Index: test/fuzzer/wasm-code.cc |
diff --git a/test/fuzzer/wasm-asmjs.cc b/test/fuzzer/wasm-code.cc |
similarity index 61% |
copy from test/fuzzer/wasm-asmjs.cc |
copy to test/fuzzer/wasm-code.cc |
index cb8b86bad4f037b425e7f74d1f0505dcd7ce66e8..ae1ec4a0deb7e92cf943d793ea95573a161dbae6 100644 |
--- a/test/fuzzer/wasm-asmjs.cc |
+++ b/test/fuzzer/wasm-code.cc |
@@ -2,18 +2,15 @@ |
// Use of this source code is governed by a BSD-style license that can be |
// found in the LICENSE file. |
-#include <limits.h> |
#include <stddef.h> |
#include <stdint.h> |
#include "include/v8.h" |
-#include "src/factory.h" |
-#include "src/isolate-inl.h" |
#include "src/isolate.h" |
-#include "src/objects-inl.h" |
-#include "src/objects.h" |
+#include "src/wasm/encoder.h" |
#include "src/wasm/wasm-js.h" |
#include "src/wasm/wasm-module.h" |
+#include "test/cctest/wasm/test-signatures.h" |
#include "test/fuzzer/fuzzer-support.h" |
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
@@ -31,9 +28,27 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
v8::HandleScope handle_scope(isolate); |
v8::Context::Scope context_scope(support->GetContext()); |
v8::TryCatch try_catch(isolate); |
+ |
+ v8::base::AccountingAllocator allocator; |
+ v8::internal::Zone zone(&allocator); |
+ |
+ v8::internal::wasm::TestSignatures sigs; |
+ |
+ v8::internal::wasm::WasmModuleBuilder builder(&zone); |
+ |
+ uint16_t f1_index = builder.AddFunction(); |
+ v8::internal::wasm::WasmFunctionBuilder* f = builder.FunctionAt(f1_index); |
+ f->SetSignature(sigs.i_iii()); |
+ f->EmitCode(data, static_cast<uint32_t>(size)); |
+ f->SetExported(); |
+ f->SetName("main", 4); |
+ |
+ v8::internal::wasm::ZoneBuffer buffer(&zone); |
+ builder.WriteTo(buffer); |
+ |
v8::internal::WasmJs::InstallWasmFunctionMap(i_isolate, |
i_isolate->native_context()); |
- v8::internal::wasm::testing::CompileAndRunWasmModule(i_isolate, data, |
- data + size, true); |
+ v8::internal::wasm::testing::CompileAndRunWasmModule( |
+ i_isolate, buffer.begin(), buffer.end(), false); |
return 0; |
} |