[regexp fuzzer] Let the fuzzer input select the regexp flag.

With this CL the regexp-parser-fuzzer uses the first byte of the fuzzer
input to select the regexp flag instead of executing each input with all
possible flags. Thereby the fuzzer can explore more inputs and with its
coverage metric will explore all flags only for interesting inputs.

I updated all files in test/fuzzer/regexp and added a random byte at the beginning. This byte is used by the fuzzer to determine the flag.

BUG=chromium:664436
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2511373002
Cr-Commit-Position: refs/heads/master@{#41176}

test/fuzzer/regexp.cc

@@ -57,23 +57,23 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
       factory->NewStringFromTwoByte(i::Vector<const i::uc16>(two_byte_array, 6))
           .ToHandleChecked();
 
-  for (int flags = 0; flags <= kAllFlags; flags++) {
   i::Handle<i::JSRegExp> regexp;
   {
     v8::TryCatch try_catch(isolate);
-      i::MaybeHandle<i::JSRegExp> maybe_regexp =
-          i::JSRegExp::New(source, static_cast<i::JSRegExp::Flags>(flags));
+    // Create a string so that we can calculate a hash from the input data.
+    std::string str = std::string(reinterpret_cast<const char*>(data), size);
+    i::JSRegExp::Flags flag = static_cast<i::JSRegExp::Flags>(
+        std::hash<std::string>()(str) % (kAllFlags + 1));
+    i::MaybeHandle<i::JSRegExp> maybe_regexp = i::JSRegExp::New(source, flag);
     if (!maybe_regexp.ToHandle(&regexp)) {
       i_isolate->clear_pending_exception();
-        continue;
+      return 0;
     }
   }
   Test(isolate, regexp, one_byte, results_array);
   Test(isolate, regexp, two_byte, results_array);
   Test(isolate, regexp, factory->empty_string(), results_array);
   Test(isolate, regexp, source, results_array);
-  }
-
   isolate->RequestGarbageCollectionForTesting(
       v8::Isolate::kFullGarbageCollection);
   return 0;