fuzzer-support.cc 3.18 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "test/fuzzer/fuzzer-support.h"

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "include/libplatform/libplatform.h"
12
#include "src/flags/flags.h"
13
#include "src/trap-handler/trap-handler.h"
14

15 16 17
namespace v8_fuzzer {

FuzzerSupport::FuzzerSupport(int* argc, char*** argv) {
18
  v8::internal::FLAG_expose_gc = true;
19
  v8::V8::SetFlagsFromCommandLine(argc, *argv, true);
20
  v8::V8::InitializeICUDefaultLocation((*argv)[0]);
21
  v8::V8::InitializeExternalStartupData((*argv)[0]);
22 23
  platform_ = v8::platform::NewDefaultPlatform();
  v8::V8::InitializePlatform(platform_.get());
24 25
  v8::V8::Initialize();

26
  allocator_ = v8::ArrayBuffer::Allocator::NewDefaultAllocator();
27 28
  v8::Isolate::CreateParams create_params;
  create_params.array_buffer_allocator = allocator_;
29
  create_params.allow_atomics_wait = false;
30 31 32 33 34 35 36 37 38 39 40 41
  isolate_ = v8::Isolate::New(create_params);

  {
    v8::Isolate::Scope isolate_scope(isolate_);
    v8::HandleScope handle_scope(isolate_);
    context_.Reset(isolate_, v8::Context::New(isolate_));
  }
}

FuzzerSupport::~FuzzerSupport() {
  {
    v8::Isolate::Scope isolate_scope(isolate_);
42 43 44
    while (PumpMessageLoop()) {
      // empty
    }
45 46 47 48 49

    v8::HandleScope handle_scope(isolate_);
    context_.Reset();
  }

50
  isolate_->LowMemoryNotification();
51 52 53 54 55 56 57 58 59 60
  isolate_->Dispose();
  isolate_ = nullptr;

  delete allocator_;
  allocator_ = nullptr;

  v8::V8::Dispose();
  v8::V8::ShutdownPlatform();
}

61 62
std::unique_ptr<FuzzerSupport> FuzzerSupport::fuzzer_support_;

63
// static
64
void FuzzerSupport::InitializeFuzzerSupport(int* argc, char*** argv) {
65
#if V8_ENABLE_WEBASSEMBLY
66
  if (V8_TRAP_HANDLER_SUPPORTED) {
67 68 69 70 71
    constexpr bool kUseDefaultTrapHandler = true;
    if (!v8::V8::EnableWebAssemblyTrapHandler(kUseDefaultTrapHandler)) {
      FATAL("Could not register trap handler");
    }
  }
72
#endif  // V8_ENABLE_WEBASSEMBLY
73 74
  DCHECK_NULL(FuzzerSupport::fuzzer_support_);
  FuzzerSupport::fuzzer_support_ =
75
      std::make_unique<v8_fuzzer::FuzzerSupport>(argc, argv);
76
}
77

78 79 80 81 82
// static
FuzzerSupport* FuzzerSupport::Get() {
  DCHECK_NOT_NULL(FuzzerSupport::fuzzer_support_);
  return FuzzerSupport::fuzzer_support_.get();
}
83 84 85 86 87 88 89 90 91

v8::Local<v8::Context> FuzzerSupport::GetContext() {
  v8::Isolate::Scope isolate_scope(isolate_);
  v8::EscapableHandleScope handle_scope(isolate_);
  v8::Local<v8::Context> context =
      v8::Local<v8::Context>::New(isolate_, context_);
  return handle_scope.Escape(context);
}

92 93
bool FuzzerSupport::PumpMessageLoop(
    v8::platform::MessageLoopBehavior behavior) {
94
  return v8::platform::PumpMessageLoop(platform_.get(), isolate_, behavior);
95 96
}

97 98
}  // namespace v8_fuzzer

99 100 101 102 103 104 105 106
// Explicitly specify some attributes to avoid issues with the linker dead-
// stripping the following function on macOS, as it is not called directly
// by fuzz target. LibFuzzer runtime uses dlsym() to resolve that function.
#if V8_OS_MACOSX
__attribute__((used)) __attribute__((visibility("default")))
#endif  // V8_OS_MACOSX
extern "C" int
LLVMFuzzerInitialize(int* argc, char*** argv) {
107
  v8_fuzzer::FuzzerSupport::InitializeFuzzerSupport(argc, argv);
108 109
  return 0;
}