DO NOT SUBMIT bluetooth-fuzzer: Draft fuzzer

third_party/WebKit/Source/modules/bluetooth/testing/clusterfuzz/constraints.py

Index: third_party/WebKit/Source/modules/bluetooth/testing/clusterfuzz/constraints.py
diff --git a/third_party/WebKit/Source/modules/bluetooth/testing/clusterfuzz/constraints.py b/third_party/WebKit/Source/modules/bluetooth/testing/clusterfuzz/constraints.py
index 9c09f0cd82dc85a7b0be7e12960a0285d4756573..e396772705bfc8ce1ea572093427c2872465fd2e 100644
--- a/third_party/WebKit/Source/modules/bluetooth/testing/clusterfuzz/constraints.py
+++ b/third_party/WebKit/Source/modules/bluetooth/testing/clusterfuzz/constraints.py
@@ -34,23 +34,59 @@ DEVICE_DISCOVERY_BASE = BASIC_BASE + \
     '      return requestDeviceWithKeyDown({{\n'\
     '        filters: [{{services: [{service_uuid}]}}]}});\n'\
     '    }})\n'\
-    '    .then(device => {{\n'
+    '    .then(device => {{\n'\
+    '      var gatt = device.gatt;\n'
 
 CONNECTABLE_BASE = DEVICE_DISCOVERY_BASE + \
-    '      return device.gatt.connect();\n'\
+    '      return gatt.connect();\n'\
     '    }})\n'\
-    '    .then(gatt => {{\n'
+    '    .then(gatt => {{\n'\
+    '      var device = gatt.device;\n'
 
 SERVICE_RETRIEVED_BASE = CONNECTABLE_BASE + \
     '      return gatt.getPrimaryService({service_uuid});\n'\
     '    }})\n'\
-    '    .then(service => {{\n'
+    '    .then(services => {{\n'\
+    '      var device = services.device;\n'\
+    '      var gatt = device.gatt;\n'
 
+SERVICES_RETRIEVED_BASE = CONNECTABLE_BASE + \
+    '      return gatt.getPrimaryServices({optional_service_uuid});\n'\
+    '    }})\n'\
+    '    .then(services => {{\n'\
+    '      var device = services[0].device;\n'\
+    '      var gatt = device.gatt;\n'
+
+CHARACTERISTIC_RETRIEVED_BASE = \
+    '      TRANSFORM_PICK_A_SERVICE;\n'\
+    '      return service.getCharacteristic({characteristic_uuid});\n'\
+    '    }})\n'\
+    '    .then(characteristics => {{\n'\
+    '      var service = characteristics.service;\n'\
+    '      var device = service.device;\n'\
+    '      var gatt = device.gatt;\n'
+
+CHARACTERISTICS_RETRIEVED_BASE = \
+    '      TRANSFORM_PICK_A_SERVICE;\n'\
+    '      return service.getCharacteristics({optional_characteristic_uuid});\n'\
+    '    }})\n'\
+    '    .then(characteristics => {{\n'\
+    '      var service = characteristics[0].service;\n'\
+    '      var device = service.device;\n'\
+    '      var gatt = device.gatt;\n'
 
 def _ToJsStr(s):
     return u'\'{}\''.format(s)
 
 
+def _GetOptional(s):
+  return random.choice(['', s])
+
+
+def _GetRandomNumber():
+  return utils.UniformExpoInteger(0, sys.maxsize.bit_length() + 1)
+
+
 def _GetFuzzedJsString(s):
     """Returns a fuzzed string based on |s|.
 
@@ -67,6 +103,7 @@ def _GetFuzzedJsString(s):
             print 'Can\'t decode fuzzed string. Trying again.'
         else:
             fuzzed_string = '\\n'.join(fuzzed_string.split())
+            fuzzed_string = fuzzed_string.replace('\\', r'\\')
             fuzzed_string = fuzzed_string.replace('\'', r'\'')
             return _ToJsStr(fuzzed_string)
 
@@ -76,6 +113,15 @@ def GetAdvertisedServiceUUIDFromFakes():
     return _ToJsStr(random.choice(wbt_fakes.ADVERTISED_SERVICES))
 
 
+def GetServiceUUIDFromFakes():
+    """Returns a random service string from the list of fake services."""
+    return _ToJsStr(random.choice(wbt_fakes.SERVICES))
+
+
+def GetCharacteristicUUIDFromFakes():
+  return _ToJsStr(random.choice(wbt_fakes.CHARACTERISTICS))
+
+
 def GetValidServiceAlias():
     """Returns a valid service alias from the list of services aliases."""
     return _ToJsStr(random.choice(gatt_aliases.SERVICES))
@@ -87,7 +133,7 @@ def GetRandomUUID():
     if choice == 'uuid':
         return _ToJsStr(uuid.uuid4())
     elif choice == 'number':
-        return utils.UniformExpoInteger(0, sys.maxsize.bit_length() + 1)
+        return _GetRandomNumber()
     elif choice == 'fuzzed string':
         choice2 = random.choice(['uuid', 'alias'])
         if choice2 == 'uuid':
@@ -101,8 +147,8 @@ def GetRandomUUID():
 def GetAdvertisedServiceUUID():
     """Generates a random Service UUID from a set of functions.
 
-    See GetServiceUUIDFromFakes(), GetValidServiceAlias() and GetRandomUUID()
-    for the different values this function can return.
+    See GetAdvertisedServiceUUIDFromFakes(), GetValidServiceAlias() and
+    GetRandomUUID() for the different values this function can return.
 
     This function weights GetServiceUUIDFromFakes() more heavily to increase the
     probability of generating test pages that can interact with the fake
@@ -121,6 +167,39 @@ def GetAdvertisedServiceUUID():
         return GetRandomUUID()
 
 
+def GetServiceUUID():
+    """Generates a random Service UUID from a set of functions.
+
+    Similar to GetAdvertisedServiceUUID() but weights GetServiceUUIDFromFakes()
+    more heavily to increase the  probability of generating test pages that can
+    interact with the fake adapters.
+
+    See GetServiceUUIDFromFakes(), GetValidServiceAlias() and
+    GetRandomUUID() for the different values this function can return.
+
+    Returns:
+      A string or a number that can be used as a Service UUID by the Web
+      Bluetooth API.
+    """
+    roll = random.random()
+    if roll < 0.8:
+        return GetServiceUUIDFromFakes()
+    elif roll < 0.9:
+        return GetValidServiceAlias()
+    else:
+        return GetRandomUUID()
+
+
+def GetCharacteristicUUID():
+    roll = random.random()
+    if roll < 0.8:
+        return GetCharacteristicUUIDFromFakes()
+    elif roll < 0.9:
+        return GetCharacteristicUUIDFromFakes()
+    else:
+        return GetRandomUUID()
+
+
 def GetRequestDeviceOptions():
     """Returns an object used by navigator.bluetooth.requestDevice."""
     # TODO(ortuno): Randomize the members, number of filters, services, etc.
@@ -156,7 +235,7 @@ def GetConnectableBase():
         service_uuid=_ToJsStr(random.choice(services)))
 
 
-def GetServiceRetrievedBase():
+def GetServicesRetrievedBase():
     """Returns a string that contains all steps to retrieve a service.
 
     Returns: A string that:
@@ -167,6 +246,86 @@ def GetServiceRetrievedBase():
       4. Retrieve the device's service used in 2.
     """
     adapter, services = random.choice(wbt_fakes.ADAPTERS_WITH_SERVICES)
-    return SERVICE_RETRIEVED_BASE.format(
+    service_uuid = _ToJsStr(random.choice(services))
+
+    base = random.choice([SERVICE_RETRIEVED_BASE, SERVICES_RETRIEVED_BASE])
+    return base.format(
         fake_adapter_name=_ToJsStr(adapter),
-        service_uuid=_ToJsStr(random.choice(services)))
+        service_uuid=service_uuid,
+        optional_service_uuid=_GetOptional(service_uuid))
+
+def GetCharacteristicsRetrievedBase():
+  adapter, services = random.choice(wbt_fakes.ADAPTERS_WITH_CHARACTERISTICS)
+
+  service_uuid, characteristics = random.choice(services)
+  service_uuid = _ToJsStr(service_uuid)
+  characteristic_uuid = _ToJsStr(random.choice(characteristics))
+
+  optional_service_uuid = _GetOptional(service_uuid)
+  optional_characteristic_uuid = _GetOptional(characteristic_uuid)
+
+  services_base = random.choice([SERVICE_RETRIEVED_BASE,
+                                 SERVICES_RETRIEVED_BASE])
+  characteristics_base = services_base + random.choice(
+      [CHARACTERISTIC_RETRIEVED_BASE,
+       CHARACTERISTICS_RETRIEVED_BASE])
+
+  return characteristics_base.format(
+      fake_adapter_name=_ToJsStr(adapter),
+      service_uuid=service_uuid,
+      optional_service_uuid=optional_service_uuid,
+      characteristic_uuid=characteristic_uuid,
+      optional_characteristic_uuid=optional_characteristic_uuid)
+
+def GetGetPrimaryServicesCall():
+  call = random.choice([u'getPrimaryService({service_uuid})',
+                        u'getPrimaryServices({optional_service_uuid})'])
+
+  return call.format(
+      service_uuid=GetServiceUUID(),
+      optional_service_uuid=_GetOptional(GetServiceUUID()))
+
+
+def GetCatch():
+  return ".catch(e => console.log(e.name + \' \' + e.message))"
+
+def GetPickAService():
+  s = \
+  'var service; '\
+  'if (typeof services !== \'undefined\') '\
+  ' service = Array.isArray(services) ? services[{} % services.length] :'\
+  ' services'
+  return s.format(random.randint(0, 10))
+
+def GetPickACharacteristic():
+  s = \
+  'var characteristic; '\
+  'if (typeof characteristics !== \'undefined\') '\
+  ' characteristic = Array.isArray(characteristics)'\
+  ' ? characteristics[{} % characteristics.length]'\
+  ' : characteristics'
+  return s.format(random.randint(0, 10))
+
+
+def GetGetCharacteristicsCall():
+  call = random.choice([u'getCharacteristic({characteristic_uuid})',
+                        u'getCharacteristics({optional_characteristic_uuid})'])
+
+  return call.format(
+      characteristic_uuid=GetCharacteristicUUID(),
+      optional_characteristic_uuid=_GetOptional(GetCharacteristicUUID()))
+
+
+def GetWriteValue():
+  return 'new Uint8Array([1,2,3,4])';
+
+
+def GetReturnArgs():
+  return \
+'if (typeof characteristics !== \'undefined\') return characteristics; '\
+'if (typeof services !== \'undefined\') return services; '\
+'if (typeof gatt !== \'undefined\') return gatt; '\
+'if (typeof device !== \'undefined\') return device;'
+
+def GetReloadId():
+  return _ToJsStr(_GetRandomNumber())