1 /*
2  * Copyright (c) 2022 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "containerslistisempty_fuzzer.h"
17 
18 #include "ecmascript/containers/containers_list.h"
19 #include "ecmascript/containers/containers_private.h"
20 #include "ecmascript/ecma_string-inl.h"
21 #include "ecmascript/ecma_vm.h"
22 #include "ecmascript/global_env.h"
23 #include "ecmascript/js_handle.h"
24 #include "ecmascript/js_tagged_value.h"
25 #include "ecmascript/napi/include/jsnapi.h"
26 
27 using namespace panda;
28 using namespace panda::test;
29 using namespace panda::ecmascript;
30 using namespace panda::ecmascript::containers;
31 
32 namespace OHOS {
JSObjectCreate(JSThread *thread)33     JSFunction *JSObjectCreate(JSThread *thread)
34     {
35         EcmaVM *ecmaVM = thread->GetEcmaVM();
36         JSHandle<GlobalEnv> globalEnv = ecmaVM->GetGlobalEnv();
37         return globalEnv->GetObjectFunction().GetObject<JSFunction>();
38     }
39 
CreateEcmaRuntimeCallInfo(JSThread *thread, uint32_t numArgs)40     EcmaRuntimeCallInfo *CreateEcmaRuntimeCallInfo(JSThread *thread, uint32_t numArgs)
41     {
42         auto factory = thread->GetEcmaVM()->GetFactory();
43         JSHandle<JSTaggedValue> hclass(thread, JSObjectCreate(thread));
44         JSHandle<JSTaggedValue> callee(factory->NewJSObjectByConstructor(JSHandle<JSFunction>::Cast(hclass), hclass));
45         JSHandle<JSTaggedValue> undefined = thread->GlobalConstants()->GetHandledUndefined();
46         EcmaRuntimeCallInfo *objCallInfo =
47             EcmaInterpreter::NewRuntimeCallInfo(thread, undefined, callee, undefined, numArgs);
48         return objCallInfo;
49     }
50 
InitializeContainersList(JSThread *thread)51     JSTaggedValue InitializeContainersList(JSThread *thread)
52     {
53         auto factory = thread->GetEcmaVM()->GetFactory();
54         JSHandle<GlobalEnv> env = thread->GetEcmaVM()->GetGlobalEnv();
55         JSHandle<JSTaggedValue> globalObject = env->GetJSGlobalObject();
56         JSHandle<JSTaggedValue> key(factory->NewFromASCII("ArkPrivate"));
57         JSHandle<JSTaggedValue> value =
58             JSObject::GetProperty(thread, JSHandle<JSTaggedValue>(globalObject), key).GetValue();
59 
60         auto objCallInfo = CreateEcmaRuntimeCallInfo(thread, 6); // 6 : means the argv length
61         objCallInfo->SetFunction(JSTaggedValue::Undefined());
62         objCallInfo->SetThis(value.GetTaggedValue());
63         objCallInfo->SetCallArg(0, JSTaggedValue(static_cast<int>(ContainerTag::List))); // 0 means the argument
64         JSTaggedValue result = ContainersPrivate::Load(objCallInfo);
65 
66         return result;
67     }
68 
CreateJSAPIList(JSThread *thread)69     JSHandle<JSAPIList> CreateJSAPIList(JSThread *thread)
70     {
71         JSHandle<JSFunction> newTarget(thread, InitializeContainersList(thread));
72         auto objCallInfo = CreateEcmaRuntimeCallInfo(thread, 4); // 4 : means the argv length
73         objCallInfo->SetFunction(newTarget.GetTaggedValue());
74         objCallInfo->SetNewTarget(newTarget.GetTaggedValue());
75         objCallInfo->SetThis(JSTaggedValue::Undefined());
76         JSTaggedValue result = ContainersList::Add(objCallInfo);
77         JSHandle<JSAPIList> map(thread, result);
78         return map;
79     }
80 
ContainerslistIsemptyFuzzTest(const uint8_t* data, size_t size)81     void ContainerslistIsemptyFuzzTest(const uint8_t* data, size_t size)
82     {
83         RuntimeOption option;
84         option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR);
85         EcmaVM *vm = JSNApi::CreateJSVM(option);
86         {
87             JsiFastNativeScope scope(vm);
88             auto thread = vm->GetAssociatedJSThread();
89 
90             if (size <= 0) {
91                 return;
92             }
93             double input = 0;
94             const double MAXBYTELEN = 8;
95             if (size > MAXBYTELEN) {
96                 size = MAXBYTELEN;
97             }
98             if (JSTaggedValue::IsImpureNaN(input)) {
99                 return;
100             }
101             if (memcpy_s(&input, MAXBYTELEN, data, size) != 0) {
102                 std::cout << "memcpy_s failed!";
103                 UNREACHABLE();
104             }
105             JSHandle<JSAPIList> lightWeightSet = CreateJSAPIList(thread);
106             EcmaRuntimeCallInfo *callInfo = CreateEcmaRuntimeCallInfo(thread, 6); // 6 : means the argv length
107             callInfo->SetFunction(JSTaggedValue::Undefined());
108             callInfo->SetThis(lightWeightSet.GetTaggedValue());
109             callInfo->SetCallArg(0, JSTaggedValue(input));
110             ContainersList::IsEmpty(callInfo);
111         }
112         JSNApi::DestroyJSVM(vm);
113     }
114 }
115 
116 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)117 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
118 {
119     // Run your code on data.
120     OHOS::ContainerslistIsemptyFuzzTest(data, size);
121     return 0;
122 }