Skip to content

V
V8
Commit eb64b26f authored by Andreas Haas's avatar Andreas Haas Committed by Commit Bot
Browse files
Options

[cleanup][wasm][fuzzer] Share code among the different fuzzers. 

With this CL we share code among the wasm fuzzers which construct a
module and run it in the interpreter and as compiled code.The fuzzers
themselves only contain the code now which creates the module and the
parameters.

BUG=v8:6325
R=eholk@chromium.org

Change-Id: I1c2d8b013531c86cb27837f1b8ec89d2688c536b
Reviewed-on: https://chromium-review.googlesource.com/490048
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: 's avatarBrad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45156}
parent d2ba280d
Hide whitespace changes
Inline Side-by-side
Showing with 447 additions and 533 deletions
BUILD.gn
View file @ eb64b26f
......@@ -3048,6 +3048,7 @@ v8_source_set("wasm_fuzzer") {
deps = [
":fuzzer_support",
":lib_wasm_fuzzer_common",
":wasm_module_runner",
]
......@@ -3067,6 +3068,7 @@ v8_source_set("wasm_asmjs_fuzzer") {
deps = [
":fuzzer_support",
":lib_wasm_fuzzer_common",
":wasm_module_runner",
]
......@@ -3087,6 +3089,7 @@ v8_source_set("wasm_code_fuzzer") {
deps = [
":fuzzer_support",
":lib_wasm_fuzzer_common",
":wasm_module_runner",
]
......@@ -3107,6 +3110,7 @@ v8_source_set("wasm_call_fuzzer") {
deps = [
":fuzzer_support",
":lib_wasm_fuzzer_common",
":wasm_module_runner",
]
......@@ -3119,10 +3123,10 @@ v8_source_set("wasm_call_fuzzer") {
v8_fuzzer("wasm_call_fuzzer") {
}
v8_source_set("lib_wasm_section_fuzzer") {
v8_source_set("lib_wasm_fuzzer_common") {
sources = [
"test/fuzzer/wasm-section-fuzzers.cc",
"test/fuzzer/wasm-section-fuzzers.h",
"test/fuzzer/wasm-fuzzer-common.cc",
"test/fuzzer/wasm-fuzzer-common.h",
]
configs = [
......@@ -3138,7 +3142,7 @@ v8_source_set("wasm_types_section_fuzzer") {
deps = [
":fuzzer_support",
":lib_wasm_section_fuzzer",
":lib_wasm_fuzzer_common",
":wasm_module_runner",
]
......@@ -3158,7 +3162,7 @@ v8_source_set("wasm_names_section_fuzzer") {
deps = [
":fuzzer_support",
":lib_wasm_section_fuzzer",
":lib_wasm_fuzzer_common",
":wasm_module_runner",
]
......@@ -3178,7 +3182,7 @@ v8_source_set("wasm_globals_section_fuzzer") {
deps = [
":fuzzer_support",
":lib_wasm_section_fuzzer",
":lib_wasm_fuzzer_common",
":wasm_module_runner",
]
......@@ -3198,7 +3202,7 @@ v8_source_set("wasm_imports_section_fuzzer") {
deps = [
":fuzzer_support",
":lib_wasm_section_fuzzer",
":lib_wasm_fuzzer_common",
":wasm_module_runner",
]
......@@ -3218,7 +3222,7 @@ v8_source_set("wasm_function_sigs_section_fuzzer") {
deps = [
":fuzzer_support",
":lib_wasm_section_fuzzer",
":lib_wasm_fuzzer_common",
":wasm_module_runner",
]
......@@ -3238,7 +3242,7 @@ v8_source_set("wasm_memory_section_fuzzer") {
deps = [
":fuzzer_support",
":lib_wasm_section_fuzzer",
":lib_wasm_fuzzer_common",
":wasm_module_runner",
]
......@@ -3258,7 +3262,7 @@ v8_source_set("wasm_data_section_fuzzer") {
deps = [
":fuzzer_support",
":lib_wasm_section_fuzzer",
":lib_wasm_fuzzer_common",
":wasm_module_runner",
]
......@@ -3279,6 +3283,7 @@ v8_source_set("wasm_compile_fuzzer") {
deps = [
":fuzzer_support",
":lib_wasm_fuzzer_common",
":wasm_module_runner",
]
......
test/fuzzer/fuzzer.gyp
View file @ eb64b26f
......@@ -169,6 +169,8 @@
'../common/wasm/test-signatures.h',
'../common/wasm/wasm-module-runner.cc',
'../common/wasm/wasm-module-runner.h',
'wasm-fuzzer-common.cc',
'wasm-fuzzer-common.h',
],
},
{
......@@ -198,6 +200,8 @@
'../common/wasm/test-signatures.h',
'../common/wasm/wasm-module-runner.cc',
'../common/wasm/wasm-module-runner.h',
'wasm-fuzzer-common.cc',
'wasm-fuzzer-common.h',
],
},
{
......@@ -227,6 +231,8 @@
'../common/wasm/test-signatures.h',
'../common/wasm/wasm-module-runner.cc',
'../common/wasm/wasm-module-runner.h',
'wasm-fuzzer-common.cc',
'wasm-fuzzer-common.h',
],
},
{
......@@ -255,8 +261,8 @@
'wasm-data-section.cc',
'../common/wasm/wasm-module-runner.cc',
'../common/wasm/wasm-module-runner.h',
'wasm-section-fuzzers.cc',
'wasm-section-fuzzers.h',
'wasm-fuzzer-common.cc',
'wasm-fuzzer-common.h',
],
},
{
......@@ -285,8 +291,8 @@
'wasm-function-sigs-section.cc',
'../common/wasm/wasm-module-runner.cc',
'../common/wasm/wasm-module-runner.h',
'wasm-section-fuzzers.cc',
'wasm-section-fuzzers.h',
'wasm-fuzzer-common.cc',
'wasm-fuzzer-common.h',
],
},
{
......@@ -315,8 +321,8 @@
'wasm-globals-section.cc',
'../common/wasm/wasm-module-runner.cc',
'../common/wasm/wasm-module-runner.h',
'wasm-section-fuzzers.cc',
'wasm-section-fuzzers.h',
'wasm-fuzzer-common.cc',
'wasm-fuzzer-common.h',
],
},
{
......@@ -345,8 +351,8 @@
'wasm-imports-section.cc',
'../common/wasm/wasm-module-runner.cc',
'../common/wasm/wasm-module-runner.h',
'wasm-section-fuzzers.cc',
'wasm-section-fuzzers.h',
'wasm-fuzzer-common.cc',
'wasm-fuzzer-common.h',
],
},
{
......@@ -375,8 +381,8 @@
'wasm-memory-section.cc',
'../common/wasm/wasm-module-runner.cc',
'../common/wasm/wasm-module-runner.h',
'wasm-section-fuzzers.cc',
'wasm-section-fuzzers.h',
'wasm-fuzzer-common.cc',
'wasm-fuzzer-common.h',
],
},
{
......@@ -405,8 +411,8 @@
'wasm-names-section.cc',
'../common/wasm/wasm-module-runner.cc',
'../common/wasm/wasm-module-runner.h',
'wasm-section-fuzzers.cc',
'wasm-section-fuzzers.h',
'wasm-fuzzer-common.cc',
'wasm-fuzzer-common.h',
],
},
{
......@@ -435,8 +441,8 @@
'wasm-types-section.cc',
'../common/wasm/wasm-module-runner.cc',
'../common/wasm/wasm-module-runner.h',
'wasm-section-fuzzers.cc',
'wasm-section-fuzzers.h',
'wasm-fuzzer-common.cc',
'wasm-fuzzer-common.h',
],
},
{
......
test/fuzzer/wasm-call.cc
View file @ eb64b26f
......@@ -16,176 +16,113 @@
#include "test/common/wasm/test-signatures.h"
#include "test/common/wasm/wasm-module-runner.h"
#include "test/fuzzer/fuzzer-support.h"
#include "test/fuzzer/wasm-fuzzer-common.h"
#define WASM_CODE_FUZZER_HASH_SEED 83
#define MAX_NUM_FUNCTIONS 3
#define MAX_NUM_PARAMS 3
using namespace v8::internal;
using namespace v8::internal::wasm;
template <typename V>
static inline V read_value(const uint8_t** data, size_t* size, bool* ok) {
// The status flag {ok} checks that the decoding up until now was okay, and
// that a value of type V can be read without problems.
*ok &= (*size > sizeof(V));
if (!(*ok)) return 0;
V result = v8::internal::ReadLittleEndianValue<V>(*data);
*data += sizeof(V);
*size -= sizeof(V);
return result;
}
static void add_argument(
v8::internal::Isolate* isolate, ValueType type, WasmVal* interpreter_args,
v8::internal::Handle<v8::internal::Object>* compiled_args, int* argc,
const uint8_t** data, size_t* size, bool* ok) {
if (!(*ok)) return;
switch (type) {
case kWasmF32: {
float value = read_value<float>(data, size, ok);
interpreter_args[*argc] = WasmVal(value);
compiled_args[*argc] =
isolate->factory()->NewNumber(static_cast<double>(value));
break;
}
case kWasmF64: {
double value = read_value<double>(data, size, ok);
interpreter_args[*argc] = WasmVal(value);
compiled_args[*argc] = isolate->factory()->NewNumber(value);
break;
}
case kWasmI32: {
int32_t value = read_value<int32_t>(data, size, ok);
interpreter_args[*argc] = WasmVal(value);
compiled_args[*argc] =
isolate->factory()->NewNumber(static_cast<double>(value));
break;
}
default:
UNREACHABLE();
using namespace v8::internal::wasm::fuzzer;
class WasmCallFuzzer : public WasmExecutionFuzzer {
template <typename V>
static inline V read_value(const uint8_t** data, size_t* size, bool* ok) {
// The status flag {ok} checks that the decoding up until now was okay, and
// that a value of type V can be read without problems.
*ok &= (*size > sizeof(V));
if (!(*ok)) return 0;
V result = v8::internal::ReadLittleEndianValue<V>(*data);
*data += sizeof(V);
*size -= sizeof(V);
return result;
}
(*argc)++;
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
v8::Isolate* isolate = support->GetIsolate();
v8::internal::Isolate* i_isolate =
reinterpret_cast<v8::internal::Isolate*>(isolate);
// Clear any pending exceptions from a prior run.
if (i_isolate->has_pending_exception()) {
i_isolate->clear_pending_exception();
static void add_argument(
v8::internal::Isolate* isolate, ValueType type, WasmVal* interpreter_args,
v8::internal::Handle<v8::internal::Object>* compiler_args, int* argc,
const uint8_t** data, size_t* size, bool* ok) {
if (!(*ok)) return;
switch (type) {
case kWasmF32: {
float value = read_value<float>(data, size, ok);
interpreter_args[*argc] = WasmVal(value);
compiler_args[*argc] =
isolate->factory()->NewNumber(static_cast<double>(value));
break;
}
case kWasmF64: {
double value = read_value<double>(data, size, ok);
interpreter_args[*argc] = WasmVal(value);
compiler_args[*argc] = isolate->factory()->NewNumber(value);
break;
}
case kWasmI32: {
int32_t value = read_value<int32_t>(data, size, ok);
interpreter_args[*argc] = WasmVal(value);
compiler_args[*argc] =
isolate->factory()->NewNumber(static_cast<double>(value));
break;
}
default:
UNREACHABLE();
}
(*argc)++;
}
v8::Isolate::Scope isolate_scope(isolate);
v8::HandleScope handle_scope(isolate);
v8::Context::Scope context_scope(support->GetContext());
v8::TryCatch try_catch(isolate);
v8::internal::AccountingAllocator allocator;
v8::internal::Zone zone(&allocator, ZONE_NAME);
bool ok = true;
uint8_t num_functions =
(read_value<uint8_t>(&data, &size, &ok) % MAX_NUM_FUNCTIONS) + 1;
ValueType types[] = {kWasmF32, kWasmF64, kWasmI32, kWasmI64};
WasmVal interpreter_args[3];
v8::internal::Handle<v8::internal::Object> compiled_args[3];
int argc = 0;
WasmModuleBuilder builder(&zone);
for (int fun = 0; fun < num_functions; fun++) {
size_t num_params = static_cast<size_t>(
(read_value<uint8_t>(&data, &size, &ok) % MAX_NUM_PARAMS) + 1);
FunctionSig::Builder sig_builder(&zone, 1, num_params);
sig_builder.AddReturn(kWasmI32);
for (size_t param = 0; param < num_params; param++) {
// The main function cannot handle int64 parameters.
ValueType param_type = types[(read_value<uint8_t>(&data, &size, &ok) %
(arraysize(types) - (fun == 0 ? 1 : 0)))];
sig_builder.AddParam(param_type);
virtual bool GenerateModule(
Isolate* isolate, Zone* zone, const uint8_t* data, size_t size,
ZoneBuffer& buffer, int32_t& num_args,
std::unique_ptr<WasmVal[]>& interpreter_args,
std::unique_ptr<Handle<Object>[]>& compiler_args) override {
bool ok = true;
uint8_t num_functions =
(read_value<uint8_t>(&data, &size, &ok) % MAX_NUM_FUNCTIONS) + 1;
ValueType types[] = {kWasmF32, kWasmF64, kWasmI32, kWasmI64};
interpreter_args.reset(new WasmVal[3]);
compiler_args.reset(new Handle<Object>[3]);
WasmModuleBuilder builder(zone);
for (int fun = 0; fun < num_functions; fun++) {
size_t num_params = static_cast<size_t>(
(read_value<uint8_t>(&data, &size, &ok) % MAX_NUM_PARAMS) + 1);
FunctionSig::Builder sig_builder(zone, 1, num_params);
sig_builder.AddReturn(kWasmI32);
for (size_t param = 0; param < num_params; param++) {
// The main function cannot handle int64 parameters.
ValueType param_type = types[(read_value<uint8_t>(&data, &size, &ok) %
(arraysize(types) - (fun == 0 ? 1 : 0)))];
sig_builder.AddParam(param_type);
if (fun == 0) {
add_argument(isolate, param_type, interpreter_args.get(),
compiler_args.get(), &num_args, &data, &size, &ok);
}
}
v8::internal::wasm::WasmFunctionBuilder* f =
builder.AddFunction(sig_builder.Build());
uint32_t code_size = static_cast<uint32_t>(size / num_functions);
f->EmitCode(data, code_size);
uint8_t end_opcode = kExprEnd;
f->EmitCode(&end_opcode, 1);
data += code_size;
size -= code_size;
if (fun == 0) {
add_argument(i_isolate, param_type, interpreter_args, compiled_args,
&argc, &data, &size, &ok);
f->ExportAs(v8::internal::CStrVector("main"));
}
}
v8::internal::wasm::WasmFunctionBuilder* f =
builder.AddFunction(sig_builder.Build());
uint32_t code_size = static_cast<uint32_t>(size / num_functions);
f->EmitCode(data, code_size);
uint8_t end_opcode = kExprEnd;
f->EmitCode(&end_opcode, 1);
data += code_size;
size -= code_size;
if (fun == 0) {
f->ExportAs(v8::internal::CStrVector("main"));
}
}
ZoneBuffer buffer(&zone);
builder.WriteTo(buffer);
if (!ok) {
// The input data was too short.
return 0;
}
v8::internal::wasm::testing::SetupIsolateForWasmModule(i_isolate);
builder.WriteTo(buffer);
v8::internal::HandleScope scope(i_isolate);
ErrorThrower interpreter_thrower(i_isolate, "Interpreter");
std::unique_ptr<const WasmModule> module(testing::DecodeWasmModuleForTesting(
i_isolate, &interpreter_thrower, buffer.begin(), buffer.end(),
v8::internal::wasm::ModuleOrigin::kWasmOrigin, true));
if (module == nullptr) {
return 0;
}
ModuleWireBytes wire_bytes(buffer.begin(), buffer.end());
int32_t result_interpreted;
bool possible_nondeterminism = false;
{
result_interpreted = testing::InterpretWasmModule(
i_isolate, &interpreter_thrower, module.get(), wire_bytes, 0,
interpreter_args, &possible_nondeterminism);
}
ErrorThrower compiler_thrower(i_isolate, "Compiler");
v8::internal::Handle<v8::internal::JSObject> instance =
testing::InstantiateModuleForTesting(i_isolate, &compiler_thrower,
module.get(), wire_bytes);
if (!interpreter_thrower.error()) {
CHECK(!instance.is_null());
} else {
return 0;
}
int32_t result_compiled;
{
result_compiled = testing::CallWasmFunctionForTesting(
i_isolate, instance, &compiler_thrower, "main", argc, compiled_args,
v8::internal::wasm::ModuleOrigin::kWasmOrigin);
}
// The WebAssembly spec allows the sign bit of NaN to be non-deterministic.
// This sign bit may cause result_interpreted to be different than
// result_compiled. Therefore we do not check the equality of the results
// if the execution may have produced a NaN at some point.
if (possible_nondeterminism) return 0;
if (result_interpreted == bit_cast<int32_t>(0xdeadbeef)) {
CHECK(i_isolate->has_pending_exception());
i_isolate->clear_pending_exception();
} else {
CHECK(!i_isolate->has_pending_exception());
if (result_interpreted != result_compiled) {
V8_Fatal(__FILE__, __LINE__, "WasmCodeFuzzerHash=%x",
v8::internal::StringHasher::HashSequentialString(
data, static_cast<int>(size), WASM_CODE_FUZZER_HASH_SEED));
if (!ok) {
// The input data was too short.
return 0;
}
return true;
}
return 0;
};
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
return WasmCallFuzzer().FuzzWasmModule(data, size);
}
test/fuzzer/wasm-code.cc
View file @ eb64b26f
......@@ -5,159 +5,43 @@
#include <stddef.h>
#include <stdint.h>
#include "include/v8.h"
#include "src/isolate.h"
#include "src/objects-inl.h"
#include "src/objects.h"
#include "src/ostreams.h"
#include "src/wasm/wasm-interpreter.h"
#include "src/wasm/wasm-module-builder.h"
#include "src/wasm/wasm-module.h"
#include "test/common/wasm/test-signatures.h"
#include "test/common/wasm/wasm-module-runner.h"
#include "test/fuzzer/fuzzer-support.h"
#define WASM_CODE_FUZZER_HASH_SEED 83
#include "test/fuzzer/wasm-fuzzer-common.h"
using namespace v8::internal;
using namespace v8::internal::wasm;
using namespace v8::internal::wasm::fuzzer;
class WasmCodeFuzzer : public WasmExecutionFuzzer {
virtual bool GenerateModule(
Isolate* isolate, Zone* zone, const uint8_t* data, size_t size,
ZoneBuffer& buffer, int32_t& num_args,
std::unique_ptr<WasmVal[]>& interpreter_args,
std::unique_ptr<Handle<Object>[]>& compiler_args) override {
TestSignatures sigs;
WasmModuleBuilder builder(zone);
WasmFunctionBuilder* f = builder.AddFunction(sigs.i_iii());
f->EmitCode(data, static_cast<uint32_t>(size));
uint8_t end_opcode = kExprEnd;
f->EmitCode(&end_opcode, 1);
f->ExportAs(CStrVector("main"));
builder.WriteTo(buffer);
num_args = 3;
interpreter_args.reset(new WasmVal[3]{WasmVal(1), WasmVal(2), WasmVal(3)});
compiler_args.reset(new Handle<Object>[3]{
handle(Smi::FromInt(1), isolate), handle(Smi::FromInt(1), isolate),
handle(Smi::FromInt(1), isolate)});
return true;
}
};
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
// Save the flag so that we can change it and restore it later.
bool generate_test = v8::internal::FLAG_wasm_code_fuzzer_gen_test;
if (generate_test) {
v8::internal::OFStream os(stdout);
os << "// Copyright 2017 the V8 project authors. All rights reserved."
<< std::endl;
os << "// Use of this source code is governed by a BSD-style license that "
"can be"
<< std::endl;
os << "// found in the LICENSE file." << std::endl;
os << std::endl;
os << "load(\"test/mjsunit/wasm/wasm-constants.js\");" << std::endl;
os << "load(\"test/mjsunit/wasm/wasm-module-builder.js\");" << std::endl;
os << std::endl;
os << "(function() {" << std::endl;
os << " var builder = new WasmModuleBuilder();" << std::endl;
os << " builder.addMemory(16, 32, false);" << std::endl;
os << " builder.addFunction(\"test\", kSig_i_iii)" << std::endl;
os << " .addBodyWithEnd([" << std::endl;
}
v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
v8::Isolate* isolate = support->GetIsolate();
v8::internal::Isolate* i_isolate =
reinterpret_cast<v8::internal::Isolate*>(isolate);
// Clear any pending exceptions from a prior run.
if (i_isolate->has_pending_exception()) {
i_isolate->clear_pending_exception();
}
v8::Isolate::Scope isolate_scope(isolate);
v8::HandleScope handle_scope(isolate);
v8::Context::Scope context_scope(support->GetContext());
v8::TryCatch try_catch(isolate);
v8::internal::AccountingAllocator allocator;
v8::internal::Zone zone(&allocator, ZONE_NAME);
TestSignatures sigs;
WasmModuleBuilder builder(&zone);
v8::internal::wasm::WasmFunctionBuilder* f =
builder.AddFunction(sigs.i_iii());
f->EmitCode(data, static_cast<uint32_t>(size));
uint8_t end_opcode = kExprEnd;
f->EmitCode(&end_opcode, 1);
f->ExportAs(v8::internal::CStrVector("main"));
ZoneBuffer buffer(&zone);
builder.WriteTo(buffer);
v8::internal::wasm::testing::SetupIsolateForWasmModule(i_isolate);
v8::internal::HandleScope scope(i_isolate);
ErrorThrower interpreter_thrower(i_isolate, "Interpreter");
std::unique_ptr<const WasmModule> module(testing::DecodeWasmModuleForTesting(
i_isolate, &interpreter_thrower, buffer.begin(), buffer.end(),
v8::internal::wasm::ModuleOrigin::kWasmOrigin, true));
// Clear the flag so that the WebAssembly code is not printed twice.
v8::internal::FLAG_wasm_code_fuzzer_gen_test = false;
if (module == nullptr) {
if (generate_test) {
v8::internal::OFStream os(stdout);
os << " ])" << std::endl;
os << " .exportFunc();" << std::endl;
os << " assertThrows(function() { builder.instantiate(); });"
<< std::endl;
os << "})();" << std::endl;
}
return 0;
}
if (generate_test) {
v8::internal::OFStream os(stdout);
os << " ])" << std::endl;
os << " .exportFunc();" << std::endl;
os << " var module = builder.instantiate();" << std::endl;
os << " module.exports.test(1, 2, 3);" << std::endl;
os << "})();" << std::endl;
}
ModuleWireBytes wire_bytes(buffer.begin(), buffer.end());
int32_t result_interpreted;
bool possible_nondeterminism = false;
{
WasmVal args[] = {WasmVal(1), WasmVal(2), WasmVal(3)};
result_interpreted = testing::InterpretWasmModule(
i_isolate, &interpreter_thrower, module.get(), wire_bytes, 0, args,
&possible_nondeterminism);
}
ErrorThrower compiler_thrower(i_isolate, "Compiler");
v8::internal::Handle<v8::internal::JSObject> instance =
testing::InstantiateModuleForTesting(i_isolate, &compiler_thrower,
module.get(), wire_bytes);
// Restore the flag.
v8::internal::FLAG_wasm_code_fuzzer_gen_test = generate_test;
if (!interpreter_thrower.error()) {
CHECK(!instance.is_null());
} else {
return 0;
}
int32_t result_compiled;
{
v8::internal::Handle<v8::internal::Object> arguments[] = {
v8::internal::handle(v8::internal::Smi::FromInt(1), i_isolate),
v8::internal::handle(v8::internal::Smi::FromInt(2), i_isolate),
v8::internal::handle(v8::internal::Smi::FromInt(3), i_isolate)};
result_compiled = testing::CallWasmFunctionForTesting(
i_isolate, instance, &compiler_thrower, "main", arraysize(arguments),
arguments, v8::internal::wasm::ModuleOrigin::kWasmOrigin);
}
// The WebAssembly spec allows the sign bit of NaN to be non-deterministic.
// This sign bit may cause result_interpreted to be different than
// result_compiled. Therefore we do not check the equality of the results
// if the execution may have produced a NaN at some point.
if (possible_nondeterminism) return 0;
if (result_interpreted == bit_cast<int32_t>(0xdeadbeef)) {
CHECK(i_isolate->has_pending_exception());
i_isolate->clear_pending_exception();
} else {
CHECK(!i_isolate->has_pending_exception());
// The WebAssembly spec allows the sign bit of NaN to be non-deterministic.
// This sign bit may cause result_interpreted to be different than
// result_compiled. Therefore we do not check the equality of the results
// if the execution may have produced a NaN at some point.
if (result_interpreted != result_compiled) {
V8_Fatal(__FILE__, __LINE__, "WasmCodeFuzzerHash=%x",
v8::internal::StringHasher::HashSequentialString(
data, static_cast<int>(size), WASM_CODE_FUZZER_HASH_SEED));
}
}
return 0;
return WasmCodeFuzzer().FuzzWasmModule(data, size);
}
test/fuzzer/wasm-compile.cc
View file @ eb64b26f
......@@ -19,12 +19,13 @@
#include "test/common/wasm/test-signatures.h"
#include "test/common/wasm/wasm-module-runner.h"
#include "test/fuzzer/fuzzer-support.h"
#define WASM_CODE_FUZZER_HASH_SEED 83
#include "test/fuzzer/wasm-fuzzer-common.h"
typedef uint8_t byte;
using namespace v8::internal;
using namespace v8::internal::wasm;
using namespace v8::internal::wasm::fuzzer;
namespace {
......@@ -297,141 +298,38 @@ void WasmGenerator::Generate(ValueType type, DataRange data) {
}
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
// Save the flag so that we can change it and restore it later.
bool generate_test = v8::internal::FLAG_wasm_code_fuzzer_gen_test;
if (generate_test) {
v8::internal::OFStream os(stdout);
os << "// Copyright 2017 the V8 project authors. All rights reserved."
<< std::endl;
os << "// Use of this source code is governed by a BSD-style license that "
"can be"
<< std::endl;
os << "// found in the LICENSE file." << std::endl;
os << std::endl;
os << "load(\"test/mjsunit/wasm/wasm-constants.js\");" << std::endl;
os << "load(\"test/mjsunit/wasm/wasm-module-builder.js\");" << std::endl;
os << std::endl;
os << "(function() {" << std::endl;
os << " var builder = new WasmModuleBuilder();" << std::endl;
os << " builder.addMemory(16, 32, false);" << std::endl;
os << " builder.addFunction(\"test\", kSig_i_iii)" << std::endl;
os << " .addBodyWithEnd([" << std::endl;
}
v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
v8::Isolate* isolate = support->GetIsolate();
v8::internal::Isolate* i_isolate =
reinterpret_cast<v8::internal::Isolate*>(isolate);
// Clear any pending exceptions from a prior run.
if (i_isolate->has_pending_exception()) {
i_isolate->clear_pending_exception();
}
v8::Isolate::Scope isolate_scope(isolate);
v8::HandleScope handle_scope(isolate);
v8::Context::Scope context_scope(support->GetContext());
v8::TryCatch try_catch(isolate);
v8::internal::AccountingAllocator allocator;
v8::internal::Zone zone(&allocator, ZONE_NAME);
class WasmCompileFuzzer : public WasmExecutionFuzzer {
virtual bool GenerateModule(
Isolate* isolate, Zone* zone, const uint8_t* data, size_t size,
ZoneBuffer& buffer, int32_t& num_args,
std::unique_ptr<WasmVal[]>& interpreter_args,
std::unique_ptr<Handle<Object>[]>& compiler_args) override {
TestSignatures sigs;
TestSignatures sigs;
WasmModuleBuilder builder(zone);
WasmModuleBuilder builder(&zone);
v8::internal::wasm::WasmFunctionBuilder* f =
builder.AddFunction(sigs.i_iii());
v8::internal::wasm::WasmFunctionBuilder* f =
builder.AddFunction(sigs.i_iii());
WasmGenerator gen(f);
gen.Generate<kWasmI32>(DataRange(data, static_cast<uint32_t>(size)));
WasmGenerator gen(f);
gen.Generate<kWasmI32>(DataRange(data, static_cast<uint32_t>(size)));
uint8_t end_opcode = kExprEnd;
f->EmitCode(&end_opcode, 1);
f->ExportAs(v8::internal::CStrVector("main"));
uint8_t end_opcode = kExprEnd;
f->EmitCode(&end_opcode, 1);
f->ExportAs(v8::internal::CStrVector("main"));
builder.WriteTo(buffer);
ZoneBuffer buffer(&zone);
builder.WriteTo(buffer);
num_args = 3;
interpreter_args.reset(new WasmVal[3]{WasmVal(1), WasmVal(2), WasmVal(3)});
v8::internal::wasm::testing::SetupIsolateForWasmModule(i_isolate);
v8::internal::HandleScope scope(i_isolate);
ErrorThrower interpreter_thrower(i_isolate, "Interpreter");
std::unique_ptr<const WasmModule> module(testing::DecodeWasmModuleForTesting(
i_isolate, &interpreter_thrower, buffer.begin(), buffer.end(),
v8::internal::wasm::ModuleOrigin::kWasmOrigin, true));
// Clear the flag so that the WebAssembly code is not printed twice.
v8::internal::FLAG_wasm_code_fuzzer_gen_test = false;
if (module == nullptr) {
if (generate_test) {
v8::internal::OFStream os(stdout);
os << " ])" << std::endl;
os << " .exportFunc();" << std::endl;
os << " assertThrows(function() { builder.instantiate(); });"
<< std::endl;
os << "})();" << std::endl;
}
return 0;
}
if (generate_test) {
v8::internal::OFStream os(stdout);
os << " ])" << std::endl;
os << " .exportFunc();" << std::endl;
os << " var module = builder.instantiate();" << std::endl;
os << " module.exports.test(1, 2, 3);" << std::endl;
os << "})();" << std::endl;
}
ModuleWireBytes wire_bytes(buffer.begin(), buffer.end());
int32_t result_interpreted;
bool possible_nondeterminism = false;
{
WasmVal args[] = {WasmVal(1), WasmVal(2), WasmVal(3)};
result_interpreted = testing::InterpretWasmModule(
i_isolate, &interpreter_thrower, module.get(), wire_bytes, 0, args,
&possible_nondeterminism);
compiler_args.reset(new Handle<Object>[3]{
handle(Smi::FromInt(1), isolate), handle(Smi::FromInt(1), isolate),
handle(Smi::FromInt(1), isolate)});
return true;
}
};
ErrorThrower compiler_thrower(i_isolate, "Compiler");
v8::internal::Handle<v8::internal::JSObject> instance =
testing::InstantiateModuleForTesting(i_isolate, &compiler_thrower,
module.get(), wire_bytes);
// Restore the flag.
v8::internal::FLAG_wasm_code_fuzzer_gen_test = generate_test;
if (!interpreter_thrower.error()) {
CHECK(!instance.is_null());
} else {
return 0;
}
int32_t result_compiled;
{
v8::internal::Handle<v8::internal::Object> arguments[] = {
v8::internal::handle(v8::internal::Smi::FromInt(1), i_isolate),
v8::internal::handle(v8::internal::Smi::FromInt(2), i_isolate),
v8::internal::handle(v8::internal::Smi::FromInt(3), i_isolate)};
result_compiled = testing::CallWasmFunctionForTesting(
i_isolate, instance, &compiler_thrower, "main", arraysize(arguments),
arguments, v8::internal::wasm::ModuleOrigin::kWasmOrigin);
}
if (result_interpreted == bit_cast<int32_t>(0xdeadbeef) &&
!possible_nondeterminism) {
CHECK(i_isolate->has_pending_exception());
i_isolate->clear_pending_exception();
} else {
// The WebAssembly spec allows the sign bit of NaN to be non-deterministic.
// This sign bit may cause result_interpreted to be different than
// result_compiled. Therefore we do not check the equality of the results
// if the execution may have produced a NaN at some point.
if (!possible_nondeterminism && (result_interpreted != result_compiled)) {
printf("\nInterpreter returned 0x%x but compiled code returned 0x%x\n",
result_interpreted, result_compiled);
V8_Fatal(__FILE__, __LINE__, "WasmCodeFuzzerHash=%x",
v8::internal::StringHasher::HashSequentialString(
data, static_cast<int>(size), WASM_CODE_FUZZER_HASH_SEED));
}
}
return 0;
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
return WasmCompileFuzzer().FuzzWasmModule(data, size);
}
test/fuzzer/wasm-data-section.cc
View file @ eb64b26f
......@@ -3,8 +3,10 @@
// found in the LICENSE file.
#include "src/objects-inl.h"
#include "test/fuzzer/wasm-section-fuzzers.h"
#include "test/fuzzer/wasm-fuzzer-common.h"
using namespace v8::internal::wasm::fuzzer;
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
return fuzz_wasm_section(v8::internal::wasm::kDataSectionCode, data, size);
return FuzzWasmSection(v8::internal::wasm::kDataSectionCode, data, size);
}
test/fuzzer/wasm-function-sigs-section.cc
View file @ eb64b26f
......@@ -3,9 +3,10 @@
// found in the LICENSE file.
#include "src/objects-inl.h"
#include "test/fuzzer/wasm-section-fuzzers.h"
#include "test/fuzzer/wasm-fuzzer-common.h"
using namespace v8::internal::wasm::fuzzer;
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
return fuzz_wasm_section(v8::internal::wasm::kFunctionSectionCode, data,
size);
return FuzzWasmSection(v8::internal::wasm::kFunctionSectionCode, data, size);
}
test/fuzzer/wasm-fuzzer-common.cc 0 → 100644
View file @ eb64b26f
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "test/fuzzer/wasm-fuzzer-common.h"
#include "include/v8.h"
#include "src/isolate.h"
#include "src/objects-inl.h"
#include "src/wasm/wasm-module-builder.h"
#include "src/wasm/wasm-module.h"
#include "src/zone/accounting-allocator.h"
#include "src/zone/zone.h"
#include "test/common/wasm/wasm-module-runner.h"
#include "test/fuzzer/fuzzer-support.h"
#define WASM_CODE_FUZZER_HASH_SEED 83
using namespace v8::internal;
using namespace v8::internal::wasm;
using namespace v8::internal::wasm::fuzzer;
static const char* kNameString = "name";
static const size_t kNameStringLength = 4;
int v8::internal::wasm::fuzzer::FuzzWasmSection(SectionCode section,
const uint8_t* data,
size_t size) {
v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
v8::Isolate* isolate = support->GetIsolate();
v8::internal::Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
// Clear any pending exceptions from a prior run.
if (i_isolate->has_pending_exception()) {
i_isolate->clear_pending_exception();
}
v8::Isolate::Scope isolate_scope(isolate);
v8::HandleScope handle_scope(isolate);
v8::Context::Scope context_scope(support->GetContext());
v8::TryCatch try_catch(isolate);
AccountingAllocator allocator;
Zone zone(&allocator, ZONE_NAME);
ZoneBuffer buffer(&zone);
buffer.write_u32(kWasmMagic);
buffer.write_u32(kWasmVersion);
if (section == kNameSectionCode) {
buffer.write_u8(kUnknownSectionCode);
buffer.write_size(size + kNameStringLength + 1);
buffer.write_u8(kNameStringLength);
buffer.write(reinterpret_cast<const uint8_t*>(kNameString),
kNameStringLength);
buffer.write(data, size);
} else {
buffer.write_u8(section);
buffer.write_size(size);
buffer.write(data, size);
}
ErrorThrower thrower(i_isolate, "decoder");
std::unique_ptr<const WasmModule> module(testing::DecodeWasmModuleForTesting(
i_isolate, &thrower, buffer.begin(), buffer.end(), kWasmOrigin));
return 0;
}
int WasmExecutionFuzzer::FuzzWasmModule(
const uint8_t* data, size_t size) {
// Save the flag so that we can change it and restore it later.
bool generate_test = FLAG_wasm_code_fuzzer_gen_test;
if (generate_test) {
OFStream os(stdout);
os << "// Copyright 2017 the V8 project authors. All rights reserved."
<< std::endl;
os << "// Use of this source code is governed by a BSD-style license that "
"can be"
<< std::endl;
os << "// found in the LICENSE file." << std::endl;
os << std::endl;
os << "load(\"test/mjsunit/wasm/wasm-constants.js\");" << std::endl;
os << "load(\"test/mjsunit/wasm/wasm-module-builder.js\");" << std::endl;
os << std::endl;
os << "(function() {" << std::endl;
os << " var builder = new WasmModuleBuilder();" << std::endl;
os << " builder.addMemory(16, 32, false);" << std::endl;
os << " builder.addFunction(\"test\", kSig_i_iii)" << std::endl;
os << " .addBodyWithEnd([" << std::endl;
}
v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
v8::Isolate* isolate = support->GetIsolate();
Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
// Clear any pending exceptions from a prior run.
if (i_isolate->has_pending_exception()) {
i_isolate->clear_pending_exception();
}
v8::Isolate::Scope isolate_scope(isolate);
v8::HandleScope handle_scope(isolate);
v8::Context::Scope context_scope(support->GetContext());
v8::TryCatch try_catch(isolate);
HandleScope scope(i_isolate);
AccountingAllocator allocator;
Zone zone(&allocator, ZONE_NAME);
ZoneBuffer buffer(&zone);
int32_t num_args = 0;
std::unique_ptr<WasmVal[]> interpreter_args;
std::unique_ptr<Handle<Object>[]> compiler_args;
if (!GenerateModule(i_isolate, &zone, data, size, buffer, num_args,
interpreter_args, compiler_args)) {
return 0;
}
v8::internal::wasm::testing::SetupIsolateForWasmModule(i_isolate);
ErrorThrower interpreter_thrower(i_isolate, "Interpreter");
std::unique_ptr<const WasmModule> module(testing::DecodeWasmModuleForTesting(
i_isolate, &interpreter_thrower, buffer.begin(), buffer.end(),
ModuleOrigin::kWasmOrigin, true));
// Clear the flag so that the WebAssembly code is not printed twice.
FLAG_wasm_code_fuzzer_gen_test = false;
if (module == nullptr) {
if (generate_test) {
OFStream os(stdout);
os << " ])" << std::endl;
os << " .exportFunc();" << std::endl;
os << " assertThrows(function() { builder.instantiate(); });"
<< std::endl;
os << "})();" << std::endl;
}
return 0;
}
if (generate_test) {
OFStream os(stdout);
os << " ])" << std::endl;
os << " .exportFunc();" << std::endl;
os << " var module = builder.instantiate();" << std::endl;
os << " module.exports.test(1, 2, 3);" << std::endl;
os << "})();" << std::endl;
}
ModuleWireBytes wire_bytes(buffer.begin(), buffer.end());
int32_t result_interpreted;
bool possible_nondeterminism = false;
{
result_interpreted = testing::InterpretWasmModule(
i_isolate, &interpreter_thrower, module.get(), wire_bytes, 0,
interpreter_args.get(), &possible_nondeterminism);
}
ErrorThrower compiler_thrower(i_isolate, "Compiler");
Handle<JSObject> instance = testing::InstantiateModuleForTesting(
i_isolate, &compiler_thrower, module.get(), wire_bytes);
// Restore the flag.
FLAG_wasm_code_fuzzer_gen_test = generate_test;
if (!interpreter_thrower.error()) {
CHECK(!instance.is_null());
} else {
return 0;
}
int32_t result_compiled;
{
result_compiled = testing::CallWasmFunctionForTesting(
i_isolate, instance, &compiler_thrower, "main", num_args,
compiler_args.get(), ModuleOrigin::kWasmOrigin);
}
// The WebAssembly spec allows the sign bit of NaN to be non-deterministic.
// This sign bit may cause result_interpreted to be different than
// result_compiled. Therefore we do not check the equality of the results
// if the execution may have produced a NaN at some point.
if (possible_nondeterminism) return 0;
if (result_interpreted == bit_cast<int32_t>(0xdeadbeef)) {
CHECK(i_isolate->has_pending_exception());
i_isolate->clear_pending_exception();
} else {
CHECK(!i_isolate->has_pending_exception());
if (result_interpreted != result_compiled) {
V8_Fatal(__FILE__, __LINE__, "WasmCodeFuzzerHash=%x",
StringHasher::HashSequentialString(data, static_cast<int>(size),
WASM_CODE_FUZZER_HASH_SEED));
}
}
return 0;
}
test/fuzzer/wasm-section-fuzzers.h → test/fuzzer/wasm-fuzzer-common.h
View file @ eb64b26f
......@@ -9,8 +9,32 @@
#include <stdint.h>
#include "src/wasm/module-decoder.h"
#include "src/wasm/wasm-interpreter.h"
#include "src/wasm/wasm-module-builder.h"
int fuzz_wasm_section(v8::internal::wasm::SectionCode section,
const uint8_t* data, size_t size);
namespace v8 {
namespace internal {
namespace wasm {
namespace fuzzer {
int FuzzWasmSection(v8::internal::wasm::SectionCode section,
const uint8_t* data, size_t size);
class WasmExecutionFuzzer {
public:
virtual ~WasmExecutionFuzzer() {}
int FuzzWasmModule(const uint8_t* data, size_t size);
protected:
virtual bool GenerateModule(
Isolate* isolate, Zone* zone, const uint8_t* data, size_t size,
ZoneBuffer& buffer, int32_t& num_args,
std::unique_ptr<WasmVal[]>& interpreter_args,
std::unique_ptr<Handle<Object>[]>& compiler_args) = 0;
};
} // namespace fuzzer
} // namespace wasm
} // namespace internal
} // namespace v8
#endif // WASM_SECTION_FUZZERS_H_
test/fuzzer/wasm-globals-section.cc
View file @ eb64b26f
......@@ -3,8 +3,10 @@
// found in the LICENSE file.
#include "src/objects-inl.h"
#include "test/fuzzer/wasm-section-fuzzers.h"
#include "test/fuzzer/wasm-fuzzer-common.h"
using namespace v8::internal::wasm::fuzzer;
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
return fuzz_wasm_section(v8::internal::wasm::kGlobalSectionCode, data, size);
return FuzzWasmSection(v8::internal::wasm::kGlobalSectionCode, data, size);
}
test/fuzzer/wasm-imports-section.cc
View file @ eb64b26f
......@@ -3,8 +3,10 @@
// found in the LICENSE file.
#include "src/objects-inl.h"
#include "test/fuzzer/wasm-section-fuzzers.h"
#include "test/fuzzer/wasm-fuzzer-common.h"
using namespace v8::internal::wasm::fuzzer;
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
return fuzz_wasm_section(v8::internal::wasm::kImportSectionCode, data, size);
return FuzzWasmSection(v8::internal::wasm::kImportSectionCode, data, size);
}
test/fuzzer/wasm-memory-section.cc
View file @ eb64b26f
......@@ -3,8 +3,10 @@
// found in the LICENSE file.
#include "src/objects-inl.h"
#include "test/fuzzer/wasm-section-fuzzers.h"
#include "test/fuzzer/wasm-fuzzer-common.h"
using namespace v8::internal::wasm::fuzzer;
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
return fuzz_wasm_section(v8::internal::wasm::kMemorySectionCode, data, size);
return FuzzWasmSection(v8::internal::wasm::kMemorySectionCode, data, size);
}
test/fuzzer/wasm-names-section.cc
View file @ eb64b26f
......@@ -3,9 +3,11 @@
// found in the LICENSE file.
#include "src/objects-inl.h"
#include "test/fuzzer/wasm-section-fuzzers.h"
#include "test/fuzzer/wasm-fuzzer-common.h"
using namespace v8::internal::wasm::fuzzer;
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
// TODO(titzer): Names section requires a preceding function section.
return fuzz_wasm_section(v8::internal::wasm::kNameSectionCode, data, size);
return FuzzWasmSection(v8::internal::wasm::kNameSectionCode, data, size);
}
test/fuzzer/wasm-section-fuzzers.cc deleted 100644 → 0
View file @ d2ba280d
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "test/fuzzer/wasm-section-fuzzers.h"
#include "include/v8.h"
#include "src/isolate.h"
#include "src/objects-inl.h"
#include "src/wasm/wasm-module-builder.h"
#include "src/wasm/wasm-module.h"
#include "src/zone/accounting-allocator.h"
#include "src/zone/zone.h"
#include "test/common/wasm/wasm-module-runner.h"
#include "test/fuzzer/fuzzer-support.h"
using namespace v8::internal::wasm;
static const char* kNameString = "name";
static const size_t kNameStringLength = 4;
int fuzz_wasm_section(SectionCode section, const uint8_t* data, size_t size) {
v8_fuzzer::FuzzerSupport* support = v8_fuzzer::FuzzerSupport::Get();
v8::Isolate* isolate = support->GetIsolate();
v8::internal::Isolate* i_isolate =
reinterpret_cast<v8::internal::Isolate*>(isolate);
// Clear any pending exceptions from a prior run.
if (i_isolate->has_pending_exception()) {
i_isolate->clear_pending_exception();
}
v8::Isolate::Scope isolate_scope(isolate);
v8::HandleScope handle_scope(isolate);
v8::Context::Scope context_scope(support->GetContext());
v8::TryCatch try_catch(isolate);
v8::internal::AccountingAllocator allocator;
v8::internal::Zone zone(&allocator, ZONE_NAME);
ZoneBuffer buffer(&zone);
buffer.write_u32(kWasmMagic);
buffer.write_u32(kWasmVersion);
if (section == kNameSectionCode) {
buffer.write_u8(kUnknownSectionCode);
buffer.write_size(size + kNameStringLength + 1);
buffer.write_u8(kNameStringLength);
buffer.write(reinterpret_cast<const uint8_t*>(kNameString),
kNameStringLength);
buffer.write(data, size);
} else {
buffer.write_u8(section);
buffer.write_size(size);
buffer.write(data, size);
}
ErrorThrower thrower(i_isolate, "decoder");
std::unique_ptr<const WasmModule> module(testing::DecodeWasmModuleForTesting(
i_isolate, &thrower, buffer.begin(), buffer.end(), kWasmOrigin));
return 0;
}
test/fuzzer/wasm-types-section.cc
View file @ eb64b26f
......@@ -3,8 +3,10 @@
// found in the LICENSE file.
#include "src/objects-inl.h"
#include "test/fuzzer/wasm-section-fuzzers.h"
#include "test/fuzzer/wasm-fuzzer-common.h"
using namespace v8::internal::wasm::fuzzer;
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
return fuzz_wasm_section(v8::internal::wasm::kTypeSectionCode, data, size);
return FuzzWasmSection(v8::internal::wasm::kTypeSectionCode, data, size);
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment