1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "containerslightweightmapisempty_fuzzer.h"
17 
18 #include "ecmascript/containers/containers_lightweightmap.h"
19 #include "ecmascript/containers/containers_private.h"
20 #include "ecmascript/ecma_string-inl.h"
21 #include "ecmascript/ecma_vm.h"
22 #include "ecmascript/global_env.h"
23 #include "ecmascript/js_handle.h"
24 #include "ecmascript/napi/include/jsnapi.h"
25 
26 using namespace panda;
27 using namespace panda::test;
28 using namespace panda::ecmascript;
29 using namespace panda::ecmascript::containers;
30 
31 namespace OHOS {
32 
JSObjectCreate(JSThread *thread)33     JSFunction *JSObjectCreate(JSThread *thread)
34     {
35         EcmaVM *ecmaVM = thread->GetEcmaVM();
36         JSHandle<GlobalEnv> globalEnv = ecmaVM->GetGlobalEnv();
37         return globalEnv->GetObjectFunction().GetObject<JSFunction>();
38     }
39 
CreateEcmaRuntimeCallInfo(JSThread *thread, uint32_t numArgs)40     EcmaRuntimeCallInfo *CreateEcmaRuntimeCallInfo(JSThread *thread, uint32_t numArgs)
41     {
42         auto factory = thread->GetEcmaVM()->GetFactory();
43         JSHandle<JSTaggedValue> hclass(thread, JSObjectCreate(thread));
44         JSHandle<JSTaggedValue> callee(factory->NewJSObjectByConstructor(JSHandle<JSFunction>::Cast(hclass), hclass));
45         JSHandle<JSTaggedValue> undefined = thread->GlobalConstants()->GetHandledUndefined();
46         EcmaRuntimeCallInfo *objCallInfo =
47             EcmaInterpreter::NewRuntimeCallInfo(thread, undefined, callee, undefined, numArgs);
48         return objCallInfo;
49     }
50 
InitializeLightWeightMapConstructor(JSThread *thread)51     JSTaggedValue InitializeLightWeightMapConstructor(JSThread *thread)
52     {
53         auto factory = thread->GetEcmaVM()->GetFactory();
54         JSHandle<GlobalEnv> env = thread->GetEcmaVM()->GetGlobalEnv();
55         JSHandle<JSTaggedValue> globalObject = env->GetJSGlobalObject();
56         JSHandle<JSTaggedValue> key(factory->NewFromASCII("ArkPrivate"));
57         JSHandle<JSTaggedValue> value =
58             JSObject::GetProperty(thread, JSHandle<JSTaggedValue>(globalObject), key).GetValue();
59 
60         auto objCallInfo = CreateEcmaRuntimeCallInfo(thread, 6); // 6 : means the argv length
61         objCallInfo->SetFunction(JSTaggedValue::Undefined());
62         objCallInfo->SetThis(value.GetTaggedValue());
63         objCallInfo->SetCallArg(0, JSTaggedValue(static_cast<int>(ContainerTag::LightWeightMap)));
64         JSTaggedValue result = ContainersPrivate::Load(objCallInfo);
65 
66         return result;
67     }
68 
CreateJSAPILightWeightMap(JSThread *thread)69     JSHandle<JSAPILightWeightMap> CreateJSAPILightWeightMap(JSThread *thread)
70     {
71         JSHandle<JSFunction> newTarget(thread, InitializeLightWeightMapConstructor(thread));
72         auto objCallInfo = CreateEcmaRuntimeCallInfo(thread, 4);
73         objCallInfo->SetFunction(newTarget.GetTaggedValue());
74         objCallInfo->SetNewTarget(newTarget.GetTaggedValue());
75         objCallInfo->SetThis(JSTaggedValue::Undefined());
76 
77         JSTaggedValue result = ContainersLightWeightMap::LightWeightMapConstructor(objCallInfo);
78         JSHandle<JSAPILightWeightMap> map(thread, result);
79         return map;
80     }
81 
ContainersLightWeightMapIsEmptyFuzzTest(const uint8_t* data, size_t size)82     void ContainersLightWeightMapIsEmptyFuzzTest(const uint8_t* data, size_t size)
83     {
84         RuntimeOption option;
85         option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR);
86         EcmaVM *vm = JSNApi::CreateJSVM(option);
87         {
88             JsiFastNativeScope scope(vm);
89             auto thread = vm->GetAssociatedJSThread();
90 
91             if (size <= 0) {
92                 return;
93             }
94             double input = 0;
95             const double maxByteLen = 4;
96             if (size > maxByteLen) {
97                 size = maxByteLen;
98             }
99             if (memcpy_s(&input, maxByteLen, data, size) != 0) {
100                 std::cout << "memcpy_s failed!";
101                 UNREACHABLE();
102             }
103             JSHandle<JSAPILightWeightMap> lightWeightMap = CreateJSAPILightWeightMap(thread);
104 
105             EcmaRuntimeCallInfo *callInfo1 = CreateEcmaRuntimeCallInfo(thread, 8);
106             callInfo1->SetFunction(JSTaggedValue::Undefined());
107             callInfo1->SetThis(lightWeightMap.GetTaggedValue());
108             callInfo1->SetCallArg(0, JSTaggedValue(input));
109             callInfo1->SetCallArg(1, JSTaggedValue(input + 1));
110             ContainersLightWeightMap::Set(callInfo1);
111 
112             EcmaRuntimeCallInfo *callInfo2 = CreateEcmaRuntimeCallInfo(thread, 4);
113             callInfo2->SetFunction(JSTaggedValue::Undefined());
114             callInfo2->SetThis(lightWeightMap.GetTaggedValue());
115             ContainersLightWeightMap::IsEmpty(callInfo2);
116         }
117         JSNApi::DestroyJSVM(vm);
118     }
119 }
120 
121 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)122 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
123 {
124     // Run your code on data.
125     OHOS::ContainersLightWeightMapIsEmptyFuzzTest(data, size);
126     return 0;
127 }