Add fuzzer for (A)PNG decoder

third_party/WebKit/Source/platform/BUILD.gn

Index: third_party/WebKit/Source/platform/BUILD.gn
diff --git a/third_party/WebKit/Source/platform/BUILD.gn b/third_party/WebKit/Source/platform/BUILD.gn
index 9685a9ab9225cc9066ca57a0b34b88a4d2e218eb..559ae6f14f71c385ed99ac1426ebe2d850f28b52 100644
--- a/third_party/WebKit/Source/platform/BUILD.gn
+++ b/third_party/WebKit/Source/platform/BUILD.gn
@@ -2018,6 +2018,18 @@ fuzzer_test("web_icon_sizes_fuzzer") {
   dict = "//testing/libfuzzer/fuzzers/dicts/web_icon_sizes.dict"
 }
 
+fuzzer_test("png_fuzzer") {

[mmoroz, 2017/01/03 08:18:36]

Would you mind naming it a bit more explicitly? For example, `blink_png_fuzzer`,
or `png_image_decoder_fuzzer`? I'm asking, because we have many fuzz targets.
Giving short names to them will collide soon (For example, we have
`libpng_read_fuzzer` which also could be named `png_fuzzer`, but we are tending
to have specific names to avoid ambiguity).

[scroggo_chromium, 2017/01/03 18:24:14]

Done.

+  sources = [
+    "PngFuzzer.cpp",
+  ]
+  deps = [
+    ":blink_fuzzer_test_support",
+    ":platform",
+    "//third_party/libpng",
+  ]
+  seed_corpus = "//third_party/WebKit/LayoutTests/images/resources/pngfuzz"

[mmoroz, 2017/01/03 08:18:36]

That's awesome that you're adding a seed corpus. I suggest you also add a
dictionary. You can use existing png.dict used by some other fuzzers
(https://cs.chromium.org/chromium/src/testing/libfuzzer/fuzzers/BUILD.gn?q=png...).

[scroggo_chromium, 2017/01/03 18:24:14]

Done. Should I also add "//cc/test/data" to the seed_corpus? (Is there a way to
have multiple seed corpora?)

+}
+
 # Fuzzer for blink::JSONParser.
 fuzzer_test("blink_json_parser_fuzzer") {
   sources = [