dom/base/fuzztest/FuzzStructuredClone.cpp

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
   5  * You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #include "FuzzingInterface.h"
   8
   9 #include "jsapi.h"
  10 #include "js/StructuredClone.h"
  11 #include "mozilla/dom/ipc/StructuredCloneData.h"
  12 #include "mozilla/dom/ScriptSettings.h"
  13 #include "mozilla/dom/StructuredCloneHolder.h"
  14 #include "mozilla/dom/SimpleGlobalObject.h"
  15 #include "mozilla/ErrorResult.h"
  16 #include "mozilla/ScopeExit.h"
  17 #include "mozilla/UniquePtr.h"
  18
  19 #include "nsCycleCollector.h"
  20
  21 using namespace mozilla;
  22 using namespace mozilla::dom;
  23 using namespace mozilla::dom::ipc;
  24
  25 JS::PersistentRooted<JSObject*> global;
  26
  27 static int FuzzingInitDomSC(int* argc, char*** argv) {
  28   JSObject* simpleGlobal =
  29       SimpleGlobalObject::Create(SimpleGlobalObject::GlobalType::BindingDetail);
  30   global.init(mozilla::dom::RootingCx());
  31   global.set(simpleGlobal);
  32   return 0;
  33 }
  34
  35 static int FuzzingRunDomSC(const uint8_t* data, size_t size) {
  36   if (size < 8) {
  37     return 0;
  38   }
  39
  40   AutoJSAPI jsapi;
  41   MOZ_RELEASE_ASSERT(jsapi.Init(global));
  42
  43   JSContext* cx = jsapi.cx();
  44   auto gcGuard = mozilla::MakeScopeExit([&] {
  45     JS::PrepareForFullGC(cx);
  46     JS::NonIncrementalGC(cx, JS::GCOptions::Normal, JS::GCReason::API);
  47     nsCycleCollector_collect(CCReason::API, nullptr);
  48   });
  49
  50   // The internals of SCInput have a release assert about the padding
  51   // of the data, so we fix it here to avoid performance problems
  52   // during fuzzing.
  53   size -= size % 8;
  54
  55   StructuredCloneData scdata;
  56   if (!scdata.CopyExternalData(reinterpret_cast<const char*>(data), size)) {
  57     return 0;
  58   }
  59
  60   JS::Rooted<JS::Value> result(cx);
  61   ErrorResult rv;
  62   scdata.Read(cx, &result, rv);
  63
  64   rv.SuppressException();
  65
  66   return 0;
  67 }
  68
  69 MOZ_FUZZING_INTERFACE_RAW(FuzzingInitDomSC, FuzzingRunDomSC,
  70                           StructuredCloneReaderDOM);