[libfuzzer] content/renderer fuzzer.

content/test/renderer_fuzzer.cc

Index: content/test/renderer_fuzzer.cc
diff --git a/content/test/renderer_fuzzer.cc b/content/test/renderer_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..03f633967833ea77923cb7de5d5d40565abb6828
--- /dev/null
+++ b/content/test/renderer_fuzzer.cc
@@ -0,0 +1,72 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Fuzzer for content/renderer
+
+#include <stddef.h>
+#include <stdint.h>
+#include <memory>
+
+#include "base/feature_list.h"
+#include "content/common/navigation_params.h"
+#include "content/public/test/render_view_test.h"
+#include "content/renderer/render_view_impl.h"
+#include "content/test/test_render_frame.h"
+#include "gin/v8_initializer.h"
+#include "third_party/WebKit/public/web/WebRuntimeFeatures.h"
+
+namespace content {
+
+class FuzzerRenderTest : public RenderViewTest {
+ public:
+  FuzzerRenderTest() : RenderViewTest() {}
+  void TestBody() override {}
+
+  void SetUp() override { RenderViewTest::SetUp(); }
+
+  TestRenderFrame* frame() {
+    return static_cast<TestRenderFrame*>(view_->GetMainRenderFrame());
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FuzzerRenderTest);
+};
+
+struct Env {
+  Env() {
+    base::CommandLine::Init(0, nullptr);
+    base::FeatureList::InitializeInstance(std::string(), std::string());
+
+    blink::WebRuntimeFeatures::enableExperimentalFeatures(true);
+    blink::WebRuntimeFeatures::enableTestOnlyFeatures(true);
+    gin::V8Initializer::LoadV8Snapshot();
+    gin::V8Initializer::LoadV8Natives();
+
+    test.reset(new FuzzerRenderTest());
+    test->SetUp();
+  }
+
+  TestRenderFrame* frame() { return test->frame(); }
+
+  std::unique_ptr<FuzzerRenderTest> test;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(Env);
+};
+
+static Env* env = new Env();
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  std::string input(reinterpret_cast<const char*>(data), size);
+
+  CommonNavigationParams common_params;
+  common_params.navigation_type = FrameMsg_Navigate_Type::NORMAL;
+  common_params.url = GURL("data:text/html," + input);

[mmoroz, 2016/06/03 14:32:46]

I guess we need a dictionary for HTML? I will try to generate it :)

[aizatsky, 2016/06/03 19:04:01]

Sure. Though my long-term plan is to explore structure-based generational
fuzzing with this one.

+  env->frame()->Navigate(common_params, StartNavigationParams(),
+                         RequestNavigationParams());
+
+  return 0;
+}
+
+}  // namespace content

[mmoroz, 2016/06/03 14:32:46]

Does it make sense to have 'extern "C" int LLVMFuzzerTestOneInput()' inside of a
namespace?

[aizatsky, 2016/06/03 19:04:01]

Yes. It let's you not to write "content::" all the time.