Add fuzzer infra to blink and fuzz CSS parser

third_party/WebKit/Source/core/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/chrome_build.gni")
 import("//build/config/chromecast_build.gni")
 import("//build/config/ui.gni")
 import("//build/split_static_library.gni")
 import("//testing/libfuzzer/fuzzer_test.gni")
 import("//third_party/WebKit/Source/bindings/bindings.gni")
@@ skipping 1108 matching lines @@
 # Fuzzer for blink::TextResourceDecoder.
 fuzzer_test("text_resource_decoder_fuzzer") {
   sources = [
     "html/parser/TextResourceDecoderFuzzer.cpp",
   ]
   deps = [
     ":core",
     "../platform:test_support",
   ]
 }
+
+# Fuzzer for blink::StyleSheetContents
+fuzzer_test("stylesheet_contents_fuzzer") {
+  sources = [
+    "css/StyleSheetContentsFuzzer.cpp",
+  ]
+  deps = [
+    ":core",
+    "../platform:blink_fuzzer_test_support",
+  ]
+  seed_corpus = "//third_party/WebKit/LayoutTests/fast/css/resources/*.css"

[mmoroz, 2016/08/25 08:00:47]

I'm afraid this wildcard won't work because we expect that value to be a path to
corpus directory. It might be a good thing to have an opportunity to filter
files like "*.css", but right now we don't have it. It would be fine to pass the
whole directory (there are not too many files, and html/js ones also have some
CSS-strings, so it won't harm).

[Charlie Harrison, 2016/08/25 13:01:14]

My main concern was files that were too big (e.g. binaries). Will they override
the max_len option or should it be fine?

[mmoroz, 2016/08/25 13:15:15]

It should be fine. LibFuzzer will use only first |max_len| bytes of those files.

+  libfuzzer_options = [ "max_len=2048" ]
+}