Introduce gpu_fuzzer to fuzz the GPU command buffers

gpu/command_buffer/service/buffer_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/buffer_manager.h"
 
 #include <stdint.h>
 
 #include <limits>
 
 #include "base/format_macros.h"
 #include "base/logging.h"
 #include "base/strings/stringprintf.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/trace_event/memory_dump_manager.h"
 #include "base/trace_event/trace_event.h"
 #include "gpu/command_buffer/common/gles2_cmd_utils.h"
 #include "gpu/command_buffer/service/context_state.h"
 #include "gpu/command_buffer/service/error_state.h"
 #include "gpu/command_buffer/service/feature_info.h"
 #include "gpu/command_buffer/service/memory_tracking.h"
 #include "gpu/command_buffer/service/transform_feedback_manager.h"
 #include "ui/gl/gl_bindings.h"
 #include "ui/gl/gl_implementation.h"
 #include "ui/gl/gl_version_info.h"
 #include "ui/gl/trace_util.h"
 
 namespace gpu {
 namespace gles2 {
+namespace {
+static const GLsizeiptr kDefaultMaxBufferSize = 1u << 30;  // 1GB
+}
 
 BufferManager::BufferManager(MemoryTracker* memory_tracker,
                              FeatureInfo* feature_info)
     : memory_type_tracker_(
           new MemoryTypeTracker(memory_tracker)),
       memory_tracker_(memory_tracker),
       feature_info_(feature_info),
+      max_buffer_size_(kDefaultMaxBufferSize),
       allow_buffers_on_multiple_targets_(false),
       allow_fixed_attribs_(false),
       buffer_count_(0),
       primitive_restart_fixed_index_(0),
       lost_context_(false),
       use_client_side_arrays_for_stream_buffers_(
           feature_info
               ? feature_info->workarounds()
                     .use_client_side_arrays_for_stream_buffers
               : 0) {
@@ skipping 341 matching lines @@
     ERRORSTATE_SET_GL_ERROR_INVALID_ENUM(
         error_state, "glBufferData", usage, "usage");
     return;
   }
   if (size < 0) {
     ERRORSTATE_SET_GL_ERROR(
         error_state, GL_INVALID_VALUE, "glBufferData", "size < 0");
     return;
   }
 
-  if (size > 1024 * 1024 * 1024) {
+  if (size > max_buffer_size_) {
     ERRORSTATE_SET_GL_ERROR(error_state, GL_OUT_OF_MEMORY, "glBufferData",
                             "cannot allocate more than 1GB.");
     return;
   }
 
   Buffer* buffer = GetBufferInfoForTarget(context_state, target);
   if (!buffer) {
     ERRORSTATE_SET_GL_ERROR(
         error_state, GL_INVALID_VALUE, "glBufferData", "unknown buffer");
     return;
@@ skipping 248 matching lines @@
     auto guid = gl::GetGLBufferGUIDForTracing(share_group_tracing_guid,
                                               client_buffer_id);
     pmd->CreateSharedGlobalAllocatorDump(guid);
     pmd->AddOwnershipEdge(dump->guid(), guid);
   }
   return true;
 }
 
 }  // namespace gles2
 }  // namespace gpu