[wasm] Create a new fuzzer for wasm code.

The new fuzzer constructs a dummy module header and uses the fuzzer
data only as function code.

R=titzer@chromium.org, jochen@chromium.org

Review-Url: https://codereview.chromium.org/2280623002
Cr-Commit-Position: refs/heads/master@{#38983}

BUILD.gn

@@ -2584,3 +2584,18 @@ v8_source_set("wasm_asmjs_fuzzer") {
 
 v8_fuzzer("wasm_asmjs_fuzzer") {
 }
+
+v8_source_set("wasm_code_fuzzer") {
+  sources = [
+    "test/fuzzer/wasm-code.cc",
+  ]
+
+  deps = [
+    ":fuzzer_support",
+  ]
+
+  configs = [ ":internal_config" ]
+}
+
+v8_fuzzer("wasm_code_fuzzer") {
+}

test/fuzzer/fuzzer.gyp

@@ -138,6 +138,32 @@
         'wasm-asmjs.cc',
       ],
     },
+    {
+      'target_name': 'v8_simple_wasm_code_fuzzer',
+      'type': 'executable',
+      'dependencies': [
+        'wasm_code_fuzzer_lib',
+      ],
+      'include_dirs': [
+        '../..',
+      ],
+      'sources': [
+        'fuzzer.cc',
+      ],
+    },
+    {
+      'target_name': 'wasm_code_fuzzer_lib',
+      'type': 'static_library',
+      'dependencies': [
+        'fuzzer_support',
+      ],
+      'include_dirs': [
+        '../..',
+      ],
+      'sources': [  ### gcmole(all) ###
+        'wasm-code.cc',
+      ],
+    },
     {
       'target_name': 'fuzzer_support',
       'type': 'static_library',

test/fuzzer/fuzzer.isolate

@@ -10,6 +10,7 @@
       '<(PRODUCT_DIR)/v8_simple_regexp_fuzzer<(EXECUTABLE_SUFFIX)',
       '<(PRODUCT_DIR)/v8_simple_wasm_fuzzer<(EXECUTABLE_SUFFIX)',
       '<(PRODUCT_DIR)/v8_simple_wasm_asmjs_fuzzer<(EXECUTABLE_SUFFIX)',
+      '<(PRODUCT_DIR)/v8_simple_wasm_code_fuzzer<(EXECUTABLE_SUFFIX)',
       './fuzzer.status',
       './testcfg.py',
       './json/',
@@ -17,6 +18,7 @@
       './regexp/',
       './wasm/',
       './wasm_asmjs/',
+      './wasm_code/',
     ],
   },
   'includes': [

test/fuzzer/testcfg.py

@@ -18,7 +18,7 @@ class FuzzerVariantGenerator(testsuite.VariantGenerator):
 
 
 class FuzzerTestSuite(testsuite.TestSuite):
-  SUB_TESTS = ( 'json', 'parser', 'regexp', 'wasm', 'wasm_asmjs', )
+  SUB_TESTS = ( 'json', 'parser', 'regexp', 'wasm', 'wasm_asmjs', 'wasm_code' )
 
   def __init__(self, name, root):
     super(FuzzerTestSuite, self).__init__(name, root)

test/fuzzer/wasm-code.cc

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "include/v8.h"
+#include "src/isolate.h"
+#include "src/wasm/encoder.h"
+#include "src/wasm/wasm-js.h"
+#include "src/wasm/wasm-module.h"
+#include "test/cctest/wasm/test-signatures.h"
+#include "test/fuzzer/fuzzer-support.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
+  v8::Isolate* isolate = support->GetIsolate();
+  v8::internal::Isolate* i_isolate =
+      reinterpret_cast<v8::internal::Isolate*>(isolate);
+
+  // Clear any pending exceptions from a prior run.
+  if (i_isolate->has_pending_exception()) {
+    i_isolate->clear_pending_exception();
+  }
+
+  v8::Isolate::Scope isolate_scope(isolate);
+  v8::HandleScope handle_scope(isolate);
+  v8::Context::Scope context_scope(support->GetContext());
+  v8::TryCatch try_catch(isolate);
+
+  v8::base::AccountingAllocator allocator;
+  v8::internal::Zone zone(&allocator);
+
+  v8::internal::wasm::TestSignatures sigs;
+
+  v8::internal::wasm::WasmModuleBuilder builder(&zone);
+
+  uint16_t f1_index = builder.AddFunction();
+  v8::internal::wasm::WasmFunctionBuilder* f = builder.FunctionAt(f1_index);
+  f->SetSignature(sigs.i_iii());
+  f->EmitCode(data, static_cast<uint32_t>(size));
+  f->SetExported();
+  f->SetName("main", 4);
+
+  v8::internal::wasm::ZoneBuffer buffer(&zone);
+  builder.WriteTo(buffer);
+
+  v8::internal::WasmJs::InstallWasmFunctionMap(i_isolate,
+                                               i_isolate->native_context());
+  v8::internal::wasm::testing::CompileAndRunWasmModule(
+      i_isolate, buffer.begin(), buffer.end(), false);
+  return 0;
+}