1 /*
2 * Copyright (c) 2023-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "generatorfunctionref_fuzzer.h"
17 #include "ecmascript/base/string_helper.h"
18 #include "ecmascript/ecma_vm.h"
19 #include "ecmascript/global_env.h"
20 #include "ecmascript/js_function.h"
21 #include "ecmascript/js_generator_object.h"
22 #include "ecmascript/js_handle.h"
23 #include "ecmascript/js_set.h"
24 #include "ecmascript/js_tagged_value.h"
25 #include "ecmascript/linked_hash_table.h"
26 #include "ecmascript/napi/include/jsnapi.h"
27 #include "ecmascript/napi/jsnapi_helper.h"
28 #include "ecmascript/object_factory.h"
29
30 using namespace panda;
31 using namespace panda::ecmascript;
32
33 namespace OHOS {
CreateGeneratorObj(EcmaVM *vm)34 Local<GeneratorFunctionRef> CreateGeneratorObj(EcmaVM *vm)
35 {
36 auto thread = vm->GetAssociatedJSThread();
37 JSHandle<GlobalEnv> env = thread->GetEcmaVM()->GetGlobalEnv();
38 ObjectFactory *factory = thread->GetEcmaVM()->GetFactory();
39 JSHandle<JSTaggedValue> genFunc = env->GetGeneratorFunctionFunction();
40 JSHandle<JSGeneratorObject> genObjHandleVal = factory->NewJSGeneratorObject(genFunc);
41 JSHandle<JSHClass> hclass = JSHandle<JSHClass>::Cast(env->GetGeneratorFunctionClass());
42 JSHandle<JSFunction> generatorFunc = JSHandle<JSFunction>::Cast(factory->NewJSObject(hclass));
43 JSFunction::InitializeJSFunction(thread, generatorFunc, FunctionKind::GENERATOR_FUNCTION);
44 JSHandle<GeneratorContext> generatorContext = factory->NewGeneratorContext();
45 generatorContext->SetMethod(thread, generatorFunc.GetTaggedValue());
46 JSHandle<JSTaggedValue> generatorContextVal = JSHandle<JSTaggedValue>::Cast(generatorContext);
47 genObjHandleVal->SetGeneratorContext(thread, generatorContextVal.GetTaggedValue());
48 JSHandle<JSTaggedValue> genObjTagHandleVal = JSHandle<JSTaggedValue>::Cast(genObjHandleVal);
49 return JSNApiHelper::ToLocal<GeneratorObjectRef>(genObjTagHandleVal);
50 }
51
IsGeneratorFuzztest([[maybe_unused]]const uint8_t *data, size_t size)52 void IsGeneratorFuzztest([[maybe_unused]]const uint8_t *data, size_t size)
53 {
54 RuntimeOption option;
55 option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR);
56 EcmaVM *vm = JSNApi::CreateJSVM(option);
57 if (size <= 0) {
58 LOG_ECMA(ERROR) << "illegal input!";
59 return;
60 }
61 Local<GeneratorObjectRef> genObjectRef = CreateGeneratorObj(vm);
62 Local<GeneratorFunctionRef> object = genObjectRef->GetGeneratorFunction(vm);
63 object->IsGenerator(vm);
64 JSNApi::DestroyJSVM(vm);
65 }
66
GetGeneratorStateFuzztest([[maybe_unused]]const uint8_t *data, size_t size)67 void GetGeneratorStateFuzztest([[maybe_unused]]const uint8_t *data, size_t size)
68 {
69 RuntimeOption option;
70 option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR);
71 EcmaVM *vm = JSNApi::CreateJSVM(option);
72 if (size <= 0) {
73 LOG_ECMA(ERROR) << "illegal input!";
74 return;
75 }
76 Local<GeneratorObjectRef> genObjectRef = CreateGeneratorObj(vm);
77 genObjectRef->GetGeneratorState(vm);
78 JSNApi::DestroyJSVM(vm);
79 }
80
GetGeneratorFunctionFuzztest([[maybe_unused]]const uint8_t *data, size_t size)81 void GetGeneratorFunctionFuzztest([[maybe_unused]]const uint8_t *data, size_t size)
82 {
83 RuntimeOption option;
84 option.SetLogLevel(RuntimeOption::LOG_LEVEL::ERROR);
85 EcmaVM *vm = JSNApi::CreateJSVM(option);
86 if (size <= 0) {
87 LOG_ECMA(ERROR) << "illegal input!";
88 return;
89 }
90 Local<GeneratorObjectRef> genObjectRef = CreateGeneratorObj(vm);
91 genObjectRef->GetGeneratorFunction(vm);
92 JSNApi::DestroyJSVM(vm);
93 }
94 }
95
96 // Fuzzer entry point.
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)97 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
98 {
99 // Run your code on data.
100 OHOS::IsGeneratorFuzztest(data, size);
101 OHOS::GetGeneratorStateFuzztest(data, size);
102 OHOS::GetGeneratorFunctionFuzztest(data, size);
103 return 0;
104 }