1 // Copyright 2017 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include <stdlib.h>
6
7 #include <iostream>
8
9 #include "javascript_parser.pb.h" // from out/gen
10 #include "testing/libfuzzer/fuzzers/javascript_parser_proto_to_string.h"
11 #include "third_party/libprotobuf-mutator/src/src/libfuzzer/libfuzzer_macro.h"
12
13 #include "v8/include/libplatform/libplatform.h"
14 #include "v8/include/v8.h"
15
16 // Silence logging from the protobuf library.
17 protobuf_mutator::protobuf::LogSilencer log_silencer;
18
19 v8::Isolate* isolate = nullptr;
20
protobuf_to_string(const javascript_parser_proto_fuzzer::Source & source_protobuf)21 std::string protobuf_to_string(
22 const javascript_parser_proto_fuzzer::Source& source_protobuf) {
23 std::string source;
24 for (const auto& token : source_protobuf.tokens()) {
25 source += token_to_string(token, 0) + std::string(" ");
26 }
27 return source;
28 }
29
30 // Explicitly specify some attributes to avoid issues with the linker dead-
31 // stripping the following function on macOS, as it is not called directly
32 // by fuzz target. LibFuzzer runtime uses dlsym() to resolve that function.
33 #if V8_OS_MACOS
34 __attribute__((used)) __attribute__((visibility("default")))
35 #endif // V8_OS_MACOS
36 extern "C" int
LLVMFuzzerInitialize(int * argc,char *** argv)37 LLVMFuzzerInitialize(int* argc, char*** argv) {
38 v8::V8::InitializeICUDefaultLocation((*argv)[0]);
39 v8::V8::InitializeExternalStartupData((*argv)[0]);
40 v8::V8::SetFlagsFromCommandLine(argc, *argv, true);
41
42 // Intentionally leaked during fuzzing.
43 v8::Platform* platform = v8::platform::NewDefaultPlatform().release();
44 v8::V8::InitializePlatform(platform);
45 v8::V8::Initialize();
46
47 v8::Isolate::CreateParams create_params;
48 create_params.array_buffer_allocator =
49 v8::ArrayBuffer::Allocator::NewDefaultAllocator();
50 isolate = v8::Isolate::New(create_params);
51 return 0;
52 }
53
DEFINE_BINARY_PROTO_FUZZER(const javascript_parser_proto_fuzzer::Source & source_protobuf)54 DEFINE_BINARY_PROTO_FUZZER(
55 const javascript_parser_proto_fuzzer::Source& source_protobuf) {
56 v8::Isolate::Scope isolate_scope(isolate);
57 v8::HandleScope handle_scope(isolate);
58 v8::Local<v8::Context> context = v8::Context::New(isolate);
59 v8::Context::Scope context_scope(context);
60
61 std::string source_string = protobuf_to_string(source_protobuf);
62
63 if (getenv("LPM_DUMP_NATIVE_INPUT")) {
64 std::cout << source_string << std::endl;
65 std::cout << "module: " << source_protobuf.is_module() << std::endl;
66 }
67 v8::Local<v8::String> source_v8_string =
68 v8::String::NewFromUtf8(isolate, source_string.c_str(),
69 v8::NewStringType::kNormal)
70 .ToLocalChecked();
71
72 {
73 v8::TryCatch try_catch(isolate);
74
75 if (source_protobuf.is_module()) {
76 v8::Local<v8::String> name =
77 v8::String::NewFromUtf8(isolate, "module.js",
78 v8::NewStringType::kNormal)
79 .ToLocalChecked();
80
81 v8::ScriptOrigin origin(isolate, name, 0, 0, false, -1,
82 v8::Local<v8::Value>(), false, false, true);
83 v8::ScriptCompiler::Source source(source_v8_string, origin);
84 v8::MaybeLocal<v8::Module> module =
85 v8::ScriptCompiler::CompileModule(isolate, &source);
86 // TODO(marja): Figure out a more elegant way to silence the warning.
87 module.IsEmpty();
88 } else {
89 v8::MaybeLocal<v8::Script> script =
90 v8::Script::Compile(context, source_v8_string);
91 // TODO(marja): Figure out a more elegant way to silence the warning.
92 script.IsEmpty();
93 }
94
95 // TODO(crbug.com/775796): run the code once we find a way to avoid endless
96 // loops.
97 }
98 }
99