fuzzer: initialize transfer buffer memory

gpu/command_buffer/tests/fuzzer_main.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include <stddef.h>
 #include <stdint.h>
 
 #include <memory>
 #include <vector>
 
 #include "base/at_exit.h"
@@ skipping 124 matching lines @@
       sync_point_order_data_->Destroy();
       sync_point_order_data_ = nullptr;
     }
   }
 
   void RunCommandBuffer(const uint8_t* data, size_t size) {
     InitDecoder();
     // The commands are flushed at a uint32_t granularity. If the data is not
     // a full command, we zero-pad it.
     size_t padded_size = (size + 3) & ~3;
-    CHECK_LE(padded_size, buffer_->size());
+    size_t buffer_size = buffer_->size();
+    CHECK_LE(padded_size, buffer_size);
     command_buffer_->SetGetBuffer(buffer_id_);
     auto* memory = static_cast<char*>(buffer_->memory());
     memcpy(memory, data, size);
-    if (padded_size > size)
-      memset(memory + size, 0, padded_size - size);
+    if (size < buffer_size)
+      memset(memory + size, 0, buffer_size - size);
     command_buffer_->Flush(padded_size / 4);
     ResetDecoder();
   }
 
  private:
   void PumpCommands() {
     if (!decoder_->MakeCurrent()) {
       command_buffer_->SetContextLostReason(decoder_->GetContextLostReason());
       command_buffer_->SetParseError(::gpu::error::kLostContext);
       return;
@@ skipping 27 matching lines @@
     if (!release_state)
       return true;
 
     if (release_state->IsFenceSyncReleased(release))
       return true;
 
     executor_->SetScheduled(false);
     return false;
   }
 
+  void CreateTransferBuffer(size_t size, int32_t id) {
+    scoped_refptr<Buffer> buffer =
+        command_buffer_->CreateTransferBufferWithId(size, id);
+    memset(buffer->memory(), 0, size);
+  }
+
   void InitializeInitialCommandBuffer() {
     buffer_id_ = 1;
     buffer_ = command_buffer_->CreateTransferBufferWithId(kCommandBufferSize,
                                                           buffer_id_);
     CHECK(buffer_);
     // Create some transfer buffers. This is somewhat arbitrary, but having a
     // reasonably sized buffer in slot 4 allows us to prime the corpus with data
     // extracted from unit tests.
-    command_buffer_->CreateTransferBufferWithId(kTransferBufferSize, 2);
-    command_buffer_->CreateTransferBufferWithId(kSmallTransferBufferSize, 3);
-    command_buffer_->CreateTransferBufferWithId(kTransferBufferSize, 4);
-    command_buffer_->CreateTransferBufferWithId(kTinyTransferBufferSize, 5);
+    CreateTransferBuffer(kTransferBufferSize, 2);
+    CreateTransferBuffer(kSmallTransferBufferSize, 3);
+    CreateTransferBuffer(kTransferBufferSize, 4);
+    CreateTransferBuffer(kTinyTransferBufferSize, 5);
   }
 
   base::AtExitManager atexit_manager_;
 
   gl::GLStubApi api_;
   GpuPreferences gpu_preferences_;
 
   std::unique_ptr<SyncPointManager> sync_point_manager_;
   scoped_refptr<SyncPointOrderData> sync_point_order_data_;
   std::unique_ptr<SyncPointClient> sync_point_client_;
@@ skipping 24 matching lines @@
 
 static gpu::CommandBufferSetup& GetSetup() {
   static gpu::CommandBufferSetup setup;
   return setup;
 }
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   GetSetup().RunCommandBuffer(data, size);
   return 0;
 }