Add a fuzzer test for the Clear-Site-Data header.

content/test/fuzzer/clear_site_data_fuzzer.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+#include <vector>
+
+#include "content/browser/browsing_data/clear_site_data_throttle.h"
+
+namespace content {
+
+class ClearSiteDataFuzzerTest {
+ public:
+  ClearSiteDataFuzzerTest() : throttle_(nullptr) {}
+
+  void TestHeader(const std::string& header) {
+    bool remove_cookies;
+    bool remove_storage;
+    bool remove_cache;
+
+    throttle_.ParseHeader(header, &remove_cookies, &remove_storage,
+                          &remove_cache, &messages_);
+
+    // Keep clearing the output messages vector so that it doesn't grow
+    // ad infinitum.
+    messages_.clear();

[aizatsky, 2016/09/12 19:54:50]

Maybe make it local?

[msramek, 2016/09/13 14:50:06]

Done. This was my attempt to optimize by sparing the construction and
destruction, but it's really negligible compared to ParseHeader.

+  }
+
+ private:
+  content::ClearSiteDataThrottle throttle_;
+  std::vector<content::ClearSiteDataThrottle::ConsoleMessage> messages_;
+};
+
+ClearSiteDataFuzzerTest* test = new ClearSiteDataFuzzerTest();
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  std::string header(reinterpret_cast<const char*>(data), size);
+  test->TestHeader(header);

[aizatsky, 2016/09/12 19:54:50]

I don't think a separate method is needed. I'd simply inline it here.

[msramek, 2016/09/13 14:50:06]

I just noticed that I can inline |header|, so I did that.

However, I'd like to keep the class unless you feel strongly. One reason for it
was to keep local state, which - as mentioned in the previous comment - is
actually not that valuable. However, I also found it better semantically that
ClearSiteDataThrottle is a friend with 'class ClearSiteDataFuzzerTest' rather
than 'extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)'.
It's clearer for the reader why there is that frienship (because it's a *Test),
and it doesn't automatically befriend all other fuzzers.

+  return 0;
+}
+
+}  // namespace content