Add fuzzer for HTMLPreloadScanner

third_party/WebKit/Source/core/html/parser/HTMLPreloadScannerFuzzer.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "core/MediaTypeNames.h"
+#include "core/css/MediaValuesCached.h"
+#include "core/frame/Settings.h"
+#include "core/html/HTMLDocument.h"
+#include "core/html/parser/HTMLDocumentParser.h"
 #include "core/html/parser/TextResourceDecoder.h"
-
+#include "core/loader/TextResourceDecoderBuilder.h"
+#include "core/testing/DummyPageHolder.h"
 #include "platform/testing/FuzzedDataProvider.h"
 #include "platform/testing/TestingPlatformSupport.h"
+#include "wtf/PtrUtil.h"
 #include "wtf/text/WTFString.h"
 #include <algorithm>
 
 namespace blink {
 
 class TextResourceDecoderForFuzzing : public TextResourceDecoder {
 public:
     // Note: mimeTypes can be quite long and still valid for XML. See the
     // comment in DOMImplementation.cpp which says:
     // Per RFCs 3023 and 2045, an XML MIME type is of the form:
     // ^[0-9a-zA-Z_\\-+~!$\\^{}|.%'`#&*]+/[0-9a-zA-Z_\\-+~!$\\^{}|.%'`#&*]+\+xml$
     //
     // Similarly, charsets can be long too (see the various encodings in
     // wtf/text). For instance: "unicode-1-1-utf-8". To ensure good coverage,
     // set a generous max limit for these sizes (32 bytes should be good).
     TextResourceDecoderForFuzzing(FuzzedDataProvider& fuzzedData)
         : TextResourceDecoder(String::fromUTF8(fuzzedData.ConsumeBytesInRange(0, 32)), String::fromUTF8(fuzzedData.ConsumeBytesInRange(0, 32)), FuzzedOption(fuzzedData))
     {
     }
 
 private:
     static TextResourceDecoder::EncodingDetectionOption FuzzedOption(FuzzedDataProvider& fuzzedData)
     {
         // Don't use AlwaysUseUTF8ForText which requires knowing the mimeType
         // ahead of time.
         return fuzzedData.ConsumeBool() ? UseAllAutoDetection : UseContentAndBOMBasedDetection;
     }
 };
 
+struct CachedDocumentParametersForFuzzing : public CachedDocumentParameters {
+    CachedDocumentParametersForFuzzing(FuzzedDataProvider& fuzzedData)
+    {

[kouhei (in TOK), 2016/08/22 05:48:28]

maybe simply
unique_ptr<CachedDocumentParameters> createCachedDocumentParametersForFuzzing()
{
  ...
}?

Also, please initialize the other fields.

+        doHtmlPreloadScanning = fuzzedData.ConsumeBool();
+        doDocumentWritePreloadScanning = fuzzedData.ConsumeBool();
+    }
+};
+
+class MockResourcePreloader : public ResourcePreloader {
+    void preload(std::unique_ptr<PreloadRequest>, const NetworkHintsInterface&) override
+    {
+    }
+};
+
 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 {
     FuzzedDataProvider fuzzedData(data, size);
+
+    HTMLParserOptions options;
+    options.scriptEnabled = fuzzedData.ConsumeBool();
+    options.pluginsEnabled = fuzzedData.ConsumeBool();
+
+    CachedDocumentParametersForFuzzing* documentParameters = new CachedDocumentParametersForFuzzing(fuzzedData);
+
+    KURL documentURL(ParsedURLString, "http://whatever.test/");
+
+    // Copied from HTMLPreloadScannerTest. May be worthwhile to fuzz.
+    MediaValuesCached::MediaValuesCachedData mediaData;
+    mediaData.viewportWidth = 500;
+    mediaData.viewportHeight = 600;
+    mediaData.deviceWidth = 700;
+    mediaData.deviceHeight = 800;
+    mediaData.devicePixelRatio = 2.0;
+    mediaData.colorBitsPerComponent = 24;
+    mediaData.monochromeBitsPerComponent = 0;
+    mediaData.primaryPointerType = PointerTypeFine;
+    mediaData.defaultFontSize = 16;
+    mediaData.threeDEnabled = true;
+    mediaData.mediaType = MediaTypeNames::screen;
+    mediaData.strictMode = true;
+    mediaData.displayMode = WebDisplayModeBrowser;
+
+    MockResourcePreloader preloader;
+
+    std::unique_ptr<HTMLPreloadScanner> scanner = HTMLPreloadScanner::create(options, documentURL, wrapUnique(documentParameters), mediaData);
+
     TextResourceDecoderForFuzzing decoder(fuzzedData);
     CString bytes = fuzzedData.ConsumeRemainingBytes();
-    decoder.decode(bytes.data(), bytes.length());
-    decoder.flush();
+    String decodedBytes = decoder.decode(bytes.data(), bytes.length());
+    scanner->appendToEnd(decodedBytes);
+    scanner->scanAndPreload(&preloader, KURL(), nullptr);
     return 0;
 }
 
 } // namespace blink
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 {
     return blink::LLVMFuzzerTestOneInput(data, size);
 }
 
 extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv)
 {
     // Intentional leak - no need to do cleanup as explained in
     // "Initialization/Cleanup" section of testing/libfuzzer/efficient_fuzzer.md
     DEFINE_STATIC_LOCAL(blink::ScopedUnittestsEnvironmentSetup, testSetup, (*argc, *argv));
     ALLOW_UNUSED_LOCAL(testSetup);
 
     return 0;
 }