Add fuzzer infra to blink and fuzz CSS parser

third_party/WebKit/Source/core/BUILD.gn

Index: third_party/WebKit/Source/core/BUILD.gn
diff --git a/third_party/WebKit/Source/core/BUILD.gn b/third_party/WebKit/Source/core/BUILD.gn
index c1dce612e52b0f1446e4ef3bf2d7158f0c3390c3..1179e9276e2f1a9e7d3376ccac190c84afb17dc5 100644
--- a/third_party/WebKit/Source/core/BUILD.gn
+++ b/third_party/WebKit/Source/core/BUILD.gn
@@ -1126,3 +1126,16 @@ fuzzer_test("text_resource_decoder_fuzzer") {
     "../platform:test_support",
   ]
 }
+
+# Fuzzer for blink::StyleSheetContents
+fuzzer_test("stylesheet_contents_fuzzer") {
+  sources = [
+    "css/StyleSheetContentsFuzzer.cpp",
+  ]
+  deps = [
+    ":core",
+    "../platform:blink_fuzzer_test_support",
+  ]
+  seed_corpus = "//third_party/WebKit/LayoutTests/fast/css/resources/*.css"

[mmoroz, 2016/08/25 08:00:47]

I'm afraid this wildcard won't work because we expect that value to be a path to
corpus directory. It might be a good thing to have an opportunity to filter
files like "*.css", but right now we don't have it. It would be fine to pass the
whole directory (there are not too many files, and html/js ones also have some
CSS-strings, so it won't harm).

[Charlie Harrison, 2016/08/25 13:01:14]

My main concern was files that were too big (e.g. binaries). Will they override
the max_len option or should it be fine?

[mmoroz, 2016/08/25 13:15:15]

It should be fine. LibFuzzer will use only first |max_len| bytes of those files.

+  libfuzzer_options = [ "max_len=2048" ]
+}