1e6d2cb319
On x64, trap handlers are enabled as part of the default configuration. However, each embedder has to enable trap handlers explicitly, and in the wasm fuzzers, trap handlers were not enabled. This CL enables trap handlers now in all wasm fuzzers. Drive-by change: enable all staged wasm features in the wasm-async fuzzer. R=clemensb@chromium.org Change-Id: Ib7c2addb092551b5554a2b74830e5b67db077909 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2362957 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#69500}
84 lines
3.2 KiB
C++
84 lines
3.2 KiB
C++
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
#include <limits.h>
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
|
|
#include "include/v8.h"
|
|
#include "src/execution/isolate-inl.h"
|
|
#include "src/heap/factory.h"
|
|
#include "src/objects/objects-inl.h"
|
|
#include "src/wasm/wasm-engine.h"
|
|
#include "src/wasm/wasm-feature-flags.h"
|
|
#include "src/wasm/wasm-module.h"
|
|
#include "test/common/wasm/flag-utils.h"
|
|
#include "test/common/wasm/wasm-module-runner.h"
|
|
#include "test/fuzzer/fuzzer-support.h"
|
|
#include "test/fuzzer/wasm-fuzzer-common.h"
|
|
|
|
namespace i = v8::internal;
|
|
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
|
if (V8_TRAP_HANDLER_SUPPORTED && i::FLAG_wasm_trap_handler) {
|
|
constexpr bool kUseDefaultTrapHandler = true;
|
|
if (!v8::V8::EnableWebAssemblyTrapHandler(kUseDefaultTrapHandler)) {
|
|
FATAL("Could not register trap handler");
|
|
}
|
|
}
|
|
|
|
// We explicitly enable staged WebAssembly features here to increase fuzzer
|
|
// coverage. For libfuzzer fuzzers it is not possible that the fuzzer enables
|
|
// the flag by itself.
|
|
#define ENABLE_STAGED_FEATURES(feat, desc, val) \
|
|
i::FlagScope<bool> enable_##feat(&i::FLAG_experimental_wasm_##feat, true);
|
|
FOREACH_WASM_STAGING_FEATURE_FLAG(ENABLE_STAGED_FEATURES)
|
|
#undef ENABLE_STAGED_FEATURES
|
|
|
|
// We reduce the maximum memory size and table size of WebAssembly instances
|
|
// to avoid OOMs in the fuzzer.
|
|
i::FlagScope<uint32_t> max_mem_flag_scope(&i::FLAG_wasm_max_mem_pages, 32);
|
|
i::FlagScope<uint32_t> max_mem_growth_flag_scope(
|
|
&i::FLAG_wasm_max_mem_pages_growth, 32);
|
|
i::FlagScope<uint32_t> max_table_size_scope(&i::FLAG_wasm_max_table_size,
|
|
100);
|
|
v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
|
|
v8::Isolate* isolate = support->GetIsolate();
|
|
i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
|
|
|
|
// Clear any pending exceptions from a prior run.
|
|
if (i_isolate->has_pending_exception()) {
|
|
i_isolate->clear_pending_exception();
|
|
}
|
|
|
|
v8::Isolate::Scope isolate_scope(isolate);
|
|
v8::HandleScope handle_scope(isolate);
|
|
v8::Context::Scope context_scope(support->GetContext());
|
|
v8::TryCatch try_catch(isolate);
|
|
i::wasm::testing::SetupIsolateForWasmModule(i_isolate);
|
|
i::wasm::ModuleWireBytes wire_bytes(data, data + size);
|
|
|
|
i::HandleScope scope(i_isolate);
|
|
i::wasm::ErrorThrower thrower(i_isolate, "wasm fuzzer");
|
|
i::Handle<i::WasmModuleObject> module_object;
|
|
auto enabled_features = i::wasm::WasmFeatures::FromIsolate(i_isolate);
|
|
bool compiles =
|
|
i_isolate->wasm_engine()
|
|
->SyncCompile(i_isolate, enabled_features, &thrower, wire_bytes)
|
|
.ToHandle(&module_object);
|
|
|
|
if (i::FLAG_wasm_fuzzer_gen_test) {
|
|
i::wasm::fuzzer::GenerateTestCase(i_isolate, wire_bytes, compiles);
|
|
}
|
|
|
|
if (compiles) {
|
|
i::wasm::fuzzer::InterpretAndExecuteModule(i_isolate, module_object);
|
|
}
|
|
|
|
// Pump the message loop and run micro tasks, e.g. GC finalization tasks.
|
|
support->PumpMessageLoop(v8::platform::MessageLoopBehavior::kDoNotWait);
|
|
isolate->PerformMicrotaskCheckpoint();
|
|
return 0;
|
|
}
|