1 /*
2 * Copyright (c) 2023-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include <fuzzer/FuzzedDataProvider.h>
17 #include "ecmascript/base/string_helper.h"
18 #include "ecmascript/global_env.h"
19 #include "ecmascript/js_function.h"
20 #include "ecmascript/js_generator_object.h"
21 #include "ecmascript/js_tagged_value-inl.h"
22 #include "ecmascript/napi/include/jsnapi.h"
23 #include "ecmascript/napi/jsnapi_helper.h"
24 #include "jsvaluerefisasync_fuzzer.h"
25
26 using namespace panda;
27 using namespace panda::ecmascript;
28
29 namespace OHOS {
JSValueRefIsAsyncGeneratorFunctionTrueFuzzTest(const uint8_t * data,size_t size)30 void JSValueRefIsAsyncGeneratorFunctionTrueFuzzTest(const uint8_t* data, size_t size)
31 {
32 RuntimeOption option;
33 FuzzedDataProvider fdp(data, size);
34 const int arkProp = fdp.ConsumeIntegral<int>();
35 option.SetLogLevel(common::LOG_LEVEL::ERROR);
36 EcmaVM *vm = JSNApi::CreateJSVM(option);
37 {
38 JsiFastNativeScope scope(vm);
39 option.SetArkProperties(arkProp);
40 ObjectFactory *factory = vm->GetFactory();
41 MethodLiteral *methodLiteral = nullptr;
42 JSHandle<Method> method = factory->NewSMethod(methodLiteral);
43 JSHandle<JSFunction> asyncGeneratorFunction = factory->NewJSAsyncGeneratorFunction(method);
44 JSHandle<JSTaggedValue> asyncgefu = JSHandle<JSTaggedValue>::Cast(asyncGeneratorFunction);
45 Local<JSValueRef> object = JSNApiHelper::ToLocal<JSValueRef>(asyncgefu);
46 [[maybe_unused]] auto it = object->IsAsyncGeneratorFunction(vm);
47 }
48 JSNApi::DestroyJSVM(vm);
49 }
50
JSValueRefIsAsyncGeneratorFunctionFalseFuzzTest(const uint8_t * data,size_t size)51 void JSValueRefIsAsyncGeneratorFunctionFalseFuzzTest(const uint8_t* data, size_t size)
52 {
53 FuzzedDataProvider fdp(data, size);
54 const int arkProp = fdp.ConsumeIntegral<int>();
55 RuntimeOption option;
56 option.SetLogLevel(common::LOG_LEVEL::ERROR);
57 EcmaVM *vm = JSNApi::CreateJSVM(option);
58 Local<JSValueRef> object = IntegerRef::New(vm, arkProp);
59 object->IsAsyncGeneratorFunction(vm);
60 JSNApi::DestroyJSVM(vm);
61 }
62
JSValueRefIsAsyncGeneratorObjectTrueFuzzTest(const uint8_t * data,size_t size)63 void JSValueRefIsAsyncGeneratorObjectTrueFuzzTest(const uint8_t* data, size_t size)
64 {
65 FuzzedDataProvider fdp(data, size);
66 const int arkProp = fdp.ConsumeIntegral<int>();
67 RuntimeOption option;
68 option.SetLogLevel(common::LOG_LEVEL::ERROR);
69 EcmaVM *vm = JSNApi::CreateJSVM(option);
70 {
71 JsiFastNativeScope scope(vm);
72 option.SetArkProperties(arkProp);
73 ObjectFactory *factory = vm->GetFactory();
74 MethodLiteral *methodLiteral = nullptr;
75 JSHandle<Method> method = factory->NewSMethod(methodLiteral);
76 JSHandle<JSFunction> asyncGeneratorFunction = factory->NewJSAsyncGeneratorFunction(method);
77 JSHandle<JSTaggedValue> asyncgefu = JSHandle<JSTaggedValue>::Cast(asyncGeneratorFunction);
78 Local<JSValueRef> object = JSNApiHelper::ToLocal<JSValueRef>(asyncgefu);
79 [[maybe_unused]] auto it = object->IsAsyncGeneratorObject(vm);
80 }
81 JSNApi::DestroyJSVM(vm);
82 }
83
JSValueRefIsAsyncGeneratorObjectFalseFuzzTest(const uint8_t * data,size_t size)84 void JSValueRefIsAsyncGeneratorObjectFalseFuzzTest(const uint8_t* data, size_t size)
85 {
86 FuzzedDataProvider fdp(data, size);
87 const int arkProp = fdp.ConsumeIntegral<int>();
88 RuntimeOption option;
89 option.SetLogLevel(common::LOG_LEVEL::ERROR);
90 EcmaVM *vm = JSNApi::CreateJSVM(option);
91 Local<JSValueRef> object = IntegerRef::New(vm, arkProp);
92 object->IsAsyncGeneratorObject(vm);
93 JSNApi::DestroyJSVM(vm);
94 }
95 }
96
97 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)98 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
99 {
100 // Run your code on data.
101 OHOS::JSValueRefIsAsyncGeneratorFunctionTrueFuzzTest(data, size);
102 OHOS::JSValueRefIsAsyncGeneratorFunctionFalseFuzzTest(data, size);
103 OHOS::JSValueRefIsAsyncGeneratorObjectTrueFuzzTest(data, size);
104 OHOS::JSValueRefIsAsyncGeneratorObjectFalseFuzzTest(data, size);
105 return 0;
106 }