Commit Graph

10 Commits

Author SHA1 Message Date
Mike Hommey
d7c9f0f24f Bug 1330533 - Remove XRE_LibFuzzerGetFuncs. r=decoder
Now that XRE_LibFuzzerGetFuncs is not used from outside libxul, it can
be inlined in LibFuzzerRunner::Run, simplifying things a little more.
2017-01-12 16:02:50 +09:00
Mike Hommey
e521d08008 Bug 1330533 - Use FuzzerDriver directly instead of wrapping it in a libfuzzer_main function. r=decoder
Going further from the previous changes, all libfuzzer_main really does
is call the init function, and then proceed to call the fuzzer driver
with the testing function.

So instead of calling that function for it to do all that, the
LibFuzzerRunner can just call the init function itself, and then
call the fuzzer driver with the testing function.
2017-01-12 14:44:18 +09:00
Mike Hommey
688aecac16 Bug 1330533 - Pass LibFuzzerInitFunc and LibFuzzerTestingFunc to libfuzzer_main. r=decoder
The LibFuzzerRunner code lives in libxul. It's unnecessary complications
to have it call back a function in the firefox executable just so that
it calls another function that is in libxul. Passing the init and
testing functions to the libfuzzer_main function allows to just bypass
that roundtrip, simplifying the setup.
2017-01-12 14:50:14 +09:00
Mike Hommey
e55bae1e11 Bug 1330533 - Remove argc/argv arguments to XRE_LibFuzzerSetMain. r=decoder
The function given to XRE_LibFuzzerSetMain is called from somewhere that
does have access to argc/argv already, so we can avoid passing them
to XRE_LibFuzzerSetMain.

This actually might fix subtle issues with argc/argv not really matching
reality when calling the LibFuzzerMain function in the current code:
some arguments are handled before the call, and both argc and argv are
modified from within XRE_main, but the values stored for the
LibFuzzerMain call still are the original ones.

Argv being a pointer, and it not being reallocated, the value stored for
the LibFuzzerMain call points to the changed one, but argc, being an
integer, is not modified accordingly.

In fact, it's actually worse, because while the Gecko code doesn't
reallocate argv, gtk_main might. So if some GTK flag is passed on the
command line, there's also a possibility that the LibFuzzerMain function
will do a use-after-free.

So all in all, it's just better to use the set of modified argc/argv
from XRE_main instead of storing them from main().
2017-01-12 11:59:37 +09:00
Christian Holler (:decoder)
efaf4d5fa9 Bug 1289194 - Make LibFuzzerRunner use its own private ScopedXPCOM copy. r=ted
MozReview-Commit-ID: Kul2N4GA7O7
2016-08-24 22:35:03 +02:00
Christian Holler (:decoder)
0ee2e05a6f Bug 1289194 - Experimental LibFuzzer integration. r=glandium
MozReview-Commit-ID: 9njDcbltyow
2016-09-01 15:07:01 +02:00
Sebastian Hengst
cda67b5d84 Backed out changeset 95e68b473e91 (bug 1289194) for failure to process moz.build file. r=backout a=backout
MozReview-Commit-ID: GhfzNoiE808
2016-09-07 18:45:40 +02:00
Sebastian Hengst
7742c85047 Backed out changeset 13a770064f3e (bug 1289194)
MozReview-Commit-ID: ILJkzxfSLdU
2016-09-07 18:44:36 +02:00
Christian Holler (:decoder)
1427b04f68 Bug 1289194 - Make LibFuzzerRunner use its own private ScopedXPCOM copy. r=ted 2016-08-24 22:35:03 +02:00
Christian Holler (:decoder)
09deaa21d9 Bug 1289194 - Experimental LibFuzzer integration. r=glandium 2016-09-01 15:07:01 +02:00