +00:00