mirror of
https://github.com/bellard/quickjs.git
synced 2024-12-12 09:44:33 +08:00
01454caf78
* Move fuzz target sources from the oss-fuzz repository here * Add support to build libFuzzer targets * Simplify the fuzz_eval and fuzz_compile targets The use of JS_NewContext instead of JS_NewContextRaw spares to call JS_AddIntrinsic<XYZ> functions from the fuzz target, since the public JS_NewContext API does exactly the same. * Simplify the fuzz_regexp target fuzz_regexp doesn't need to be dependant on libquickjs since the runtime and the context - that were provided by libquickjs - were only created to call two simple functions implemented in libquickjs which could be mimicked by the fuzzer. The removal of runtime and context objects implicated further simplifications, like the omission of their one-time creation. Finally, writing the result of the regexp operations into a file is also superfluous, since it's not used by anybody. * Recreate and destroy JS runtime and context in fuzz_eval and fuzz_compile targets Before this patch, the test executions were not independent, since all the executed tests used the same JavaScript runtime and context, causing irreproducible failure reports. * Enable bignumber support in eval and compile targets Big numbers are used by the input corpus, but the targets were not able to interpret them since they were not compiled into them. This change improved the inital coverage of the fuzz_eval target with 21% and the coverage of the fuzz_compile target with 25% when using the official corpus. * Ensure std and os modules are available in the fuzz_eval and fuzz_compile targets * Add fuzzer dictionary with builtin and variable names. Furthermore, added a JS script that collects all the builtin names from the executing engine. * Move common fuzzer code into one place * Enable to define the LIB_FUZZING_ENGINE variable to ease the oss-fuzz integration * Add README to fuzzers
25 lines
1020 B
JavaScript
25 lines
1020 B
JavaScript
// Function to recursively iterate through built-in names.
|
|
function collectBuiltinNames(obj, visited = new Set(), result = new Set()) {
|
|
// Check if the object has already been visited to avoid infinite recursion.
|
|
if (visited.has(obj))
|
|
return;
|
|
|
|
// Add the current object to the set of visited objects
|
|
visited.add(obj);
|
|
// Get the property names of the current object
|
|
const properties = Object.getOwnPropertyNames(obj);
|
|
// Iterate through each property
|
|
for (var i=0; i < properties.length; i++) {
|
|
var property = properties[i];
|
|
if (property != "collectBuiltinNames" && typeof property != "number")
|
|
result.add(property);
|
|
// Check if the property is an object and if so, recursively iterate through its properties.
|
|
if (typeof obj[property] === 'object' && obj[property] !== null)
|
|
collectBuiltinNames(obj[property], visited, result);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
// Start the recursive iteration with the global object.
|
|
console.log(Array.from(collectBuiltinNames(this)).join('\n'));
|