e9440c45fa
We unify the implementation of element segment expression entries with
other initializer expressions: we represent them with a {WireBytesRef}
and decode them with {InitExprInterface}. Except for reducing code
duplication, this also fixes a bug where {global.get} entries in element
segments could reference invalid globals.
Changes:
- Change {WasmElemSegment::Entry} to a union of a {WireBytesRef}
initializer expression and a {uint32_t} function index.
- In module-decoder, change parsing of expression entries to use
{consume_init_expr}. Add type checking to
{consume_element_func_index}, to complement type checking happening in
{consume_init_expr}.
- In module-instantiate.cc:
- Move instantiation of indirect tables before loading of element
segments. This way, when we call {UpdateDispatchTables} in
{SetTableEntry}, the indirect table for the current table will also
be updated.
- Consolidate table entry instantiation into {SetTableEntry}, which
handles lazily instantiated functions, or dispatches to
{WasmTableObject::Set}.
- Rename {InitializeIndirectFunctionTables} to
{InitializeNonDefaultableTables}.
- Change {InitializeNonDefaultableTables} and {LoadElemSegmentImpl}
to use {EvaluateInitExpression}.
- Add a test to exclude mutable/non-imported globals from the element
section.
- Update tests as needed.
- Update .js module emission in wasm-fuzzer-common.
Change-Id: I29c541bbca8531e8d0312ed95869c8e78a5a0c57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3364082
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78476}
|
||
|---|---|---|
| .. | ||
| inspector | ||
| json | ||
| multi_return | ||
| parser | ||
| regexp | ||
| regexp_builtins | ||
| wasm | ||
| wasm_async | ||
| wasm_code | ||
| wasm_compile | ||
| BUILD.gn | ||
| DEPS | ||
| fuzzer-support.cc | ||
| fuzzer-support.h | ||
| fuzzer.cc | ||
| fuzzer.status | ||
| inspector-fuzzer.cc | ||
| json.cc | ||
| multi-return.cc | ||
| parser.cc | ||
| README.md | ||
| regexp-builtins.cc | ||
| regexp.cc | ||
| testcfg.py | ||
| wasm_corpus.tar.gz.sha1 | ||
| wasm-async.cc | ||
| wasm-code.cc | ||
| wasm-compile.cc | ||
| wasm-fuzzer-common.cc | ||
| wasm-fuzzer-common.h | ||
| wasm.cc | ||
How to make a libFuzzer fuzzer in V8
This document describes how to make a new libFuzzer fuzzer for V8. A general introduction to libFuzzer can be found here. In short, libFuzzer is an in-process coverage-driven evolutionary fuzzer. libFuzzer serves you with a sequence of byte arrays that you can use to test your code. libFuzzer tries to generate this sequence of byte arrays in a way that maximizes test coverage.
Warning: By itself libFuzzer typically does not generate valid JavaScript code.
Changes to V8
tldr: Do the same as https://codereview.chromium.org/2280623002 to introduce a new fuzzer to V8.
This is a step by step guide on how to make a new fuzzer in V8. In the example
the fuzzer is called foo.
-
Copy one of the existing fuzzer implementations in test/fuzzer/, e.g.
cp wasm.cc foo.cc- Copying an existing fuzzer is a good idea to get all the required setup, e.g. setting up the isolate
-
Create a directory called
fooin test/fuzzer/ which contains at least one file- The file is used by the trybots to check whether the fuzzer actually compiles and runs
-
Copy the build rules of an existing fuzzer in BUILD.gn, e.g. the build rules for the wasm.cc fuzzer are
v8_source_set("wasm_fuzzer")andv8_fuzzer("wasm_fuzzer"). Note that the name has to be the name of the directory created in Step 2 +_fuzzerso that the scripts on the trybots work -
Now you can already compile the fuzzer, e.g. with
ninja -j 1000 -C out/x64.debug/v8_simple_foo_fuzzer- Use this binary to reproduce issues found by cluster fuzz, e.g.
out/x64.debug/v8_simple_foo_fuzzer testcase.foo
- Use this binary to reproduce issues found by cluster fuzz, e.g.
-
Copy the binary name and the test directory name in test/fuzzer/fuzzer.isolate
-
Add the fuzzer to the FuzzerTestSuite in test/fuzzer/testcfg.py
- This step is needed to run the fuzzer with the files created in Step 2 on the trybots
-
Commit the changes described above to the V8 repository
Changes to Chromium
tldr: Do the same as https://codereview.chromium.org/2344823002 to add the new fuzzer to cluster fuzz.
-
Copy the build rules of an existing fuzzer in testing/libfuzzer/fuzzers/BUILD.gn, e.g. the build rule for the wasm.cc fuzzer is
v8_wasm_fuzzer. There is no need to set adictionary, or aseed_corpus. See chromium-fuzzing-getting-started for more information. -
Compile the fuzzer in chromium (for different configurations see: https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md):
-
gn gen out/libfuzzer '--args=use_libfuzzer=true is_asan=true is_debug=false enable_nacl=false' -
ninja -j 1000 -C out/libfuzzer/ v8_foo_fuzzer
-
-
Run the fuzzer locally
mkdir /tmp/empty_corpus && out/libfuzzer/v8_foo_fuzzer /tmp/empty_corpus