javascript_parser_proto_fuzzer.cc 3.4 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include <stdlib.h>
  5. #include <iostream>
  6. #include "javascript_parser.pb.h" // from out/gen
  7. #include "testing/libfuzzer/fuzzers/javascript_parser_proto_to_string.h"
  8. #include "third_party/libprotobuf-mutator/src/src/libfuzzer/libfuzzer_macro.h"
  9. #include "v8/include/libplatform/libplatform.h"
  10. #include "v8/include/v8.h"
  11. // Silence logging from the protobuf library.
  12. protobuf_mutator::protobuf::LogSilencer log_silencer;
  13. v8::Isolate* isolate = nullptr;
  14. std::string protobuf_to_string(
  15. const javascript_parser_proto_fuzzer::Source& source_protobuf) {
  16. std::string source;
  17. for (const auto& token : source_protobuf.tokens()) {
  18. source += token_to_string(token, 0) + std::string(" ");
  19. }
  20. return source;
  21. }
  22. // Explicitly specify some attributes to avoid issues with the linker dead-
  23. // stripping the following function on macOS, as it is not called directly
  24. // by fuzz target. LibFuzzer runtime uses dlsym() to resolve that function.
  25. #if V8_OS_MACOS
  26. __attribute__((used)) __attribute__((visibility("default")))
  27. #endif // V8_OS_MACOS
  28. extern "C" int
  29. LLVMFuzzerInitialize(int* argc, char*** argv) {
  30. v8::V8::InitializeICUDefaultLocation((*argv)[0]);
  31. v8::V8::InitializeExternalStartupData((*argv)[0]);
  32. v8::V8::SetFlagsFromCommandLine(argc, *argv, true);
  33. // Intentionally leaked during fuzzing.
  34. v8::Platform* platform = v8::platform::NewDefaultPlatform().release();
  35. v8::V8::InitializePlatform(platform);
  36. v8::V8::Initialize();
  37. v8::Isolate::CreateParams create_params;
  38. create_params.array_buffer_allocator =
  39. v8::ArrayBuffer::Allocator::NewDefaultAllocator();
  40. isolate = v8::Isolate::New(create_params);
  41. return 0;
  42. }
  43. DEFINE_BINARY_PROTO_FUZZER(
  44. const javascript_parser_proto_fuzzer::Source& source_protobuf) {
  45. v8::Isolate::Scope isolate_scope(isolate);
  46. v8::HandleScope handle_scope(isolate);
  47. v8::Local<v8::Context> context = v8::Context::New(isolate);
  48. v8::Context::Scope context_scope(context);
  49. std::string source_string = protobuf_to_string(source_protobuf);
  50. if (getenv("LPM_DUMP_NATIVE_INPUT")) {
  51. std::cout << source_string << std::endl;
  52. std::cout << "module: " << source_protobuf.is_module() << std::endl;
  53. }
  54. v8::Local<v8::String> source_v8_string =
  55. v8::String::NewFromUtf8(isolate, source_string.c_str(),
  56. v8::NewStringType::kNormal)
  57. .ToLocalChecked();
  58. {
  59. v8::TryCatch try_catch(isolate);
  60. if (source_protobuf.is_module()) {
  61. v8::Local<v8::String> name =
  62. v8::String::NewFromUtf8(isolate, "module.js",
  63. v8::NewStringType::kNormal)
  64. .ToLocalChecked();
  65. v8::ScriptOrigin origin(isolate, name, 0, 0, false, -1,
  66. v8::Local<v8::Value>(), false, false, true);
  67. v8::ScriptCompiler::Source source(source_v8_string, origin);
  68. v8::MaybeLocal<v8::Module> module =
  69. v8::ScriptCompiler::CompileModule(isolate, &source);
  70. // TODO(marja): Figure out a more elegant way to silence the warning.
  71. module.IsEmpty();
  72. } else {
  73. v8::MaybeLocal<v8::Script> script =
  74. v8::Script::Compile(context, source_v8_string);
  75. // TODO(marja): Figure out a more elegant way to silence the warning.
  76. script.IsEmpty();
  77. }
  78. // TODO(crbug.com/775796): run the code once we find a way to avoid endless
  79. // loops.
  80. }
  81. }