1 // Copyright 2017 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include <stdlib.h>
6
7 #include <iostream>
8
9 #include "base/memory/raw_ptr.h"
10 #include "javascript_parser.pb.h" // from out/gen
11 #include "testing/libfuzzer/fuzzers/javascript_parser_proto_to_string.h"
12 #include "testing/libfuzzer/libfuzzer_exports.h"
13 #include "third_party/libprotobuf-mutator/src/src/libfuzzer/libfuzzer_macro.h"
14
15 #include "v8/include/libplatform/libplatform.h"
16 #include "v8/include/v8.h"
17
18 // Silence logging from the protobuf library.
19 protobuf_mutator::protobuf::LogSilencer log_silencer;
20
21 // Encapsulates process-wide v8 state, initialized once per fuzzing session.
22 class Environment {
23 public:
24 // Returns the singleton v8 environment.
Get()25 static Environment& Get() {
26 // Defining this as a static function variable instead of a global avoids
27 // LSAN complaining about a leak.
28 // See also: https://llvm.org/docs/LibFuzzer.html#startup-initialization
29 static Environment environment;
30 return environment;
31 }
32
isolate()33 v8::Isolate* isolate() { return isolate_; }
34
35 private:
Environment()36 Environment() {
37 platform_ = v8::platform::NewDefaultPlatform();
38 v8::V8::InitializePlatform(platform_.get());
39 v8::V8::Initialize();
40
41 v8::Isolate::CreateParams create_params;
42 create_params.array_buffer_allocator =
43 v8::ArrayBuffer::Allocator::NewDefaultAllocator();
44 isolate_ = v8::Isolate::New(create_params);
45 }
46
47 std::unique_ptr<v8::Platform> platform_;
48 raw_ptr<v8::Isolate> isolate_ = nullptr;
49 };
50
protobuf_to_string(const javascript_parser_proto_fuzzer::Source & source_protobuf)51 std::string protobuf_to_string(
52 const javascript_parser_proto_fuzzer::Source& source_protobuf) {
53 std::string source;
54 for (const auto& token : source_protobuf.tokens()) {
55 source += token_to_string(token, 0) + std::string(" ");
56 }
57 return source;
58 }
59
60 extern "C" int
LLVMFuzzerInitialize(int * argc,char *** argv)61 LLVMFuzzerInitialize(int* argc, char*** argv) {
62 v8::V8::InitializeICUDefaultLocation((*argv)[0]);
63 v8::V8::InitializeExternalStartupData((*argv)[0]);
64 v8::V8::SetFlagsFromCommandLine(argc, *argv, true);
65 return 0;
66 }
67
DEFINE_BINARY_PROTO_FUZZER(const javascript_parser_proto_fuzzer::Source & source_protobuf)68 DEFINE_BINARY_PROTO_FUZZER(
69 const javascript_parser_proto_fuzzer::Source& source_protobuf) {
70 v8::Isolate* isolate = Environment::Get().isolate();
71
72 v8::Isolate::Scope isolate_scope(isolate);
73 v8::HandleScope handle_scope(isolate);
74 v8::Local<v8::Context> context = v8::Context::New(isolate);
75 v8::Context::Scope context_scope(context);
76
77 std::string source_string = protobuf_to_string(source_protobuf);
78
79 if (getenv("LPM_DUMP_NATIVE_INPUT")) {
80 std::cout << source_string << std::endl;
81 std::cout << "module: " << source_protobuf.is_module() << std::endl;
82 }
83 v8::Local<v8::String> source_v8_string =
84 v8::String::NewFromUtf8(isolate, source_string.c_str(),
85 v8::NewStringType::kNormal)
86 .ToLocalChecked();
87
88 {
89 v8::TryCatch try_catch(isolate);
90
91 if (source_protobuf.is_module()) {
92 v8::Local<v8::String> name =
93 v8::String::NewFromUtf8(isolate, "module.js",
94 v8::NewStringType::kNormal)
95 .ToLocalChecked();
96
97 v8::ScriptOrigin origin(isolate, name, 0, 0, false, -1,
98 v8::Local<v8::Value>(), false, false, true);
99 v8::ScriptCompiler::Source source(source_v8_string, origin);
100 v8::MaybeLocal<v8::Module> module =
101 v8::ScriptCompiler::CompileModule(isolate, &source);
102 // TODO(marja): Figure out a more elegant way to silence the warning.
103 module.IsEmpty();
104 } else {
105 v8::MaybeLocal<v8::Script> script =
106 v8::Script::Compile(context, source_v8_string);
107 // TODO(marja): Figure out a more elegant way to silence the warning.
108 script.IsEmpty();
109 }
110
111 // TODO(crbug.com/775796): run the code once we find a way to avoid endless
112 // loops.
113 }
114 }
115