b556c9eaa6
This is the second V8 CL to refactor WebAssembly.instantiateStreaming to make it spec compliant again. The design doc where the whole change is discussed is available in the tracking bug. The tracking bug also references prototype implementations of the whole change, which includes the changes in this CL. R=mstarzinger@chromium.org Bug: chromium:860637 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I776c0f24959ab5663727d3dfee0248a9b0642a42 Reviewed-on: https://chromium-review.googlesource.com/1143187 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#54834}
87 lines
2.6 KiB
C++
87 lines
2.6 KiB
C++
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
#include <limits.h>
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
|
|
#include "include/v8.h"
|
|
#include "src/api.h"
|
|
#include "src/heap/factory.h"
|
|
#include "src/isolate-inl.h"
|
|
#include "src/objects-inl.h"
|
|
#include "src/wasm/wasm-engine.h"
|
|
#include "src/wasm/wasm-module.h"
|
|
#include "test/common/wasm/flag-utils.h"
|
|
#include "test/common/wasm/wasm-module-runner.h"
|
|
#include "test/fuzzer/fuzzer-support.h"
|
|
#include "test/fuzzer/wasm-fuzzer-common.h"
|
|
|
|
namespace v8 {
|
|
namespace internal {
|
|
class WasmModuleObject;
|
|
|
|
namespace wasm {
|
|
namespace fuzzer {
|
|
|
|
class AsyncFuzzerResolver : public i::wasm::CompilationResultResolver {
|
|
public:
|
|
AsyncFuzzerResolver(i::Isolate* isolate, bool* done)
|
|
: isolate_(isolate), done_(done) {}
|
|
|
|
void OnCompilationSucceeded(i::Handle<i::WasmModuleObject> module) override {
|
|
*done_ = true;
|
|
InterpretAndExecuteModule(isolate_, module);
|
|
}
|
|
|
|
void OnCompilationFailed(i::Handle<i::Object> error_reason) override {
|
|
*done_ = true;
|
|
}
|
|
|
|
private:
|
|
i::Isolate* isolate_;
|
|
bool* done_;
|
|
};
|
|
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
|
FlagScope<bool> turn_on_async_compile(
|
|
&v8::internal::FLAG_wasm_async_compilation, true);
|
|
FlagScope<uint32_t> max_mem_flag_scope(&v8::internal::FLAG_wasm_max_mem_pages,
|
|
32);
|
|
FlagScope<uint32_t> max_table_size_scope(
|
|
&v8::internal::FLAG_wasm_max_table_size, 100);
|
|
v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
|
|
v8::Isolate* isolate = support->GetIsolate();
|
|
i::Isolate* i_isolate = reinterpret_cast<v8::internal::Isolate*>(isolate);
|
|
|
|
// Clear any pending exceptions from a prior run.
|
|
if (i_isolate->has_pending_exception()) {
|
|
i_isolate->clear_pending_exception();
|
|
}
|
|
|
|
v8::Isolate::Scope isolate_scope(isolate);
|
|
v8::HandleScope handle_scope(isolate);
|
|
i::HandleScope internal_scope(i_isolate);
|
|
v8::Context::Scope context_scope(support->GetContext());
|
|
TryCatch try_catch(isolate);
|
|
testing::SetupIsolateForWasmModule(i_isolate);
|
|
|
|
bool done = false;
|
|
i_isolate->wasm_engine()->AsyncCompile(
|
|
i_isolate, std::make_shared<AsyncFuzzerResolver>(i_isolate, &done),
|
|
ModuleWireBytes(data, data + size), false);
|
|
|
|
// Wait for the promise to resolve.
|
|
while (!done) {
|
|
support->PumpMessageLoop(platform::MessageLoopBehavior::kWaitForWork);
|
|
isolate->RunMicrotasks();
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
} // namespace fuzzer
|
|
} // namespace wasm
|
|
} // namespace internal
|
|
} // namespace v8
|