[wasm] Add a fuzzer for async compilation

The new fuzzer takes the fuzzer input as module bytes and compiles them
with WebAssembly asynchronous compilation.

R=mtrofin@chromium.org

Change-Id: I9740edec68e26c04d011d85c68521e340be13c4c
Reviewed-on: https://chromium-review.googlesource.com/506156
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45912}

BUILD.gn

@@ -2781,6 +2781,7 @@ group("v8_fuzzers") {
     ":v8_simple_parser_fuzzer",
     ":v8_simple_regexp_fuzzer",
     ":v8_simple_wasm_asmjs_fuzzer",
+    ":v8_simple_wasm_async_fuzzer",
     ":v8_simple_wasm_call_fuzzer",
     ":v8_simple_wasm_code_fuzzer",
     ":v8_simple_wasm_compile_fuzzer",
@@ -3132,6 +3133,26 @@ v8_source_set("wasm_asmjs_fuzzer") {
 v8_fuzzer("wasm_asmjs_fuzzer") {
 }
 
+v8_source_set("wasm_async_fuzzer") {
+  sources = [
+    "test/fuzzer/wasm-async.cc",
+  ]
+
+  deps = [
+    ":fuzzer_support",
+    ":lib_wasm_fuzzer_common",
+    ":wasm_module_runner",
+  ]
+
+  configs = [
+    ":external_config",
+    ":internal_config_base",
+  ]
+}
+
+v8_fuzzer("wasm_async_fuzzer") {
+}
+
 v8_source_set("wasm_code_fuzzer") {
   sources = [
     "test/common/wasm/test-signatures.h",

test/fuzzer/fuzzer-support.cc

@@ -46,12 +46,14 @@ FuzzerSupport::FuzzerSupport(int* argc, char*** argv) {
     v8::HandleScope handle_scope(isolate_);
     context_.Reset(isolate_, v8::Context::New(isolate_));
   }
+
+  v8::platform::EnsureEventLoopInitialized(platform_, isolate_);
 }
 
 FuzzerSupport::~FuzzerSupport() {
   {
     v8::Isolate::Scope isolate_scope(isolate_);
-    while (v8::platform::PumpMessageLoop(platform_, isolate_)) /* empty */
+    while (PumpMessageLoop()) /* empty */
       ;
 
     v8::HandleScope handle_scope(isolate_);
@@ -85,6 +87,11 @@ v8::Local<v8::Context> FuzzerSupport::GetContext() {
   return handle_scope.Escape(context);
 }
 
+bool FuzzerSupport::PumpMessageLoop(
+    v8::platform::MessageLoopBehavior behavior) {
+  return v8::platform::PumpMessageLoop(platform_, isolate_, behavior);
+}
+
 }  // namespace v8_fuzzer
 
 extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) {

test/fuzzer/fuzzer-support.h

@@ -5,6 +5,7 @@
 #ifndef TEST_FUZZER_FUZZER_SUPPORT_H_
 #define TEST_FUZZER_FUZZER_SUPPORT_H_
 
+#include "include/libplatform/libplatform.h"
 #include "include/v8.h"
 
 namespace v8_fuzzer {
@@ -18,6 +19,8 @@ class FuzzerSupport {
 
   v8::Isolate* GetIsolate() const;
   v8::Local<v8::Context> GetContext();
+  bool PumpMessageLoop(v8::platform::MessageLoopBehavior =
+                           v8::platform::MessageLoopBehavior::kDoNotWait);
 
  private:
   // Prevent copying. Not implemented.

test/fuzzer/fuzzer.gyp

@@ -25,6 +25,7 @@
       'target_name': 'json_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -51,6 +52,7 @@
       'target_name': 'parser_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -77,6 +79,7 @@
       'target_name': 'regexp_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -103,6 +106,7 @@
       'target_name': 'wasm_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -131,6 +135,7 @@
       'target_name': 'wasm_asmjs_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -142,6 +147,35 @@
         '../common/wasm/wasm-module-runner.h',
       ],
     },
+    {
+      'target_name': 'v8_simple_wasm_async_fuzzer',
+      'type': 'executable',
+      'dependencies': [
+        'wasm_async_fuzzer_lib',
+      ],
+      'include_dirs': [
+        '../..',
+      ],
+      'sources': [
+        'fuzzer.cc',
+      ],
+    },
+    {
+      'target_name': 'wasm_async_fuzzer_lib',
+      'type': 'static_library',
+      'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
+        'fuzzer_support',
+      ],
+      'include_dirs': [
+        '../..',
+      ],
+      'sources': [  ### gcmole(all) ###
+        'wasm-async.cc',
+        '../common/wasm/wasm-module-runner.cc',
+        '../common/wasm/wasm-module-runner.h',
+      ],
+    },
     {
       'target_name': 'v8_simple_wasm_call_fuzzer',
       'type': 'executable',
@@ -159,6 +193,7 @@
       'target_name': 'wasm_call_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -190,6 +225,7 @@
       'target_name': 'wasm_code_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -221,6 +257,7 @@
       'target_name': 'wasm_compile_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -252,6 +289,7 @@
       'target_name': 'wasm_data_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -282,6 +320,7 @@
       'target_name': 'wasm_function_sigs_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -312,6 +351,7 @@
       'target_name': 'wasm_globals_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -342,6 +382,7 @@
       'target_name': 'wasm_imports_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -372,6 +413,7 @@
       'target_name': 'wasm_memory_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -402,6 +444,7 @@
       'target_name': 'wasm_names_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [
@@ -432,6 +475,7 @@
       'target_name': 'wasm_types_section_fuzzer_lib',
       'type': 'static_library',
       'dependencies': [
+        '../../src/v8.gyp:v8_libplatform',
         'fuzzer_support',
       ],
       'include_dirs': [

test/fuzzer/fuzzer.isolate

@@ -10,6 +10,7 @@
       '<(PRODUCT_DIR)/v8_simple_regexp_fuzzer<(EXECUTABLE_SUFFIX)',
       '<(PRODUCT_DIR)/v8_simple_wasm_fuzzer<(EXECUTABLE_SUFFIX)',
       '<(PRODUCT_DIR)/v8_simple_wasm_asmjs_fuzzer<(EXECUTABLE_SUFFIX)',
+      '<(PRODUCT_DIR)/v8_simple_wasm_async_fuzzer<(EXECUTABLE_SUFFIX)',
       '<(PRODUCT_DIR)/v8_simple_wasm_call_fuzzer<(EXECUTABLE_SUFFIX)',
       '<(PRODUCT_DIR)/v8_simple_wasm_code_fuzzer<(EXECUTABLE_SUFFIX)',
       '<(PRODUCT_DIR)/v8_simple_wasm_compile_fuzzer<(EXECUTABLE_SUFFIX)',
@@ -27,6 +28,7 @@
       './regexp/',
       './wasm/',
       './wasm_asmjs/',
+      './wasm_async/',
       './wasm_call/',
       './wasm_code/',
       './wasm_compile/',

test/fuzzer/testcfg.py

@@ -18,8 +18,8 @@ class FuzzerVariantGenerator(testsuite.VariantGenerator):
 
 
 class FuzzerTestSuite(testsuite.TestSuite):
-  SUB_TESTS = ( 'json', 'parser', 'regexp', 'wasm', 'wasm_asmjs', 'wasm_call',
-          'wasm_code', 'wasm_compile', 'wasm_data_section',
+  SUB_TESTS = ( 'json', 'parser', 'regexp', 'wasm', 'wasm_asmjs', 'wasm_async',
+          'wasm_call', 'wasm_code', 'wasm_compile', 'wasm_data_section',
           'wasm_function_sigs_section', 'wasm_globals_section',
           'wasm_imports_section', 'wasm_memory_section', 'wasm_names_section',
           'wasm_types_section' )

test/fuzzer/wasm-async.cc

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <limits.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#include "include/v8.h"
+#include "src/factory.h"
+#include "src/isolate-inl.h"
+#include "src/isolate.h"
+#include "src/objects-inl.h"
+#include "src/objects.h"
+#include "src/wasm/wasm-module.h"
+#include "test/common/wasm/flag-utils.h"
+#include "test/common/wasm/wasm-module-runner.h"
+#include "test/fuzzer/fuzzer-support.h"
+
+using namespace v8::internal;
+using namespace v8::internal::wasm;
+using namespace v8::internal::wasm::testing;
+
+#define ASSIGN(type, var, expr)                      \
+  v8::Local<type> var;                               \
+  do {                                               \
+    if (!expr.ToLocal(&var)) {                       \
+      DCHECK(i_isolate->has_scheduled_exception());  \
+      return 0;                                      \
+    } else {                                         \
+      DCHECK(!i_isolate->has_scheduled_exception()); \
+    }                                                \
+  } while (false)
+
+namespace v8 {
+namespace internal {
+class WasmModuleObject;
+}
+}
+
+namespace {
+// We need this helper function because we cannot use
+// Handle<WasmModuleObject>::cast here. To use this function we would have to
+// mark it with V8_EXPORT_PRIVATE, which is quite ugly in this case.
+Handle<WasmModuleObject> ToWasmModuleObjectUnchecked(Handle<Object> that) {
+  return handle(reinterpret_cast<WasmModuleObject*>(*that));
+}
+}
+
+void InstantiateCallback(const v8::FunctionCallbackInfo<v8::Value>& args) {
+  DCHECK_GE(args.Length(), 1);
+  v8::Isolate* isolate = args.GetIsolate();
+  v8::MicrotasksScope does_not_run_microtasks(
+      isolate, v8::MicrotasksScope::kDoNotRunMicrotasks);
+
+  v8::HandleScope scope(isolate);
+
+  v8::Local<v8::Value> module = args[0];
+
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+
+  ErrorThrower thrower(i_isolate, "WebAssembly Instantiation");
+
+  i::Handle<i::WasmModuleObject> module_obj = ToWasmModuleObjectUnchecked(
+      v8::Utils::OpenHandle(v8::Object::Cast(*module)));
+  i::MaybeHandle<WasmInstanceObject> maybe_instance =
+      i::wasm::SyncInstantiate(i_isolate, &thrower, module_obj,
+                               Handle<JSReceiver>::null(),     // imports
+                               MaybeHandle<JSArrayBuffer>());  // memory
+  Handle<WasmInstanceObject> instance;
+  if (!maybe_instance.ToHandle(&instance)) {
+    return;
+  }
+  RunWasmModuleForTesting(i_isolate, instance, 0, nullptr, kWasmOrigin);
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  v8::internal::FlagScope<bool> turn_on_async_compile(
+      &v8::internal::FLAG_wasm_async_compilation, true);
+  v8::internal::FlagScope<uint32_t> max_mem_flag_scope(
+      &v8::internal::FLAG_wasm_max_mem_pages, 32);
+  v8::internal::FlagScope<uint32_t> max_table_size_scope(
+      &v8::internal::FLAG_wasm_max_table_size, 100);
+  v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
+  v8::Isolate* isolate = support->GetIsolate();
+  v8::internal::Isolate* i_isolate =
+      reinterpret_cast<v8::internal::Isolate*>(isolate);
+
+  // Clear any pending exceptions from a prior run.
+  if (i_isolate->has_pending_exception()) {
+    i_isolate->clear_pending_exception();
+  }
+
+  v8::Isolate::Scope isolate_scope(isolate);
+  v8::HandleScope handle_scope(isolate);
+  HandleScope internal_scope(i_isolate);
+  v8::Context::Scope context_scope(support->GetContext());
+  v8::TryCatch try_catch(isolate);
+  v8::internal::wasm::testing::SetupIsolateForWasmModule(i_isolate);
+
+  // Get the promise for async compilation.
+  ASSIGN(v8::Promise::Resolver, resolver,
+         v8::Promise::Resolver::New(support->GetContext()));
+  v8::Local<v8::Promise> promise = resolver->GetPromise();
+
+  AsyncCompile(i_isolate, v8::Utils::OpenHandle(*promise),
+               ModuleWireBytes(data, data + size));
+
+  ASSIGN(v8::Function, instantiate_impl,
+         v8::Function::New(support->GetContext(), &InstantiateCallback,
+                           v8::Undefined(isolate)));
+
+  ASSIGN(v8::Promise, result,
+         promise->Then(support->GetContext(), instantiate_impl));
+
+  // Wait for the promise to resolve.
+  while (result->State() == v8::Promise::kPending) {
+    support->PumpMessageLoop(v8::platform::MessageLoopBehavior::kWaitForWork);
+    isolate->RunMicrotasks();
+  }
+  return 0;
+}

test/fuzzer/wasm_async/README.md

+All files in this directory are used by the trybots to check that the fuzzer
+executes correctly, see
+https://github.com/v8/v8/blob/master/test/fuzzer/README.md. There should be at
+least one file in this directory, e.g. this README file.