[wasm] Call the wasm interpreter from the wasm-code-fuzzer.

test/fuzzer/wasm-code.cc

Index: test/fuzzer/wasm-code.cc
diff --git a/test/fuzzer/wasm-code.cc b/test/fuzzer/wasm-code.cc
index ae1ec4a0deb7e92cf943d793ea95573a161dbae6..3bdf1457f0457ceeedee1d2cc64204f961a946d9 100644
--- a/test/fuzzer/wasm-code.cc
+++ b/test/fuzzer/wasm-code.cc
@@ -8,9 +8,11 @@
 #include "include/v8.h"
 #include "src/isolate.h"
 #include "src/wasm/encoder.h"
+#include "src/wasm/wasm-interpreter.h"
 #include "src/wasm/wasm-js.h"
 #include "src/wasm/wasm-module.h"
 #include "test/cctest/wasm/test-signatures.h"
+#include "test/cctest/wasm/wasm-module-runner.h"
 #include "test/fuzzer/fuzzer-support.h"
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
@@ -48,7 +50,51 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
 
   v8::internal::WasmJs::InstallWasmFunctionMap(i_isolate,
                                                i_isolate->native_context());
-  v8::internal::wasm::testing::CompileAndRunWasmModule(
-      i_isolate, buffer.begin(), buffer.end(), false);
+
+  v8::internal::HandleScope scope(i_isolate);
+
+  v8::internal::wasm::ErrorThrower interpreter_thrower(i_isolate,

[titzer, 2016/09/12 11:46:21]

Nit: use a "using v8::internal::wasm" to shorten this code a bit?

+                                                       "Interpreter");
+  std::unique_ptr<const v8::internal::wasm::WasmModule> module(
+      v8::internal::wasm::testing::DecodeWasmModuleForTesting(
+          i_isolate, &zone, interpreter_thrower, buffer.begin(), buffer.end(),
+          v8::internal::wasm::kWasmOrigin));
+
+  if (module == nullptr) {
+    return 0;
+  }
+  int32_t result_interpreted;
+  {
+    v8::internal::wasm::WasmVal args[] = {v8::internal::wasm::WasmVal(1),
+                                          v8::internal::wasm::WasmVal(2),
+                                          v8::internal::wasm::WasmVal(3)};
+    result_interpreted = v8::internal::wasm::testing::InterpretWasmModule(
+        i_isolate, interpreter_thrower, module.get(), 0, args);
+  }
+
+  v8::internal::wasm::ErrorThrower compiler_thrower(i_isolate, "Compiler");
+  v8::internal::Handle<v8::internal::JSObject> instance =
+      v8::internal::wasm::testing::InstantiateModuleForTesting(
+          i_isolate, compiler_thrower, module.get());
+
+  if (!interpreter_thrower.error()) {
+    CHECK(!instance.is_null());
+  } else {
+    return 0;
+  }
+  int32_t result_compiled;
+  {
+    v8::internal::Handle<v8::internal::Object> arguments[] = {
+        v8::internal::handle(v8::internal::Smi::FromInt(1), i_isolate)};
+    result_compiled = v8::internal::wasm::testing::CallWasmFunctionForTesting(
+        i_isolate, instance, compiler_thrower, "main", arraysize(arguments),
+        arguments, false);
+  }
+  if (result_interpreted == 0xdeadbeef) {
+    CHECK(i_isolate->has_pending_exception());
+    i_isolate->clear_pending_exception();
+  } else {
+    CHECK_EQ(result_interpreted, result_compiled);
+  }
   return 0;
 }