fuzzer-support.cc 3.11 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "test/fuzzer/fuzzer-support.h"

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "include/libplatform/libplatform.h"
12
#include "src/flags/flags.h"
13
#include "src/trap-handler/trap-handler.h"
14

15 16 17
namespace v8_fuzzer {

FuzzerSupport::FuzzerSupport(int* argc, char*** argv) {
18
  v8::internal::FLAG_expose_gc = true;
19
  v8::V8::SetFlagsFromCommandLine(argc, *argv, true);
20
  v8::V8::InitializeICUDefaultLocation((*argv)[0]);
21
  v8::V8::InitializeExternalStartupData((*argv)[0]);
22 23
  platform_ = v8::platform::NewDefaultPlatform();
  v8::V8::InitializePlatform(platform_.get());
24 25
  v8::V8::Initialize();

26
  allocator_ = v8::ArrayBuffer::Allocator::NewDefaultAllocator();
27 28 29 30 31 32 33 34 35 36 37 38 39 40
  v8::Isolate::CreateParams create_params;
  create_params.array_buffer_allocator = allocator_;
  isolate_ = v8::Isolate::New(create_params);

  {
    v8::Isolate::Scope isolate_scope(isolate_);
    v8::HandleScope handle_scope(isolate_);
    context_.Reset(isolate_, v8::Context::New(isolate_));
  }
}

FuzzerSupport::~FuzzerSupport() {
  {
    v8::Isolate::Scope isolate_scope(isolate_);
41 42 43
    while (PumpMessageLoop()) {
      // empty
    }
44 45 46 47 48

    v8::HandleScope handle_scope(isolate_);
    context_.Reset();
  }

49
  isolate_->LowMemoryNotification();
50 51 52 53 54 55 56 57 58 59
  isolate_->Dispose();
  isolate_ = nullptr;

  delete allocator_;
  allocator_ = nullptr;

  v8::V8::Dispose();
  v8::V8::ShutdownPlatform();
}

60 61
std::unique_ptr<FuzzerSupport> FuzzerSupport::fuzzer_support_;

62
// static
63
void FuzzerSupport::InitializeFuzzerSupport(int* argc, char*** argv) {
64 65 66 67 68 69
  if (V8_TRAP_HANDLER_SUPPORTED && i::FLAG_wasm_trap_handler) {
    constexpr bool kUseDefaultTrapHandler = true;
    if (!v8::V8::EnableWebAssemblyTrapHandler(kUseDefaultTrapHandler)) {
      FATAL("Could not register trap handler");
    }
  }
70 71
  DCHECK_NULL(FuzzerSupport::fuzzer_support_);
  FuzzerSupport::fuzzer_support_ =
72
      std::make_unique<v8_fuzzer::FuzzerSupport>(argc, argv);
73
}
74

75 76 77 78 79
// static
FuzzerSupport* FuzzerSupport::Get() {
  DCHECK_NOT_NULL(FuzzerSupport::fuzzer_support_);
  return FuzzerSupport::fuzzer_support_.get();
}
80 81 82 83 84 85 86 87 88

v8::Local<v8::Context> FuzzerSupport::GetContext() {
  v8::Isolate::Scope isolate_scope(isolate_);
  v8::EscapableHandleScope handle_scope(isolate_);
  v8::Local<v8::Context> context =
      v8::Local<v8::Context>::New(isolate_, context_);
  return handle_scope.Escape(context);
}

89 90
bool FuzzerSupport::PumpMessageLoop(
    v8::platform::MessageLoopBehavior behavior) {
91
  return v8::platform::PumpMessageLoop(platform_.get(), isolate_, behavior);
92 93
}

94 95
}  // namespace v8_fuzzer

96 97 98 99 100 101 102 103
// Explicitly specify some attributes to avoid issues with the linker dead-
// stripping the following function on macOS, as it is not called directly
// by fuzz target. LibFuzzer runtime uses dlsym() to resolve that function.
#if V8_OS_MACOSX
__attribute__((used)) __attribute__((visibility("default")))
#endif  // V8_OS_MACOSX
extern "C" int
LLVMFuzzerInitialize(int* argc, char*** argv) {
104
  v8_fuzzer::FuzzerSupport::InitializeFuzzerSupport(argc, argv);
105 106
  return 0;
}