14514f5e3Sopenharmony_ci/* 24514f5e3Sopenharmony_ci * Copyright (c) 2022 Huawei Device Co., Ltd. 34514f5e3Sopenharmony_ci * Licensed under the Apache License, Version 2.0 (the "License"); 44514f5e3Sopenharmony_ci * you may not use this file except in compliance with the License. 54514f5e3Sopenharmony_ci * You may obtain a copy of the License at 64514f5e3Sopenharmony_ci * 74514f5e3Sopenharmony_ci * http://www.apache.org/licenses/LICENSE-2.0 84514f5e3Sopenharmony_ci * 94514f5e3Sopenharmony_ci * Unless required by applicable law or agreed to in writing, software 104514f5e3Sopenharmony_ci * distributed under the License is distributed on an "AS IS" BASIS, 114514f5e3Sopenharmony_ci * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 124514f5e3Sopenharmony_ci * See the License for the specific language governing permissions and 134514f5e3Sopenharmony_ci * limitations under the License. 144514f5e3Sopenharmony_ci */ 154514f5e3Sopenharmony_ci 164514f5e3Sopenharmony_ci#include "containerslightweightmapvalues_fuzzer.h" 174514f5e3Sopenharmony_ci 184514f5e3Sopenharmony_ci#include "ecmascript/containers/containers_lightweightmap.h" 194514f5e3Sopenharmony_ci#include "ecmascript/containers/containers_private.h" 204514f5e3Sopenharmony_ci#include "ecmascript/ecma_string-inl.h" 214514f5e3Sopenharmony_ci#include "ecmascript/ecma_vm.h" 224514f5e3Sopenharmony_ci#include "ecmascript/global_env.h" 234514f5e3Sopenharmony_ci#include "ecmascript/js_handle.h" 244514f5e3Sopenharmony_ci#include "ecmascript/napi/include/jsnapi.h" 254514f5e3Sopenharmony_ci#include "ecmascript/js_api/js_api_lightweightmap.h" 264514f5e3Sopenharmony_ci#include "ecmascript/js_api/js_api_lightweightmap_iterator.h" 274514f5e3Sopenharmony_ci 284514f5e3Sopenharmony_ciusing namespace panda; 294514f5e3Sopenharmony_ciusing namespace panda::test; 304514f5e3Sopenharmony_ciusing namespace panda::ecmascript; 314514f5e3Sopenharmony_ciusing namespace panda::ecmascript::containers; 324514f5e3Sopenharmony_ci 334514f5e3Sopenharmony_cinamespace OHOS { 344514f5e3Sopenharmony_ci 354514f5e3Sopenharmony_ci JSFunction *JSObjectCreate(JSThread *thread) 364514f5e3Sopenharmony_ci { 374514f5e3Sopenharmony_ci EcmaVM *ecmaVM = thread->GetEcmaVM(); 384514f5e3Sopenharmony_ci JSHandle<GlobalEnv> globalEnv = ecmaVM->GetGlobalEnv(); 394514f5e3Sopenharmony_ci return globalEnv->GetObjectFunction().GetObject<JSFunction>(); 404514f5e3Sopenharmony_ci } 414514f5e3Sopenharmony_ci 424514f5e3Sopenharmony_ci EcmaRuntimeCallInfo *CreateEcmaRuntimeCallInfo(JSThread *thread, uint32_t numArgs) 434514f5e3Sopenharmony_ci { 444514f5e3Sopenharmony_ci auto factory = thread->GetEcmaVM()->GetFactory(); 454514f5e3Sopenharmony_ci JSHandle<JSTaggedValue> hclass(thread, JSObjectCreate(thread)); 464514f5e3Sopenharmony_ci JSHandle<JSTaggedValue> callee(factory->NewJSObjectByConstructor(JSHandle<JSFunction>::Cast(hclass), hclass)); 474514f5e3Sopenharmony_ci JSHandle<JSTaggedValue> undefined = thread->GlobalConstants()->GetHandledUndefined(); 484514f5e3Sopenharmony_ci EcmaRuntimeCallInfo *objCallInfo = 494514f5e3Sopenharmony_ci EcmaInterpreter::NewRuntimeCallInfo(thread, undefined, callee, undefined, numArgs); 504514f5e3Sopenharmony_ci return objCallInfo; 514514f5e3Sopenharmony_ci } 524514f5e3Sopenharmony_ci 534514f5e3Sopenharmony_ci JSTaggedValue InitializeLightWeightMapConstructor(JSThread *thread) 544514f5e3Sopenharmony_ci { 554514f5e3Sopenharmony_ci auto factory = thread->GetEcmaVM()->GetFactory(); 564514f5e3Sopenharmony_ci JSHandle<GlobalEnv> env = thread->GetEcmaVM()->GetGlobalEnv(); 574514f5e3Sopenharmony_ci JSHandle<JSTaggedValue> globalObject = env->GetJSGlobalObject(); 584514f5e3Sopenharmony_ci JSHandle<JSTaggedValue> key(factory->NewFromASCII("ArkPrivate")); 594514f5e3Sopenharmony_ci JSHandle<JSTaggedValue> value = 604514f5e3Sopenharmony_ci JSObject::GetProperty(thread, JSHandle<JSTaggedValue>(globalObject), key).GetValue(); 614514f5e3Sopenharmony_ci 624514f5e3Sopenharmony_ci auto objCallInfo = CreateEcmaRuntimeCallInfo(thread, 6); // 6 : means the argv length 634514f5e3Sopenharmony_ci objCallInfo->SetFunction(JSTaggedValue::Undefined()); 644514f5e3Sopenharmony_ci objCallInfo->SetThis(value.GetTaggedValue()); 654514f5e3Sopenharmony_ci objCallInfo->SetCallArg(0, JSTaggedValue(static_cast<int>(ContainerTag::LightWeightMap))); 664514f5e3Sopenharmony_ci JSTaggedValue result = ContainersPrivate::Load(objCallInfo); 674514f5e3Sopenharmony_ci 684514f5e3Sopenharmony_ci return result; 694514f5e3Sopenharmony_ci } 704514f5e3Sopenharmony_ci 714514f5e3Sopenharmony_ci JSHandle<JSAPILightWeightMap> CreateJSAPILightWeightMap(JSThread *thread) 724514f5e3Sopenharmony_ci { 734514f5e3Sopenharmony_ci JSHandle<JSFunction> newTarget(thread, InitializeLightWeightMapConstructor(thread)); 744514f5e3Sopenharmony_ci auto objCallInfo = CreateEcmaRuntimeCallInfo(thread, 4); 754514f5e3Sopenharmony_ci objCallInfo->SetFunction(newTarget.GetTaggedValue()); 764514f5e3Sopenharmony_ci objCallInfo->SetNewTarget(newTarget.GetTaggedValue()); 774514f5e3Sopenharmony_ci objCallInfo->SetThis(JSTaggedValue::Undefined()); 784514f5e3Sopenharmony_ci 794514f5e3Sopenharmony_ci JSTaggedValue result = ContainersLightWeightMap::LightWeightMapConstructor(objCallInfo); 804514f5e3Sopenharmony_ci JSHandle<JSAPILightWeightMap> map(thread, result); 814514f5e3Sopenharmony_ci return map; 824514f5e3Sopenharmony_ci } 834514f5e3Sopenharmony_ci 844514f5e3Sopenharmony_ci void ContainersLightWeightMapValuesFuzzTest(const uint8_t* data, size_t size) 854514f5e3Sopenharmony_ci { 864514f5e3Sopenharmony_ci RuntimeOption option; 874514f5e3Sopenharmony_ci option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR); 884514f5e3Sopenharmony_ci EcmaVM *vm = JSNApi::CreateJSVM(option); 894514f5e3Sopenharmony_ci { 904514f5e3Sopenharmony_ci JsiFastNativeScope scope(vm); 914514f5e3Sopenharmony_ci auto thread = vm->GetAssociatedJSThread(); 924514f5e3Sopenharmony_ci 934514f5e3Sopenharmony_ci if (size <= 0) { 944514f5e3Sopenharmony_ci return; 954514f5e3Sopenharmony_ci } 964514f5e3Sopenharmony_ci double input = 0; 974514f5e3Sopenharmony_ci const double maxByteLen = 4; 984514f5e3Sopenharmony_ci if (size > maxByteLen) { 994514f5e3Sopenharmony_ci size = maxByteLen; 1004514f5e3Sopenharmony_ci } 1014514f5e3Sopenharmony_ci if (memcpy_s(&input, maxByteLen, data, size) != 0) { 1024514f5e3Sopenharmony_ci std::cout << "memcpy_s failed!"; 1034514f5e3Sopenharmony_ci UNREACHABLE(); 1044514f5e3Sopenharmony_ci } 1054514f5e3Sopenharmony_ci JSHandle<JSAPILightWeightMap> lightWeightMap = CreateJSAPILightWeightMap(thread); 1064514f5e3Sopenharmony_ci 1074514f5e3Sopenharmony_ci EcmaRuntimeCallInfo *callInfo1 = CreateEcmaRuntimeCallInfo(thread, 8); 1084514f5e3Sopenharmony_ci callInfo1->SetFunction(JSTaggedValue::Undefined()); 1094514f5e3Sopenharmony_ci callInfo1->SetThis(lightWeightMap.GetTaggedValue()); 1104514f5e3Sopenharmony_ci callInfo1->SetCallArg(0, JSTaggedValue(input)); 1114514f5e3Sopenharmony_ci callInfo1->SetCallArg(1, JSTaggedValue(input)); 1124514f5e3Sopenharmony_ci ContainersLightWeightMap::Set(callInfo1); 1134514f5e3Sopenharmony_ci 1144514f5e3Sopenharmony_ci JSMutableHandle<JSTaggedValue> result(thread, JSTaggedValue::Undefined()); 1154514f5e3Sopenharmony_ci EcmaRuntimeCallInfo *callInfo2 = CreateEcmaRuntimeCallInfo(thread, 4); 1164514f5e3Sopenharmony_ci callInfo2->SetFunction(JSTaggedValue::Undefined()); 1174514f5e3Sopenharmony_ci callInfo2->SetThis(lightWeightMap.GetTaggedValue()); 1184514f5e3Sopenharmony_ci JSHandle<JSTaggedValue> iterValues(thread, ContainersLightWeightMap::Values(callInfo2)); 1194514f5e3Sopenharmony_ci 1204514f5e3Sopenharmony_ci EcmaRuntimeCallInfo *callInfo3 = CreateEcmaRuntimeCallInfo(thread, 4); 1214514f5e3Sopenharmony_ci callInfo3->SetFunction(JSTaggedValue::Undefined()); 1224514f5e3Sopenharmony_ci callInfo3->SetThis(iterValues.GetTaggedValue()); 1234514f5e3Sopenharmony_ci result.Update(JSAPILightWeightMapIterator::Next(callInfo3)); 1244514f5e3Sopenharmony_ci JSHandle<JSTaggedValue> valuesHandle = JSIterator::IteratorValue(thread, result); 1254514f5e3Sopenharmony_ci 1264514f5e3Sopenharmony_ci EcmaRuntimeCallInfo *callInfo4 = CreateEcmaRuntimeCallInfo(thread, 6); 1274514f5e3Sopenharmony_ci callInfo4->SetFunction(JSTaggedValue::Undefined()); 1284514f5e3Sopenharmony_ci callInfo4->SetThis(lightWeightMap.GetTaggedValue()); 1294514f5e3Sopenharmony_ci callInfo4->SetCallArg(0, valuesHandle.GetTaggedValue()); 1304514f5e3Sopenharmony_ci ContainersLightWeightMap::HasValue(callInfo4); 1314514f5e3Sopenharmony_ci } 1324514f5e3Sopenharmony_ci JSNApi::DestroyJSVM(vm); 1334514f5e3Sopenharmony_ci } 1344514f5e3Sopenharmony_ci} 1354514f5e3Sopenharmony_ci 1364514f5e3Sopenharmony_ci// Fuzzer entry point. 1374514f5e3Sopenharmony_ciextern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) 1384514f5e3Sopenharmony_ci{ 1394514f5e3Sopenharmony_ci // Run your code on data. 1404514f5e3Sopenharmony_ci OHOS::ContainersLightWeightMapValuesFuzzTest(data, size); 1414514f5e3Sopenharmony_ci return 0; 1424514f5e3Sopenharmony_ci}