?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
exclude PluginsFieldTrialTest.NoPrefLeftBehind from valgrind bot
[chromium-blink-merge.git] / tools / ipc_fuzzer / fuzzer / fuzzer.cc
blobd2862d415b18a08c30f5f7800ea0fb2ce952c221
1 // Copyright 2015 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include <iostream>
6 #include <set>
7 #include <string>
8 #include <utility>
9 #include <vector>
10
11 #include "base/strings/string_util.h"
12 #include "ipc/ipc_message.h"
13 #include "ipc/ipc_message_utils.h"
14 #include "ipc/ipc_switches.h"
15 #include "ipc/ipc_sync_channel.h"
16 #include "ipc/ipc_sync_message.h"
17 #include "tools/ipc_fuzzer/fuzzer/fuzzer.h"
18 #include "tools/ipc_fuzzer/fuzzer/rand_util.h"
19 #include "tools/ipc_fuzzer/message_lib/message_cracker.h"
20 #include "tools/ipc_fuzzer/message_lib/message_file.h"
21
22 #if defined(OS_POSIX)
23 #include <unistd.h>
24 #endif
25
26 // First include of all message files to provide basic types.
27 #include "tools/ipc_fuzzer/message_lib/all_messages.h"
28 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h"
29
30 #if defined(COMPILER_GCC)
31 #define PRETTY_FUNCTION __PRETTY_FUNCTION__
32 #elif defined(COMPILER_MSVC)
33 #define PRETTY_FUNCTION __FUNCSIG__
34 #else
35 #define PRETTY_FUNCTION __FUNCTION__
36 #endif
37
38 namespace IPC {
39 class Message;
40 } // namespace IPC
41
42 namespace {
43 // For breaking deep recursion.
44 int g_depth = 0;
45 } // namespace
46
47 namespace ipc_fuzzer {
48
49 FuzzerFunctionVector g_function_vector;
50
51 bool Fuzzer::ShouldGenerate() {
52 return false;
53 }
54
55 // Partially-specialized class that knows how to handle a given type.
56 template <class P>
57 struct FuzzTraits {
58 static bool Fuzz(P* p, Fuzzer *fuzzer) {
59 // This is the catch-all for types we don't have enough information
60 // to generate.
61 std::cerr << "Can't handle " << PRETTY_FUNCTION << "\n";
62 return false;
63 }
64 };
65
66 // Template function to invoke partially-specialized class method.
67 template <class P>
68 static bool FuzzParam(P* p, Fuzzer* fuzzer) {
69 return FuzzTraits<P>::Fuzz(p, fuzzer);
70 }
71
72 template <class P>
73 static bool FuzzParamArray(P* p, size_t length, Fuzzer* fuzzer) {
74 for (size_t i = 0; i < length; i++, p++) {
75 if (!FuzzTraits<P>::Fuzz(p, fuzzer))
76 return false;
77 }
78 return true;
79 }
80
81 // Specializations to generate primitive types.
82 template <>
83 struct FuzzTraits<bool> {
84 static bool Fuzz(bool* p, Fuzzer* fuzzer) {
85 fuzzer->FuzzBool(p);
86 return true;
87 }
88 };
89
90 template <>
91 struct FuzzTraits<int> {
92 static bool Fuzz(int* p, Fuzzer* fuzzer) {
93 fuzzer->FuzzInt(p);
94 return true;
95 }
96 };
97
98 template <>
99 struct FuzzTraits<unsigned int> {
100 static bool Fuzz(unsigned int* p, Fuzzer* fuzzer) {
101 fuzzer->FuzzInt(reinterpret_cast<int*>(p));
102 return true;
103 }
104 };
105
106 template <>
107 struct FuzzTraits<long> {
108 static bool Fuzz(long* p, Fuzzer* fuzzer) {
109 fuzzer->FuzzLong(p);
110 return true;
111 }
112 };
113
114 template <>
115 struct FuzzTraits<unsigned long> {
116 static bool Fuzz(unsigned long* p, Fuzzer* fuzzer) {
117 fuzzer->FuzzLong(reinterpret_cast<long*>(p));
118 return true;
119 }
120 };
121
122 template <>
123 struct FuzzTraits<long long> {
124 static bool Fuzz(long long* p, Fuzzer* fuzzer) {
125 fuzzer->FuzzInt64(reinterpret_cast<int64*>(p));
126 return true;
127 }
128 };
129
130 template <>
131 struct FuzzTraits<unsigned long long> {
132 static bool Fuzz(unsigned long long* p, Fuzzer* fuzzer) {
133 fuzzer->FuzzInt64(reinterpret_cast<int64*>(p));
134 return true;
135 }
136 };
137
138 template <>
139 struct FuzzTraits<short> {
140 static bool Fuzz(short* p, Fuzzer* fuzzer) {
141 fuzzer->FuzzUInt16(reinterpret_cast<uint16*>(p));
142 return true;
143 }
144 };
145
146 template <>
147 struct FuzzTraits<unsigned short> {
148 static bool Fuzz(unsigned short* p, Fuzzer* fuzzer) {
149 fuzzer->FuzzUInt16(reinterpret_cast<uint16*>(p));
150 return true;
151 }
152 };
153
154 template <>
155 struct FuzzTraits<char> {
156 static bool Fuzz(char* p, Fuzzer* fuzzer) {
157 fuzzer->FuzzUChar(reinterpret_cast<unsigned char*>(p));
158 return true;
159 }
160 };
161
162 template <>
163 struct FuzzTraits<unsigned char> {
164 static bool Fuzz(unsigned char* p, Fuzzer* fuzzer) {
165 fuzzer->FuzzUChar(p);
166 return true;
167 }
168 };
169
170 template <>
171 struct FuzzTraits<wchar_t> {
172 static bool Fuzz(wchar_t* p, Fuzzer* fuzzer) {
173 fuzzer->FuzzWChar(p);
174 return true;
175 }
176 };
177
178 template <>
179 struct FuzzTraits<float> {
180 static bool Fuzz(float* p, Fuzzer* fuzzer) {
181 fuzzer->FuzzFloat(p);
182 return true;
183 }
184 };
185
186 template <>
187 struct FuzzTraits<double> {
188 static bool Fuzz(double* p, Fuzzer* fuzzer) {
189 fuzzer->FuzzDouble(p);
190 return true;
191 }
192 };
193
194 template <>
195 struct FuzzTraits<std::string> {
196 static bool Fuzz(std::string* p, Fuzzer* fuzzer) {
197 fuzzer->FuzzString(p);
198 return true;
199 }
200 };
201
202 template <>
203 struct FuzzTraits<base::string16> {
204 static bool Fuzz(base::string16* p, Fuzzer* fuzzer) {
205 fuzzer->FuzzString16(p);
206 return true;
207 }
208 };
209
210 // Specializations for tuples.
211 template <>
212 struct FuzzTraits<base::Tuple<>> {
213 static bool Fuzz(base::Tuple<>* p, Fuzzer* fuzzer) {
214 return true;
215 }
216 };
217
218 template <class A>
219 struct FuzzTraits<base::Tuple<A>> {
220 static bool Fuzz(base::Tuple<A>* p, Fuzzer* fuzzer) {
221 return FuzzParam(&base::get<0>(*p), fuzzer);
222 }
223 };
224
225 template <class A, class B>
226 struct FuzzTraits<base::Tuple<A, B>> {
227 static bool Fuzz(base::Tuple<A, B>* p, Fuzzer* fuzzer) {
228 return
229 FuzzParam(&base::get<0>(*p), fuzzer) &&
230 FuzzParam(&base::get<1>(*p), fuzzer);
231 }
232 };
233
234 template <class A, class B, class C>
235 struct FuzzTraits<base::Tuple<A, B, C>> {
236 static bool Fuzz(base::Tuple<A, B, C>* p, Fuzzer* fuzzer) {
237 return
238 FuzzParam(&base::get<0>(*p), fuzzer) &&
239 FuzzParam(&base::get<1>(*p), fuzzer) &&
240 FuzzParam(&base::get<2>(*p), fuzzer);
241 }
242 };
243
244 template <class A, class B, class C, class D>
245 struct FuzzTraits<base::Tuple<A, B, C, D>> {
246 static bool Fuzz(base::Tuple<A, B, C, D>* p, Fuzzer* fuzzer) {
247 return
248 FuzzParam(&base::get<0>(*p), fuzzer) &&
249 FuzzParam(&base::get<1>(*p), fuzzer) &&
250 FuzzParam(&base::get<2>(*p), fuzzer) &&
251 FuzzParam(&base::get<3>(*p), fuzzer);
252 }
253 };
254
255 template <class A, class B, class C, class D, class E>
256 struct FuzzTraits<base::Tuple<A, B, C, D, E>> {
257 static bool Fuzz(base::Tuple<A, B, C, D, E>* p, Fuzzer* fuzzer) {
258 return
259 FuzzParam(&base::get<0>(*p), fuzzer) &&
260 FuzzParam(&base::get<1>(*p), fuzzer) &&
261 FuzzParam(&base::get<2>(*p), fuzzer) &&
262 FuzzParam(&base::get<3>(*p), fuzzer) &&
263 FuzzParam(&base::get<4>(*p), fuzzer);
264 }
265 };
266
267 // Specializations for containers.
268 template <class A>
269 struct FuzzTraits<std::vector<A> > {
270 static bool Fuzz(std::vector<A>* p, Fuzzer* fuzzer) {
271 ++g_depth;
272 size_t count = p->size();
273 if (fuzzer->ShouldGenerate()) {
274 count = g_depth > 3 ? 0 : RandElementCount();
275 p->resize(count);
276 }
277 for (size_t i = 0; i < count; ++i) {
278 if (!FuzzParam(&p->at(i), fuzzer)) {
279 --g_depth;
280 return false;
281 }
282 }
283 --g_depth;
284 return true;
285 }
286 };
287
288 template <class A>
289 struct FuzzTraits<std::set<A> > {
290 static bool Fuzz(std::set<A>* p, Fuzzer* fuzzer) {
291 if (!fuzzer->ShouldGenerate()) {
292 std::set<A> result;
293 typename std::set<A>::iterator it;
294 for (it = p->begin(); it != p->end(); ++it) {
295 A item = *it;
296 if (!FuzzParam(&item, fuzzer))
297 return false;
298 result.insert(item);
299 }
300 *p = result;
301 return true;
302 }
303
304 static int g_depth = 0;
305 size_t count = ++g_depth > 3 ? 0 : RandElementCount();
306 A a;
307 for (size_t i = 0; i < count; ++i) {
308 if (!FuzzParam(&a, fuzzer)) {
309 --g_depth;
310 return false;
311 }
312 p->insert(a);
313 }
314 --g_depth;
315 return true;
316 }
317 };
318
319 template <class A, class B>
320 struct FuzzTraits<std::map<A, B> > {
321 static bool Fuzz(std::map<A, B>* p, Fuzzer* fuzzer) {
322 if (!fuzzer->ShouldGenerate()) {
323 typename std::map<A, B>::iterator it;
324 for (it = p->begin(); it != p->end(); ++it) {
325 if (!FuzzParam(&it->second, fuzzer))
326 return false;
327 }
328 return true;
329 }
330
331 static int g_depth = 0;
332 size_t count = ++g_depth > 3 ? 0 : RandElementCount();
333 std::pair<A, B> place_holder;
334 for (size_t i = 0; i < count; ++i) {
335 if (!FuzzParam(&place_holder, fuzzer)) {
336 --g_depth;
337 return false;
338 }
339 p->insert(place_holder);
340 }
341 --g_depth;
342 return true;
343 }
344 };
345
346 template <class A, class B, class C, class D>
347 struct FuzzTraits<std::map<A, B, C, D>> {
348 static bool Fuzz(std::map<A, B, C, D>* p, Fuzzer* fuzzer) {
349 if (!fuzzer->ShouldGenerate()) {
350 typename std::map<A, B, C, D>::iterator it;
351 for (it = p->begin(); it != p->end(); ++it) {
352 if (!FuzzParam(&it->second, fuzzer))
353 return false;
354 }
355 return true;
356 }
357
358 static int g_depth = 0;
359 size_t count = ++g_depth > 3 ? 0 : RandElementCount();
360 std::pair<A, B> place_holder;
361 for (size_t i = 0; i < count; ++i) {
362 if (!FuzzParam(&place_holder, fuzzer)) {
363 --g_depth;
364 return false;
365 }
366 p->insert(place_holder);
367 }
368 --g_depth;
369 return true;
370 }
371 };
372
373 template <class A, class B>
374 struct FuzzTraits<std::pair<A, B> > {
375 static bool Fuzz(std::pair<A, B>* p, Fuzzer* fuzzer) {
376 return
377 FuzzParam(&p->first, fuzzer) &&
378 FuzzParam(&p->second, fuzzer);
379 }
380 };
381
382 // Specializations for hand-coded types.
383
384 template <>
385 struct FuzzTraits<base::FilePath> {
386 static bool Fuzz(base::FilePath* p, Fuzzer* fuzzer) {
387 if (!fuzzer->ShouldGenerate()) {
388 base::FilePath::StringType path = p->value();
389 if(!FuzzParam(&path, fuzzer))
390 return false;
391 *p = base::FilePath(path);
392 return true;
393 }
394
395 const char path_chars[] = "ACz0/.~:";
396 size_t count = RandInRange(60);
397 base::FilePath::StringType random_path;
398 for (size_t i = 0; i < count; ++i)
399 random_path += path_chars[RandInRange(sizeof(path_chars) - 1)];
400 *p = base::FilePath(random_path);
401 return true;
402 }
403 };
404
405 template <>
406 struct FuzzTraits<base::File::Error> {
407 static bool Fuzz(base::File::Error* p, Fuzzer* fuzzer) {
408 int value = static_cast<int>(*p);
409 if (!FuzzParam(&value, fuzzer))
410 return false;
411 *p = static_cast<base::File::Error>(value);
412 return true;
413 }
414 };
415
416 template <>
417 struct FuzzTraits<base::File::Info> {
418 static bool Fuzz(base::File::Info* p, Fuzzer* fuzzer) {
419 double last_modified = p->last_modified.ToDoubleT();
420 double last_accessed = p->last_accessed.ToDoubleT();
421 double creation_time = p->creation_time.ToDoubleT();
422 if (!FuzzParam(&p->size, fuzzer))
423 return false;
424 if (!FuzzParam(&p->is_directory, fuzzer))
425 return false;
426 if (!FuzzParam(&last_modified, fuzzer))
427 return false;
428 if (!FuzzParam(&last_accessed, fuzzer))
429 return false;
430 if (!FuzzParam(&creation_time, fuzzer))
431 return false;
432 p->last_modified = base::Time::FromDoubleT(last_modified);
433 p->last_accessed = base::Time::FromDoubleT(last_accessed);
434 p->creation_time = base::Time::FromDoubleT(creation_time);
435 return true;
436 }
437 };
438
439 template <>
440 struct FuzzTraits<base::NullableString16> {
441 static bool Fuzz(base::NullableString16* p, Fuzzer* fuzzer) {
442 base::string16 string = p->string();
443 bool is_null = p->is_null();
444 if (!FuzzParam(&string, fuzzer))
445 return false;
446 if (!FuzzParam(&is_null, fuzzer))
447 return false;
448 *p = base::NullableString16(string, is_null);
449 return true;
450 }
451 };
452
453 template <>
454 struct FuzzTraits<base::Time> {
455 static bool Fuzz(base::Time* p, Fuzzer* fuzzer) {
456 int64 internal_value = p->ToInternalValue();
457 if (!FuzzParam(&internal_value, fuzzer))
458 return false;
459 *p = base::Time::FromInternalValue(internal_value);
460 return true;
461 }
462 };
463
464 template <>
465 struct FuzzTraits<base::TimeDelta> {
466 static bool Fuzz(base::TimeDelta* p, Fuzzer* fuzzer) {
467 int64 internal_value = p->ToInternalValue();
468 if (!FuzzParam(&internal_value, fuzzer))
469 return false;
470 *p = base::TimeDelta::FromInternalValue(internal_value);
471 return true;
472 }
473 };
474
475 template <>
476 struct FuzzTraits<base::TimeTicks> {
477 static bool Fuzz(base::TimeTicks* p, Fuzzer* fuzzer) {
478 int64 internal_value = p->ToInternalValue();
479 if (!FuzzParam(&internal_value, fuzzer))
480 return false;
481 *p = base::TimeTicks::FromInternalValue(internal_value);
482 return true;
483 }
484 };
485
486 template <>
487 struct FuzzTraits<base::ListValue> {
488 static bool Fuzz(base::ListValue* p, Fuzzer* fuzzer) {
489 // TODO(mbarbella): Support mutation.
490 if (!fuzzer->ShouldGenerate())
491 return true;
492
493 ++g_depth;
494 size_t list_length = p->GetSize();
495 if (fuzzer->ShouldGenerate())
496 list_length = g_depth > 3 ? 0 : RandInRange(8);
497 for (size_t index = 0; index < list_length; ++index) {
498 switch (RandInRange(8)) {
499 case base::Value::TYPE_BOOLEAN: {
500 bool tmp;
501 p->GetBoolean(index, &tmp);
502 fuzzer->FuzzBool(&tmp);
503 p->Set(index, new base::FundamentalValue(tmp));
504 break;
505 }
506 case base::Value::TYPE_INTEGER: {
507 int tmp;
508 p->GetInteger(index, &tmp);
509 fuzzer->FuzzInt(&tmp);
510 p->Set(index, new base::FundamentalValue(tmp));
511 break;
512 }
513 case base::Value::TYPE_DOUBLE: {
514 double tmp;
515 p->GetDouble(index, &tmp);
516 fuzzer->FuzzDouble(&tmp);
517 p->Set(index, new base::FundamentalValue(tmp));
518 break;
519 }
520 case base::Value::TYPE_STRING: {
521 std::string tmp;
522 p->GetString(index, &tmp);
523 fuzzer->FuzzString(&tmp);
524 p->Set(index, new base::StringValue(tmp));
525 break;
526 }
527 case base::Value::TYPE_BINARY: {
528 char tmp[200];
529 size_t bin_length = RandInRange(sizeof(tmp));
530 fuzzer->FuzzData(tmp, bin_length);
531 p->Set(index,
532 base::BinaryValue::CreateWithCopiedBuffer(tmp, bin_length));
533 break;
534 }
535 case base::Value::TYPE_DICTIONARY: {
536 base::DictionaryValue* tmp = new base::DictionaryValue();
537 p->GetDictionary(index, &tmp);
538 FuzzParam(tmp, fuzzer);
539 p->Set(index, tmp);
540 break;
541 }
542 case base::Value::TYPE_LIST: {
543 base::ListValue* tmp = new base::ListValue();
544 p->GetList(index, &tmp);
545 FuzzParam(tmp, fuzzer);
546 p->Set(index, tmp);
547 break;
548 }
549 case base::Value::TYPE_NULL:
550 default:
551 break;
552 }
553 }
554 --g_depth;
555 return true;
556 }
557 };
558
559 template <>
560 struct FuzzTraits<base::DictionaryValue> {
561 static bool Fuzz(base::DictionaryValue* p, Fuzzer* fuzzer) {
562 // TODO(mbarbella): Support mutation.
563 if (!fuzzer->ShouldGenerate())
564 return true;
565
566 ++g_depth;
567 size_t dict_length = g_depth > 3 ? 0 : RandInRange(8);
568 for (size_t index = 0; index < dict_length; ++index) {
569 std::string property;
570 fuzzer->FuzzString(&property);
571 switch (RandInRange(8)) {
572 case base::Value::TYPE_BOOLEAN: {
573 bool tmp;
574 fuzzer->FuzzBool(&tmp);
575 p->SetWithoutPathExpansion(property, new base::FundamentalValue(tmp));
576 break;
577 }
578 case base::Value::TYPE_INTEGER: {
579 int tmp;
580 fuzzer->FuzzInt(&tmp);
581 p->SetWithoutPathExpansion(property, new base::FundamentalValue(tmp));
582 break;
583 }
584 case base::Value::TYPE_DOUBLE: {
585 double tmp;
586 fuzzer->FuzzDouble(&tmp);
587 p->SetWithoutPathExpansion(property, new base::FundamentalValue(tmp));
588 break;
589 }
590 case base::Value::TYPE_STRING: {
591 std::string tmp;
592 fuzzer->FuzzString(&tmp);
593 p->SetWithoutPathExpansion(property, new base::StringValue(tmp));
594 break;
595 }
596 case base::Value::TYPE_BINARY: {
597 char tmp[200];
598 size_t bin_length = RandInRange(sizeof(tmp));
599 fuzzer->FuzzData(tmp, bin_length);
600 p->SetWithoutPathExpansion(
601 property,
602 base::BinaryValue::CreateWithCopiedBuffer(tmp, bin_length));
603 break;
604 }
605 case base::Value::TYPE_DICTIONARY: {
606 base::DictionaryValue* tmp = new base::DictionaryValue();
607 FuzzParam(tmp, fuzzer);
608 p->SetWithoutPathExpansion(property, tmp);
609 break;
610 }
611 case base::Value::TYPE_LIST: {
612 base::ListValue* tmp = new base::ListValue();
613 FuzzParam(tmp, fuzzer);
614 p->SetWithoutPathExpansion(property, tmp);
615 break;
616 }
617 case base::Value::TYPE_NULL:
618 default:
619 break;
620 }
621 }
622 --g_depth;
623 return true;
624 }
625 };
626
627 template <>
628 struct FuzzTraits<blink::WebGamepad> {
629 static bool Fuzz(blink::WebGamepad* p, Fuzzer* fuzzer) {
630 if (!FuzzParam(&p->connected, fuzzer))
631 return false;
632 if (!FuzzParam(&p->timestamp, fuzzer))
633 return false;
634 unsigned idLength = static_cast<unsigned>(
635 RandInRange(blink::WebGamepad::idLengthCap + 1));
636 if (!FuzzParamArray(&p->id[0], idLength, fuzzer))
637 return false;
638 p->axesLength = static_cast<unsigned>(
639 RandInRange(blink::WebGamepad::axesLengthCap + 1));
640 if (!FuzzParamArray(&p->axes[0], p->axesLength, fuzzer))
641 return false;
642 p->buttonsLength = static_cast<unsigned>(
643 RandInRange(blink::WebGamepad::buttonsLengthCap + 1));
644 if (!FuzzParamArray(&p->buttons[0], p->buttonsLength, fuzzer))
645 return false;
646 unsigned mappingsLength = static_cast<unsigned>(
647 RandInRange(blink::WebGamepad::mappingLengthCap + 1));
648 if (!FuzzParamArray(&p->mapping[0], mappingsLength, fuzzer))
649 return false;
650 return true;
651 }
652 };
653
654 template <>
655 struct FuzzTraits<blink::WebGamepadButton> {
656 static bool Fuzz(blink::WebGamepadButton* p, Fuzzer* fuzzer) {
657 if (!FuzzParam(&p->pressed, fuzzer))
658 return false;
659 if (!FuzzParam(&p->value, fuzzer))
660 return false;
661 return true;
662 }
663 };
664
665 template <>
666 struct FuzzTraits<cc::CompositorFrame> {
667 static bool Fuzz(cc::CompositorFrame* p, Fuzzer* fuzzer) {
668 // TODO(mbarbella): Support mutation.
669 if (!fuzzer->ShouldGenerate())
670 return true;
671
672 if (!FuzzParam(&p->metadata, fuzzer))
673 return false;
674
675 switch (RandInRange(3)) {
676 case 0: {
677 p->delegated_frame_data.reset(new cc::DelegatedFrameData());
678 if (!FuzzParam(p->delegated_frame_data.get(), fuzzer))
679 return false;
680 return true;
681 }
682 case 1: {
683 p->gl_frame_data.reset(new cc::GLFrameData());
684 if (!FuzzParam(p->gl_frame_data.get(), fuzzer))
685 return false;
686 return true;
687 }
688 default:
689 // Fuzz nothing to handle the no frame case.
690 return true;
691 }
692 }
693 };
694
695 template <>
696 struct FuzzTraits<cc::CompositorFrameAck> {
697 static bool Fuzz(cc::CompositorFrameAck* p, Fuzzer* fuzzer) {
698 if (!FuzzParam(&p->resources, fuzzer))
699 return false;
700
701 if (!p->gl_frame_data)
702 p->gl_frame_data.reset(new cc::GLFrameData);
703 if (!FuzzParam(p->gl_frame_data.get(), fuzzer))
704 return false;
705 return true;
706 }
707 };
708
709 template <>
710 struct FuzzTraits<cc::DelegatedFrameData> {
711 static bool Fuzz(cc::DelegatedFrameData* p, Fuzzer* fuzzer) {
712 if (!FuzzParam(&p->device_scale_factor, fuzzer))
713 return false;
714 if (!FuzzParam(&p->resource_list, fuzzer))
715 return false;
716 if (!FuzzParam(&p->render_pass_list, fuzzer))
717 return false;
718 return true;
719 }
720 };
721
722 template <class A>
723 struct FuzzTraits<cc::ListContainer<A>> {
724 static bool Fuzz(cc::ListContainer<A>* p, Fuzzer* fuzzer) {
725 // TODO(mbarbella): This should actually do something.
726 return true;
727 }
728 };
729
730 template <>
731 struct FuzzTraits<cc::QuadList> {
732 static bool Fuzz(cc::QuadList* p, Fuzzer* fuzzer) {
733 // TODO(mbarbella): This should actually do something.
734 return true;
735 }
736 };
737
738 template <>
739 struct FuzzTraits<cc::RenderPass> {
740 static bool Fuzz(cc::RenderPass* p, Fuzzer* fuzzer) {
741 if (!FuzzParam(&p->id, fuzzer))
742 return false;
743 if (!FuzzParam(&p->output_rect, fuzzer))
744 return false;
745 if (!FuzzParam(&p->damage_rect, fuzzer))
746 return false;
747 if (!FuzzParam(&p->transform_to_root_target, fuzzer))
748 return false;
749 if (!FuzzParam(&p->has_transparent_background, fuzzer))
750 return false;
751 if (!FuzzParam(&p->quad_list, fuzzer))
752 return false;
753 if (!FuzzParam(&p->shared_quad_state_list, fuzzer))
754 return false;
755 // Omitting |copy_requests| as it is not sent over IPC.
756 return true;
757 }
758 };
759
760 template <>
761 struct FuzzTraits<cc::RenderPassList> {
762 static bool Fuzz(cc::RenderPassList* p, Fuzzer* fuzzer) {
763 if (!fuzzer->ShouldGenerate()) {
764 for (size_t i = 0; i < p->size(); ++i) {
765 if (!FuzzParam(p->at(i), fuzzer))
766 return false;
767 }
768 return true;
769 }
770
771 size_t count = RandElementCount();
772 for (size_t i = 0; i < count; ++i) {
773 scoped_ptr<cc::RenderPass> render_pass = cc::RenderPass::Create();
774 if (!FuzzParam(render_pass.get(), fuzzer))
775 return false;
776 p->push_back(render_pass.Pass());
777 }
778 return true;
779 }
780 };
781
782 template <>
783 struct FuzzTraits<content::IndexedDBKey> {
784 static bool Fuzz(content::IndexedDBKey* p, Fuzzer* fuzzer) {
785 // TODO(mbarbella): Support mutation.
786 if (!fuzzer->ShouldGenerate())
787 return true;
788
789 ++g_depth;
790 blink::WebIDBKeyType web_type =
791 static_cast<blink::WebIDBKeyType>(RandInRange(7));
792 switch (web_type) {
793 case blink::WebIDBKeyTypeArray: {
794 size_t length = g_depth > 3 ? 0 : RandInRange(4);
795 std::vector<content::IndexedDBKey> array;
796 array.resize(length);
797 for (size_t i = 0; i < length; ++i) {
798 if (!FuzzParam(&array[i], fuzzer)) {
799 --g_depth;
800 return false;
801 }
802 }
803 *p = content::IndexedDBKey(array);
804 return true;
805 }
806 case blink::WebIDBKeyTypeBinary: {
807 std::string binary;
808 if (!FuzzParam(&binary, fuzzer)) {
809 --g_depth;
810 return false;
811 }
812 *p = content::IndexedDBKey(binary);
813 return true;
814 }
815 case blink::WebIDBKeyTypeString: {
816 base::string16 string;
817 if (!FuzzParam(&string, fuzzer))
818 return false;
819 *p = content::IndexedDBKey(string);
820 return true;
821 }
822 case blink::WebIDBKeyTypeDate:
823 case blink::WebIDBKeyTypeNumber: {
824 double number;
825 if (!FuzzParam(&number, fuzzer)) {
826 --g_depth;
827 return false;
828 }
829 *p = content::IndexedDBKey(number, web_type);
830 return true;
831 }
832 case blink::WebIDBKeyTypeInvalid:
833 case blink::WebIDBKeyTypeNull: {
834 *p = content::IndexedDBKey(web_type);
835 return true;
836 }
837 default: {
838 NOTREACHED();
839 --g_depth;
840 return false;
841 }
842 }
843 }
844 };
845
846 template <>
847 struct FuzzTraits<content::IndexedDBKeyRange> {
848 static bool Fuzz(content::IndexedDBKeyRange* p, Fuzzer* fuzzer) {
849 content::IndexedDBKey lower = p->lower();
850 content::IndexedDBKey upper = p->upper();
851 bool lower_open = p->lower_open();
852 bool upper_open = p->upper_open();
853 if (!FuzzParam(&lower, fuzzer))
854 return false;
855 if (!FuzzParam(&upper, fuzzer))
856 return false;
857 if (!FuzzParam(&lower_open, fuzzer))
858 return false;
859 if (!FuzzParam(&upper_open, fuzzer))
860 return false;
861 *p = content::IndexedDBKeyRange(lower, upper, lower_open, upper_open);
862 return true;
863 }
864 };
865
866 template <>
867 struct FuzzTraits<content::IndexedDBKeyPath> {
868 static bool Fuzz(content::IndexedDBKeyPath* p, Fuzzer* fuzzer) {
869 // TODO(mbarbella): Support mutation.
870 if (!fuzzer->ShouldGenerate())
871 return true;
872
873 switch (RandInRange(3)) {
874 case 0: {
875 std::vector<base::string16> array;
876 if (!FuzzParam(&array, fuzzer))
877 return false;
878 *p = content::IndexedDBKeyPath(array);
879 break;
880 }
881 case 1: {
882 base::string16 string;
883 if (!FuzzParam(&string, fuzzer))
884 return false;
885 *p = content::IndexedDBKeyPath(string);
886 break;
887 }
888 case 2: {
889 *p = content::IndexedDBKeyPath();
890 break;
891 }
892 }
893 return true;
894 }
895 };
896
897 template <>
898 struct FuzzTraits<content::NPIdentifier_Param> {
899 static bool Fuzz(content::NPIdentifier_Param* p, Fuzzer* fuzzer) {
900 // TODO(mbarbella): This should actually do something.
901 return true;
902 }
903 };
904
905 template <>
906 struct FuzzTraits<content::NPVariant_Param> {
907 static bool Fuzz(content::NPVariant_Param* p, Fuzzer* fuzzer) {
908 // TODO(mbarbella): This should actually do something.
909 return true;
910 }
911 };
912
913 template <>
914 struct FuzzTraits<content::PageState> {
915 static bool Fuzz(content::PageState* p, Fuzzer* fuzzer) {
916 std::string data = p->ToEncodedData();
917 if (!FuzzParam(&data, fuzzer))
918 return false;
919 *p = content::PageState::CreateFromEncodedData(data);
920 return true;
921 }
922 };
923
924 template <>
925 struct FuzzTraits<content::SyntheticGesturePacket> {
926 static bool Fuzz(content::SyntheticGesturePacket* p,
927 Fuzzer* fuzzer) {
928 // TODO(mbarbella): Support mutation.
929 if (!fuzzer->ShouldGenerate())
930 return true;
931
932 scoped_ptr<content::SyntheticGestureParams> gesture_params;
933 switch (RandInRange(
934 content::SyntheticGestureParams::SYNTHETIC_GESTURE_TYPE_MAX + 1)) {
935 case content::SyntheticGestureParams::GestureType::
936 SMOOTH_SCROLL_GESTURE: {
937 content::SyntheticSmoothScrollGestureParams* params =
938 new content::SyntheticSmoothScrollGestureParams();
939 if (!FuzzParam(&params->anchor, fuzzer))
940 return false;
941 if (!FuzzParam(&params->distances, fuzzer))
942 return false;
943 if (!FuzzParam(&params->prevent_fling, fuzzer))
944 return false;
945 if (!FuzzParam(&params->speed_in_pixels_s, fuzzer))
946 return false;
947 gesture_params.reset(params);
948 break;
949 }
950 case content::SyntheticGestureParams::GestureType::SMOOTH_DRAG_GESTURE: {
951 content::SyntheticSmoothDragGestureParams* params =
952 new content::SyntheticSmoothDragGestureParams();
953 if (!FuzzParam(&params->start_point, fuzzer))
954 return false;
955 if (!FuzzParam(&params->distances, fuzzer))
956 return false;
957 if (!FuzzParam(&params->speed_in_pixels_s, fuzzer))
958 return false;
959 gesture_params.reset(params);
960 break;
961 }
962 case content::SyntheticGestureParams::GestureType::PINCH_GESTURE: {
963 content::SyntheticPinchGestureParams* params =
964 new content::SyntheticPinchGestureParams();
965 if (!FuzzParam(&params->scale_factor, fuzzer))
966 return false;
967 if (!FuzzParam(&params->anchor, fuzzer))
968 return false;
969 if (!FuzzParam(&params->relative_pointer_speed_in_pixels_s,
970 fuzzer))
971 return false;
972 gesture_params.reset(params);
973 break;
974 }
975 case content::SyntheticGestureParams::GestureType::TAP_GESTURE: {
976 content::SyntheticTapGestureParams* params =
977 new content::SyntheticTapGestureParams();
978 if (!FuzzParam(&params->position, fuzzer))
979 return false;
980 if (!FuzzParam(&params->duration_ms, fuzzer))
981 return false;
982 gesture_params.reset(params);
983 break;
984 }
985 }
986 p->set_gesture_params(gesture_params.Pass());
987 return true;
988 }
989 };
990
991 template <>
992 struct FuzzTraits<content::WebCursor> {
993 static bool Fuzz(content::WebCursor* p, Fuzzer* fuzzer) {
994 content::WebCursor::CursorInfo info;
995 p->GetCursorInfo(&info);
996
997 // |type| enum is not validated on de-serialization, so pick random value.
998 if (!FuzzParam(reinterpret_cast<int*>(&info.type), fuzzer))
999 return false;
1000 if (!FuzzParam(&info.hotspot, fuzzer))
1001 return false;
1002 if (!FuzzParam(&info.image_scale_factor, fuzzer))
1003 return false;
1004 if (!FuzzParam(&info.custom_image, fuzzer))
1005 return false;
1006 // Omitting |externalHandle| since it is not serialized.
1007
1008 // Scale factor is expected to be greater than 0, otherwise we hit
1009 // a check failure.
1010 info.image_scale_factor = fabs(info.image_scale_factor) + 0.001;
1011
1012 *p = content::WebCursor(info);
1013 return true;
1014 }
1015 };
1016
1017 template <>
1018 struct FuzzTraits<ContentSettingsPattern> {
1019 static bool Fuzz(ContentSettingsPattern* p, Fuzzer* fuzzer) {
1020 // TODO(mbarbella): This can crash if a pattern is generated from a random
1021 // string. We could carefully generate a pattern or fix pattern generation.
1022 return true;
1023 }
1024 };
1025
1026 template <>
1027 struct FuzzTraits<ExtensionMsg_PermissionSetStruct> {
1028 static bool Fuzz(ExtensionMsg_PermissionSetStruct* p,
1029 Fuzzer* fuzzer) {
1030 // TODO(mbarbella): This should actually do something.
1031 return true;
1032 }
1033 };
1034
1035 template <>
1036 struct FuzzTraits<extensions::URLPatternSet> {
1037 static bool Fuzz(extensions::URLPatternSet* p, Fuzzer* fuzzer) {
1038 std::set<URLPattern> patterns = p->patterns();
1039 if (!FuzzParam(&patterns, fuzzer))
1040 return false;
1041 *p = extensions::URLPatternSet(patterns);
1042 return true;
1043 }
1044 };
1045
1046 template <>
1047 struct FuzzTraits<gfx::Point> {
1048 static bool Fuzz(gfx::Point* p, Fuzzer* fuzzer) {
1049 int x = p->x();
1050 int y = p->y();
1051 if (!FuzzParam(&x, fuzzer))
1052 return false;
1053 if (!FuzzParam(&y, fuzzer))
1054 return false;
1055 p->SetPoint(x, y);
1056 return true;
1057 }
1058 };
1059
1060 template <>
1061 struct FuzzTraits<gfx::PointF> {
1062 static bool Fuzz(gfx::PointF* p, Fuzzer* fuzzer) {
1063 float x = p->x();
1064 float y = p->y();
1065 if (!FuzzParam(&x, fuzzer))
1066 return false;
1067 if (!FuzzParam(&y, fuzzer))
1068 return false;
1069 p->SetPoint(x, y);
1070 return true;
1071 }
1072 };
1073
1074 template <>
1075 struct FuzzTraits<gfx::Rect> {
1076 static bool Fuzz(gfx::Rect* p, Fuzzer* fuzzer) {
1077 gfx::Point origin = p->origin();
1078 gfx::Size size = p->size();
1079 if (!FuzzParam(&origin, fuzzer))
1080 return false;
1081 if (!FuzzParam(&size, fuzzer))
1082 return false;
1083 p->set_origin(origin);
1084 p->set_size(size);
1085 return true;
1086 }
1087 };
1088
1089 template <>
1090 struct FuzzTraits<gfx::RectF> {
1091 static bool Fuzz(gfx::RectF* p, Fuzzer* fuzzer) {
1092 gfx::PointF origin = p->origin();
1093 gfx::SizeF size = p->size();
1094 if (!FuzzParam(&origin, fuzzer))
1095 return false;
1096 if (!FuzzParam(&size, fuzzer))
1097 return false;
1098 p->set_origin(origin);
1099 p->set_size(size);
1100 return true;
1101 }
1102 };
1103
1104 template <>
1105 struct FuzzTraits<gfx::Range> {
1106 static bool Fuzz(gfx::Range* p, Fuzzer* fuzzer) {
1107 size_t start = p->start();
1108 size_t end = p->end();
1109 if (!FuzzParam(&start, fuzzer))
1110 return false;
1111 if (!FuzzParam(&end, fuzzer))
1112 return false;
1113 *p = gfx::Range(start, end);
1114 return true;
1115 }
1116 };
1117
1118 template <>
1119 struct FuzzTraits<gfx::Size> {
1120 static bool Fuzz(gfx::Size* p, Fuzzer* fuzzer) {
1121 int width = p->width();
1122 int height = p->height();
1123 if (!FuzzParam(&width, fuzzer))
1124 return false;
1125 if (!FuzzParam(&height, fuzzer))
1126 return false;
1127 p->SetSize(width, height);
1128 return true;
1129 }
1130 };
1131
1132 template <>
1133 struct FuzzTraits<gfx::SizeF> {
1134 static bool Fuzz(gfx::SizeF* p, Fuzzer* fuzzer) {
1135 float w;
1136 float h;
1137 if (!FuzzParam(&w, fuzzer))
1138 return false;
1139 if (!FuzzParam(&h, fuzzer))
1140 return false;
1141 p->SetSize(w, h);
1142 return true;
1143 }
1144 };
1145
1146 template <>
1147 struct FuzzTraits<gfx::Transform> {
1148 static bool Fuzz(gfx::Transform* p, Fuzzer* fuzzer) {
1149 SkMScalar matrix[16];
1150 for (size_t i = 0; i < arraysize(matrix); i++) {
1151 matrix[i] = p->matrix().get(i / 4, i % 4);
1152 }
1153 if (!FuzzParamArray(&matrix[0], arraysize(matrix), fuzzer))
1154 return false;
1155 *p = gfx::Transform(matrix[0], matrix[1], matrix[2], matrix[3], matrix[4],
1156 matrix[5], matrix[6], matrix[7], matrix[8], matrix[9],
1157 matrix[10], matrix[11], matrix[12], matrix[13],
1158 matrix[14], matrix[15]);
1159 return true;
1160 }
1161 };
1162
1163 template <>
1164 struct FuzzTraits<gfx::Vector2d> {
1165 static bool Fuzz(gfx::Vector2d* p, Fuzzer* fuzzer) {
1166 int x = p->x();
1167 int y = p->y();
1168 if (!FuzzParam(&x, fuzzer))
1169 return false;
1170 if (!FuzzParam(&y, fuzzer))
1171 return false;
1172 *p = gfx::Vector2d(x, y);
1173 return true;
1174 }
1175 };
1176
1177 template <>
1178 struct FuzzTraits<gfx::Vector2dF> {
1179 static bool Fuzz(gfx::Vector2dF* p, Fuzzer* fuzzer) {
1180 float x = p->x();
1181 float y = p->y();
1182 if (!FuzzParam(&x, fuzzer))
1183 return false;
1184 if (!FuzzParam(&y, fuzzer))
1185 return false;
1186 *p = gfx::Vector2dF(x, y);
1187 return true;
1188 }
1189 };
1190
1191 template <>
1192 struct FuzzTraits<gpu::Mailbox> {
1193 static bool Fuzz(gpu::Mailbox* p, Fuzzer* fuzzer) {
1194 fuzzer->FuzzBytes(p->name, sizeof(p->name));
1195 return true;
1196 }
1197 };
1198
1199 template <>
1200 struct FuzzTraits<gpu::MailboxHolder> {
1201 static bool Fuzz(gpu::MailboxHolder* p, Fuzzer* fuzzer) {
1202 if (!FuzzParam(&p->mailbox, fuzzer))
1203 return false;
1204 if (!FuzzParam(&p->texture_target, fuzzer))
1205 return false;
1206 if (!FuzzParam(&p->sync_point, fuzzer))
1207 return false;
1208 return true;
1209 }
1210 };
1211
1212 template <>
1213 struct FuzzTraits<gpu::ValueState> {
1214 static bool Fuzz(gpu::ValueState* p, Fuzzer* fuzzer) {
1215 if (!FuzzParamArray(&p->float_value[0], 4, fuzzer))
1216 return false;
1217 if (!FuzzParamArray(&p->int_value[0], 4, fuzzer))
1218 return false;
1219 return true;
1220 }
1221 };
1222
1223 template <>
1224 struct FuzzTraits<GURL> {
1225 static bool Fuzz(GURL* p, Fuzzer* fuzzer) {
1226 if (!fuzzer->ShouldGenerate()) {
1227 std::string spec = p->possibly_invalid_spec();
1228 if (!FuzzParam(&spec, fuzzer))
1229 return false;
1230 if (spec != p->possibly_invalid_spec())
1231 *p = GURL(spec);
1232 return true;
1233 }
1234
1235 const char url_chars[] = "Ahtp0:/.?+\\%&#";
1236 size_t count = RandInRange(100);
1237 std::string random_url;
1238 for (size_t i = 0; i < count; ++i)
1239 random_url += url_chars[RandInRange(sizeof(url_chars) - 1)];
1240 int selector = RandInRange(10);
1241 if (selector == 0)
1242 random_url = std::string("http://") + random_url;
1243 else if (selector == 1)
1244 random_url = std::string("file://") + random_url;
1245 else if (selector == 2)
1246 random_url = std::string("javascript:") + random_url;
1247 else if (selector == 2)
1248 random_url = std::string("data:") + random_url;
1249 *p = GURL(random_url);
1250 return true;
1251 }
1252 };
1253
1254 template <>
1255 struct FuzzTraits<HostID> {
1256 static bool Fuzz(HostID* p, Fuzzer* fuzzer) {
1257 HostID::HostType type = p->type();
1258 std::string id = p->id();
1259 if (!FuzzParam(&type, fuzzer))
1260 return false;
1261 if (!FuzzParam(&id, fuzzer))
1262 return false;
1263 *p = HostID(type, id);
1264 return true;
1265 }
1266 };
1267
1268 #if defined(OS_WIN)
1269 template <>
1270 struct FuzzTraits<HWND> {
1271 static bool Fuzz(HWND* p, Fuzzer* fuzzer) {
1272 // TODO(aarya): This should actually do something.
1273 return true;
1274 }
1275 };
1276 #endif
1277
1278 template <>
1279 struct FuzzTraits<IPC::Message> {
1280 static bool Fuzz(IPC::Message* p, Fuzzer* fuzzer) {
1281 // TODO(mbarbella): Support mutation.
1282 if (!fuzzer->ShouldGenerate())
1283 return true;
1284
1285 if (g_function_vector.empty())
1286 return false;
1287 size_t index = RandInRange(g_function_vector.size());
1288 IPC::Message* ipc_message = (*g_function_vector[index])(NULL, fuzzer);
1289 if (!ipc_message)
1290 return false;
1291 p = ipc_message;
1292 return true;
1293 }
1294 };
1295
1296 template <>
1297 struct FuzzTraits<IPC::PlatformFileForTransit> {
1298 static bool Fuzz(IPC::PlatformFileForTransit* p, Fuzzer* fuzzer) {
1299 // TODO(inferno): I don't think we can generate real ones due to check on
1300 // construct.
1301 return true;
1302 }
1303 };
1304
1305 template <>
1306 struct FuzzTraits<IPC::ChannelHandle> {
1307 static bool Fuzz(IPC::ChannelHandle* p, Fuzzer* fuzzer) {
1308 // TODO(mbarbella): Support mutation.
1309 if (!fuzzer->ShouldGenerate())
1310 return true;
1311
1312 // TODO(inferno): Add way to generate real channel handles.
1313 #if defined(OS_WIN)
1314 HANDLE fake_handle = (HANDLE)(RandU64());
1315 p->pipe = IPC::ChannelHandle::PipeHandle(fake_handle);
1316 return true;
1317 #elif defined(OS_POSIX)
1318 return
1319 FuzzParam(&p->name, fuzzer) &&
1320 FuzzParam(&p->socket, fuzzer);
1321 #endif
1322 }
1323 };
1324
1325 #if defined(OS_WIN)
1326 template <>
1327 struct FuzzTraits<LOGFONT> {
1328 static bool Fuzz(LOGFONT* p, Fuzzer* fuzzer) {
1329 // TODO(aarya): This should actually do something.
1330 return true;
1331 }
1332 };
1333 #endif
1334
1335 template <>
1336 struct FuzzTraits<media::AudioParameters> {
1337 static bool Fuzz(media::AudioParameters* p, Fuzzer* fuzzer) {
1338 int format = p->format();
1339 int channel_layout = p->channel_layout();
1340 int sample_rate = p->sample_rate();
1341 int bits_per_sample = p->bits_per_sample();
1342 int frames_per_buffer = p->frames_per_buffer();
1343 int channels = p->channels();
1344 int effects = p->effects();
1345 if (!FuzzParam(&format, fuzzer))
1346 return false;
1347 if (!FuzzParam(&channel_layout, fuzzer))
1348 return false;
1349 if (!FuzzParam(&sample_rate, fuzzer))
1350 return false;
1351 if (!FuzzParam(&bits_per_sample, fuzzer))
1352 return false;
1353 if (!FuzzParam(&frames_per_buffer, fuzzer))
1354 return false;
1355 if (!FuzzParam(&channels, fuzzer))
1356 return false;
1357 if (!FuzzParam(&effects, fuzzer))
1358 return false;
1359 media::AudioParameters params(
1360 static_cast<media::AudioParameters::Format>(format),
1361 static_cast<media::ChannelLayout>(channel_layout), channels,
1362 sample_rate, bits_per_sample, frames_per_buffer, effects);
1363 *p = params;
1364 return true;
1365 }
1366 };
1367
1368 template <>
1369 struct FuzzTraits<media::VideoCaptureFormat> {
1370 static bool Fuzz(media::VideoCaptureFormat* p, Fuzzer* fuzzer) {
1371 if (!FuzzParam(&p->frame_size, fuzzer))
1372 return false;
1373 if (!FuzzParam(&p->frame_rate, fuzzer))
1374 return false;
1375 if (!FuzzParam(reinterpret_cast<int*>(&p->pixel_format), fuzzer))
1376 return false;
1377 return true;
1378 }
1379 };
1380
1381 template <>
1382 struct FuzzTraits<net::LoadTimingInfo> {
1383 static bool Fuzz(net::LoadTimingInfo* p, Fuzzer* fuzzer) {
1384 return FuzzParam(&p->socket_log_id, fuzzer) &&
1385 FuzzParam(&p->socket_reused, fuzzer) &&
1386 FuzzParam(&p->request_start_time, fuzzer) &&
1387 FuzzParam(&p->request_start, fuzzer) &&
1388 FuzzParam(&p->proxy_resolve_start, fuzzer) &&
1389 FuzzParam(&p->proxy_resolve_end, fuzzer) &&
1390 FuzzParam(&p->connect_timing.dns_start, fuzzer) &&
1391 FuzzParam(&p->connect_timing.dns_end, fuzzer) &&
1392 FuzzParam(&p->connect_timing.connect_start, fuzzer) &&
1393 FuzzParam(&p->connect_timing.connect_end, fuzzer) &&
1394 FuzzParam(&p->connect_timing.ssl_start, fuzzer) &&
1395 FuzzParam(&p->connect_timing.ssl_end, fuzzer) &&
1396 FuzzParam(&p->send_start, fuzzer) &&
1397 FuzzParam(&p->send_end, fuzzer) &&
1398 FuzzParam(&p->receive_headers_end, fuzzer);
1399 }
1400 };
1401
1402 template <>
1403 struct FuzzTraits<net::HostPortPair> {
1404 static bool Fuzz(net::HostPortPair* p, Fuzzer* fuzzer) {
1405 std::string host = p->host();
1406 uint16 port = p->port();
1407 if (!FuzzParam(&host, fuzzer))
1408 return false;
1409 if (!FuzzParam(&port, fuzzer))
1410 return false;
1411 p->set_host(host);
1412 p->set_port(port);
1413 return true;
1414 }
1415 };
1416
1417 template <>
1418 struct FuzzTraits<net::IPEndPoint> {
1419 static bool Fuzz(net::IPEndPoint* p, Fuzzer* fuzzer) {
1420 net::IPAddressNumber address = p->address();
1421 int port = p->port();
1422 if (!FuzzParam(&address, fuzzer))
1423 return false;
1424 if (!FuzzParam(&port, fuzzer))
1425 return false;
1426 net::IPEndPoint ip_endpoint(address, port);
1427 *p = ip_endpoint;
1428 return true;
1429 }
1430 };
1431
1432 template <>
1433 struct FuzzTraits<network_hints::LookupRequest> {
1434 static bool Fuzz(network_hints::LookupRequest* p, Fuzzer* fuzzer) {
1435 if (!FuzzParam(&p->hostname_list, fuzzer))
1436 return false;
1437 return true;
1438 }
1439 };
1440
1441 // PP_ traits.
1442 template <>
1443 struct FuzzTraits<PP_Bool> {
1444 static bool Fuzz(PP_Bool* p, Fuzzer* fuzzer) {
1445 bool tmp = PP_ToBool(*p);
1446 if (!FuzzParam(&tmp, fuzzer))
1447 return false;
1448 *p = PP_FromBool(tmp);
1449 return true;
1450 }
1451 };
1452
1453 template <>
1454 struct FuzzTraits<PP_KeyInformation> {
1455 static bool Fuzz(PP_KeyInformation* p, Fuzzer* fuzzer) {
1456 // TODO(mbarbella): This should actually do something.
1457 return true;
1458 }
1459 };
1460
1461 template <>
1462 struct FuzzTraits<PP_NetAddress_Private> {
1463 static bool Fuzz(PP_NetAddress_Private* p, Fuzzer* fuzzer) {
1464 p->size = RandInRange(sizeof(p->data) + 1);
1465 fuzzer->FuzzBytes(&p->data, p->size);
1466 return true;
1467 }
1468 };
1469
1470 template <>
1471 struct FuzzTraits<ppapi::PPB_X509Certificate_Fields> {
1472 static bool Fuzz(ppapi::PPB_X509Certificate_Fields* p,
1473 Fuzzer* fuzzer) {
1474 // TODO(mbarbella): This should actually do something.
1475 return true;
1476 }
1477 };
1478
1479 template <>
1480 struct FuzzTraits<ppapi::proxy::PPBFlash_DrawGlyphs_Params> {
1481 static bool Fuzz(ppapi::proxy::PPBFlash_DrawGlyphs_Params* p,
1482 Fuzzer* fuzzer) {
1483 // TODO(mbarbella): This should actually do something.
1484 return true;
1485 }
1486 };
1487
1488 template <>
1489 struct FuzzTraits<ppapi::proxy::ResourceMessageCallParams> {
1490 static bool Fuzz(
1491 ppapi::proxy::ResourceMessageCallParams* p, Fuzzer* fuzzer) {
1492 // TODO(mbarbella): Support mutation.
1493 if (!fuzzer->ShouldGenerate())
1494 return true;
1495
1496 PP_Resource resource;
1497 int32_t sequence;
1498 bool has_callback;
1499 if (!FuzzParam(&resource, fuzzer))
1500 return false;
1501 if (!FuzzParam(&sequence, fuzzer))
1502 return false;
1503 if (!FuzzParam(&has_callback, fuzzer))
1504 return false;
1505 *p = ppapi::proxy::ResourceMessageCallParams(resource, sequence);
1506 if (has_callback)
1507 p->set_has_callback();
1508 return true;
1509 }
1510 };
1511
1512 template <>
1513 struct FuzzTraits<ppapi::proxy::ResourceMessageReplyParams> {
1514 static bool Fuzz(
1515 ppapi::proxy::ResourceMessageReplyParams* p, Fuzzer* fuzzer) {
1516 // TODO(mbarbella): Support mutation.
1517 if (!fuzzer->ShouldGenerate())
1518 return true;
1519
1520 PP_Resource resource;
1521 int32_t sequence;
1522 int32_t result;
1523 if (!FuzzParam(&resource, fuzzer))
1524 return false;
1525 if (!FuzzParam(&sequence, fuzzer))
1526 return false;
1527 if (!FuzzParam(&result, fuzzer))
1528 return false;
1529 *p = ppapi::proxy::ResourceMessageReplyParams(resource, sequence);
1530 p->set_result(result);
1531 return true;
1532 }
1533 };
1534
1535 template <>
1536 struct FuzzTraits<ppapi::proxy::SerializedHandle> {
1537 static bool Fuzz(ppapi::proxy::SerializedHandle* p,
1538 Fuzzer* fuzzer) {
1539 // TODO(mbarbella): This should actually do something.
1540 return true;
1541 }
1542 };
1543
1544 template <>
1545 struct FuzzTraits<ppapi::proxy::SerializedFontDescription> {
1546 static bool Fuzz(ppapi::proxy::SerializedFontDescription* p,
1547 Fuzzer* fuzzer) {
1548 // TODO(mbarbella): This should actually do something.
1549 return true;
1550 }
1551 };
1552
1553 template <>
1554 struct FuzzTraits<ppapi::proxy::SerializedTrueTypeFontDesc> {
1555 static bool Fuzz(ppapi::proxy::SerializedTrueTypeFontDesc* p,
1556 Fuzzer* fuzzer) {
1557 // TODO(mbarbella): This should actually do something.
1558 return true;
1559 }
1560 };
1561
1562 template <>
1563 struct FuzzTraits<ppapi::proxy::SerializedVar> {
1564 static bool Fuzz(ppapi::proxy::SerializedVar* p, Fuzzer* fuzzer) {
1565 // TODO(mbarbella): This should actually do something.
1566 return true;
1567 }
1568 };
1569
1570 template <>
1571 struct FuzzTraits<ppapi::HostResource> {
1572 static bool Fuzz(ppapi::HostResource* p, Fuzzer* fuzzer) {
1573 // TODO(mbarbella): Support mutation.
1574 if (!fuzzer->ShouldGenerate())
1575 return true;
1576
1577 PP_Instance instance;
1578 PP_Resource resource;
1579 if (!FuzzParam(&instance, fuzzer))
1580 return false;
1581 if (!FuzzParam(&resource, fuzzer))
1582 return false;
1583 p->SetHostResource(instance, resource);
1584 return true;
1585 }
1586 };
1587
1588 template <>
1589 struct FuzzTraits<ppapi::PepperFilePath> {
1590 static bool Fuzz(ppapi::PepperFilePath *p, Fuzzer* fuzzer) {
1591 // TODO(mbarbella): Support mutation.
1592 if (!fuzzer->ShouldGenerate())
1593 return true;
1594
1595 unsigned domain = RandInRange(ppapi::PepperFilePath::DOMAIN_MAX_VALID+1);
1596 base::FilePath path;
1597 if (!FuzzParam(&path, fuzzer))
1598 return false;
1599 *p = ppapi::PepperFilePath(
1600 static_cast<ppapi::PepperFilePath::Domain>(domain), path);
1601 return true;
1602 }
1603 };
1604
1605 template <>
1606 struct FuzzTraits<ppapi::PpapiPermissions> {
1607 static bool Fuzz(ppapi::PpapiPermissions* p, Fuzzer* fuzzer) {
1608 uint32_t bits = p->GetBits();
1609 if (!FuzzParam(&bits, fuzzer))
1610 return false;
1611 *p = ppapi::PpapiPermissions(bits);
1612 return true;
1613 }
1614 };
1615
1616 template <>
1617 struct FuzzTraits<ppapi::SocketOptionData> {
1618 static bool Fuzz(ppapi::SocketOptionData* p, Fuzzer* fuzzer) {
1619 // TODO(mbarbella): This can be improved.
1620 int32 tmp;
1621 p->GetInt32(&tmp);
1622 if (!FuzzParam(&tmp, fuzzer))
1623 return false;
1624 p->SetInt32(tmp);
1625 return true;
1626 }
1627 };
1628
1629 template <>
1630 struct FuzzTraits<printing::PdfRenderSettings> {
1631 static bool Fuzz(printing::PdfRenderSettings* p, Fuzzer* fuzzer) {
1632 gfx::Rect area = p->area();
1633 int dpi = p->dpi();
1634 bool autorotate = p->autorotate();
1635 if (!FuzzParam(&area, fuzzer))
1636 return false;
1637 if (!FuzzParam(&dpi, fuzzer))
1638 return false;
1639 if (!FuzzParam(&autorotate, fuzzer))
1640 return false;
1641 *p = printing::PdfRenderSettings(area, dpi, autorotate);
1642 return true;
1643 }
1644 };
1645
1646 template <>
1647 struct FuzzTraits<remoting::ScreenResolution> {
1648 static bool Fuzz(remoting::ScreenResolution* p, Fuzzer* fuzzer) {
1649 webrtc::DesktopSize dimensions = p->dimensions();
1650 webrtc::DesktopVector dpi = p->dpi();
1651 if (!FuzzParam(&dimensions, fuzzer))
1652 return false;
1653 if (!FuzzParam(&dpi, fuzzer))
1654 return false;
1655 *p = remoting::ScreenResolution(dimensions, dpi);
1656 return true;
1657 }
1658 };
1659
1660 template <>
1661 struct FuzzTraits<SkBitmap> {
1662 static bool Fuzz(SkBitmap* p, Fuzzer* fuzzer) {
1663 // TODO(mbarbella): This should actually do something.
1664 return true;
1665 }
1666 };
1667
1668 template <>
1669 struct FuzzTraits<storage::DataElement> {
1670 static bool Fuzz(storage::DataElement* p, Fuzzer* fuzzer) {
1671 // TODO(mbarbella): Support mutation.
1672 if (!fuzzer->ShouldGenerate())
1673 return true;
1674
1675 switch (RandInRange(4)) {
1676 case storage::DataElement::Type::TYPE_BYTES: {
1677 if (RandEvent(2)) {
1678 p->SetToEmptyBytes();
1679 } else {
1680 char data[256];
1681 int data_len = RandInRange(sizeof(data));
1682 fuzzer->FuzzBytes(&data[0], data_len);
1683 p->SetToBytes(&data[0], data_len);
1684 }
1685 return true;
1686 }
1687 case storage::DataElement::Type::TYPE_FILE: {
1688 base::FilePath path;
1689 uint64 offset;
1690 uint64 length;
1691 base::Time modification_time;
1692 if (!FuzzParam(&path, fuzzer))
1693 return false;
1694 if (!FuzzParam(&offset, fuzzer))
1695 return false;
1696 if (!FuzzParam(&length, fuzzer))
1697 return false;
1698 if (!FuzzParam(&modification_time, fuzzer))
1699 return false;
1700 p->SetToFilePathRange(path, offset, length, modification_time);
1701 return true;
1702 }
1703 case storage::DataElement::Type::TYPE_BLOB: {
1704 std::string uuid;
1705 uint64 offset;
1706 uint64 length;
1707 if (!FuzzParam(&uuid, fuzzer))
1708 return false;
1709 if (!FuzzParam(&offset, fuzzer))
1710 return false;
1711 if (!FuzzParam(&length, fuzzer))
1712 return false;
1713 p->SetToBlobRange(uuid, offset, length);
1714 return true;
1715 }
1716 case storage::DataElement::Type::TYPE_FILE_FILESYSTEM: {
1717 GURL url;
1718 uint64 offset;
1719 uint64 length;
1720 base::Time modification_time;
1721 if (!FuzzParam(&url, fuzzer))
1722 return false;
1723 if (!FuzzParam(&offset, fuzzer))
1724 return false;
1725 if (!FuzzParam(&length, fuzzer))
1726 return false;
1727 if (!FuzzParam(&modification_time, fuzzer))
1728 return false;
1729 p->SetToFileSystemUrlRange(url, offset, length, modification_time);
1730 return true;
1731 }
1732 default: {
1733 NOTREACHED();
1734 return false;
1735 }
1736 }
1737 }
1738 };
1739
1740 template <>
1741 struct FuzzTraits<ui::LatencyInfo> {
1742 static bool Fuzz(ui::LatencyInfo* p, Fuzzer* fuzzer) {
1743 // TODO(inferno): Add param traits for |latency_components|.
1744 int64 trace_id = p->trace_id();
1745 bool terminated = p->terminated();
1746 uint32 input_coordinates_size = static_cast<uint32>(
1747 RandInRange(ui::LatencyInfo::kMaxInputCoordinates + 1));
1748 ui::LatencyInfo::InputCoordinate
1749 input_coordinates[ui::LatencyInfo::kMaxInputCoordinates];
1750 if (!FuzzParamArray(
1751 input_coordinates, input_coordinates_size, fuzzer))
1752 return false;
1753 if (!FuzzParam(&trace_id, fuzzer))
1754 return false;
1755 if (!FuzzParam(&terminated, fuzzer))
1756 return false;
1757
1758 ui::LatencyInfo latency(trace_id, terminated);
1759 for (size_t i = 0; i < input_coordinates_size; i++) {
1760 latency.AddInputCoordinate(input_coordinates[i]);
1761 }
1762 *p = latency;
1763
1764 return true;
1765 }
1766 };
1767
1768 template <>
1769 struct FuzzTraits<ui::LatencyInfo::InputCoordinate> {
1770 static bool Fuzz(
1771 ui::LatencyInfo::InputCoordinate* p, Fuzzer* fuzzer) {
1772 if (!FuzzParam(&p->x, fuzzer))
1773 return false;
1774 if (!FuzzParam(&p->y, fuzzer))
1775 return false;
1776 return true;
1777 }
1778 };
1779
1780 template <>
1781 struct FuzzTraits<url::Origin> {
1782 static bool Fuzz(url::Origin* p, Fuzzer* fuzzer) {
1783 std::string scheme = p->scheme();
1784 std::string host = p->host();
1785 uint16 port = p->port();
1786 if (!FuzzParam(&scheme, fuzzer))
1787 return false;
1788 if (!FuzzParam(&host, fuzzer))
1789 return false;
1790 if (!FuzzParam(&port, fuzzer))
1791 return false;
1792 *p = url::Origin::UnsafelyCreateOriginWithoutNormalization(scheme, host,
1793 port);
1794
1795 // Force a unique origin 1% of the time:
1796 if (RandInRange(100) == 1)
1797 *p = url::Origin();
1798 return true;
1799 }
1800 };
1801
1802 template <>
1803 struct FuzzTraits<URLPattern> {
1804 static bool Fuzz(URLPattern* p, Fuzzer* fuzzer) {
1805 int valid_schemes = p->valid_schemes();
1806 std::string host = p->host();
1807 std::string port = p->port();
1808 std::string path = p->path();
1809 if (!FuzzParam(&valid_schemes, fuzzer))
1810 return false;
1811 if (!FuzzParam(&host, fuzzer))
1812 return false;
1813 if (!FuzzParam(&port, fuzzer))
1814 return false;
1815 if (!FuzzParam(&path, fuzzer))
1816 return false;
1817 *p = URLPattern(valid_schemes);
1818 p->SetHost(host);
1819 p->SetPort(port);
1820 p->SetPath(path);
1821 return true;
1822 }
1823 };
1824
1825 template <>
1826 struct FuzzTraits<webrtc::DesktopSize> {
1827 static bool Fuzz(webrtc::DesktopSize* p, Fuzzer* fuzzer) {
1828 int32_t width = p->width();
1829 int32_t height = p->height();
1830 if (!FuzzParam(&width, fuzzer))
1831 return false;
1832 if (!FuzzParam(&height, fuzzer))
1833 return false;
1834 *p = webrtc::DesktopSize(width, height);
1835 return true;
1836 }
1837 };
1838
1839 template <>
1840 struct FuzzTraits<webrtc::DesktopVector> {
1841 static bool Fuzz(webrtc::DesktopVector* p, Fuzzer* fuzzer) {
1842 int32_t x = p->x();
1843 int32_t y = p->y();
1844 if (!FuzzParam(&x, fuzzer))
1845 return false;
1846 if (!FuzzParam(&y, fuzzer))
1847 return false;
1848 p->set(x, y);
1849 return true;
1850 }
1851 };
1852
1853 template <>
1854 struct FuzzTraits<webrtc::DesktopRect> {
1855 static bool Fuzz(webrtc::DesktopRect* p, Fuzzer* fuzzer) {
1856 int32_t left = p->left();
1857 int32_t top = p->top();
1858 int32_t right = p->right();
1859 int32_t bottom = p->bottom();
1860 if (!FuzzParam(&left, fuzzer))
1861 return false;
1862 if (!FuzzParam(&top, fuzzer))
1863 return false;
1864 if (!FuzzParam(&right, fuzzer))
1865 return false;
1866 if (!FuzzParam(&bottom, fuzzer))
1867 return false;
1868 *p = webrtc::DesktopRect::MakeLTRB(left, top, right, bottom);
1869 return true;
1870 }
1871 };
1872
1873 template <>
1874 struct FuzzTraits<webrtc::MouseCursor> {
1875 static bool Fuzz(webrtc::MouseCursor* p, Fuzzer* fuzzer) {
1876 webrtc::DesktopVector hotspot = p->hotspot();
1877 if (!FuzzParam(&hotspot, fuzzer))
1878 return false;
1879 p->set_hotspot(hotspot);
1880
1881 // TODO(mbarbella): Find a way to handle the size mutation properly.
1882 if (!fuzzer->ShouldGenerate())
1883 return false;
1884
1885 // Using a small size here to avoid OOM or overflow on image allocation.
1886 webrtc::DesktopSize size(RandInRange(100), RandInRange(100));
1887 p->set_image(new webrtc::BasicDesktopFrame(size));
1888 return true;
1889 }
1890 };
1891
1892 // Redefine macros to generate generating from traits declarations.
1893 // STRUCT declarations cause corresponding STRUCT_TRAITS declarations to occur.
1894 #undef IPC_STRUCT_BEGIN
1895 #undef IPC_STRUCT_BEGIN_WITH_PARENT
1896 #undef IPC_STRUCT_MEMBER
1897 #undef IPC_STRUCT_END
1898 #define IPC_STRUCT_BEGIN_WITH_PARENT(struct_name, parent) \
1899 IPC_STRUCT_BEGIN(struct_name)
1900 #define IPC_STRUCT_BEGIN(struct_name) IPC_STRUCT_TRAITS_BEGIN(struct_name)
1901 #define IPC_STRUCT_MEMBER(type, name, ...) IPC_STRUCT_TRAITS_MEMBER(name)
1902 #define IPC_STRUCT_END() IPC_STRUCT_TRAITS_END()
1903
1904 // Set up so next include will generate generate trait classes.
1905 #undef IPC_STRUCT_TRAITS_BEGIN
1906 #undef IPC_STRUCT_TRAITS_MEMBER
1907 #undef IPC_STRUCT_TRAITS_PARENT
1908 #undef IPC_STRUCT_TRAITS_END
1909 #define IPC_STRUCT_TRAITS_BEGIN(struct_name) \
1910 template <> \
1911 struct FuzzTraits<struct_name> { \
1912 static bool Fuzz(struct_name *p, Fuzzer* fuzzer) {
1913
1914 #define IPC_STRUCT_TRAITS_MEMBER(name) \
1915 if (!FuzzParam(&p->name, fuzzer)) \
1916 return false;
1917
1918 #define IPC_STRUCT_TRAITS_PARENT(type) \
1919 if (!FuzzParam(static_cast<type*>(p), fuzzer)) \
1920 return false;
1921
1922 #define IPC_STRUCT_TRAITS_END() \
1923 return true; \
1924 } \
1925 };
1926
1927 // If |condition| isn't met, the messsge will fail to serialize. Try
1928 // increasingly smaller ranges until we find one that happens to meet
1929 // the condition, or fail trying.
1930 // TODO(mbarbella): Attempt to validate even in the mutation case.
1931 #undef IPC_ENUM_TRAITS_VALIDATE
1932 #define IPC_ENUM_TRAITS_VALIDATE(enum_name, condition) \
1933 template <> \
1934 struct FuzzTraits<enum_name> { \
1935 static bool Fuzz(enum_name* p, Fuzzer* fuzzer) { \
1936 if (!fuzzer->ShouldGenerate()) { \
1937 return FuzzParam(reinterpret_cast<int*>(p), fuzzer); \
1938 } \
1939 for (int shift = 30; shift; --shift) { \
1940 for (int tries = 0; tries < 2; ++tries) { \
1941 int value = RandInRange(1 << shift); \
1942 if (condition) { \
1943 *reinterpret_cast<int*>(p) = value; \
1944 return true; \
1945 } \
1946 } \
1947 } \
1948 std::cerr << "failed to satisfy " << #condition << "\n"; \
1949 return false; \
1950 } \
1951 };
1952
1953 // Bring them into existence.
1954 #include "tools/ipc_fuzzer/message_lib/all_messages.h"
1955 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h"
1956
1957 // Redefine macros to generate generating funtions
1958 #undef IPC_MESSAGE_DECL
1959 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \
1960 IPC_##kind##_##type##_FUZZ(name, in, out, ilist, olist)
1961
1962 #define IPC_EMPTY_CONTROL_FUZZ(name, in, out, ilist, olist) \
1963 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \
1964 if (msg) { \
1965 return NULL; \
1966 } \
1967 return new name(); \
1968 }
1969
1970 #define IPC_EMPTY_ROUTED_FUZZ(name, in, out, ilist, olist) \
1971 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \
1972 if (msg) { \
1973 return NULL; \
1974 } \
1975 return new name(RandInRange(MAX_FAKE_ROUTING_ID)); \
1976 }
1977
1978 #define IPC_ASYNC_CONTROL_FUZZ(name, in, out, ilist, olist) \
1979 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \
1980 IPC_TUPLE_IN_##in ilist p; \
1981 if (msg) { \
1982 name::Read(static_cast<name*>(msg), &p); \
1983 } \
1984 if (FuzzParam(&p, fuzzer)) { \
1985 return new name(IPC_MEMBERS_IN_##in(p)); \
1986 } \
1987 std::cerr << "Don't know how to handle " << #name << "\n"; \
1988 return 0; \
1989 }
1990
1991 #define IPC_ASYNC_ROUTED_FUZZ(name, in, out, ilist, olist) \
1992 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \
1993 IPC_TUPLE_IN_##in ilist p; \
1994 if (msg) { \
1995 name::Read(static_cast<name*>(msg), &p); \
1996 } \
1997 if (FuzzParam(&p, fuzzer)) { \
1998 return new name(RandInRange(MAX_FAKE_ROUTING_ID) \
1999 IPC_COMMA_##in \
2000 IPC_MEMBERS_IN_##in(p)); \
2001 } \
2002 std::cerr << "Don't know how to handle " << #name << "\n"; \
2003 return 0; \
2004 }
2005
2006 #define IPC_SYNC_CONTROL_FUZZ(name, in, out, ilist, olist) \
2007 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \
2008 IPC_TUPLE_IN_##in ilist p; \
2009 name* real_msg = static_cast<name*>(msg); \
2010 name* new_msg = NULL; \
2011 if (real_msg) { \
2012 name::ReadSendParam(real_msg, &p); \
2013 } \
2014 if (FuzzParam(&p, fuzzer)) { \
2015 new_msg = new name(IPC_MEMBERS_IN_##in(p) \
2016 IPC_COMMA_AND_##out(IPC_COMMA_##in) \
2017 IPC_MEMBERS_OUT_##out()); \
2018 } \
2019 if (real_msg && new_msg) { \
2020 MessageCracker::CopyMessageID(new_msg, real_msg); \
2021 } \
2022 else if (!new_msg) { \
2023 std::cerr << "Don't know how to handle " << #name << "\n"; \
2024 } \
2025 return new_msg; \
2026 }
2027
2028 #define IPC_SYNC_ROUTED_FUZZ(name, in, out, ilist, olist) \
2029 IPC::Message* fuzzer_for_##name(IPC::Message* msg, Fuzzer* fuzzer) { \
2030 IPC_TUPLE_IN_##in ilist p; \
2031 name* real_msg = static_cast<name*>(msg); \
2032 name* new_msg = NULL; \
2033 if (real_msg) { \
2034 name::ReadSendParam(real_msg, &p); \
2035 } \
2036 if (FuzzParam(&p, fuzzer)) { \
2037 new_msg = new name(RandInRange(MAX_FAKE_ROUTING_ID) \
2038 IPC_COMMA_OR_##out(IPC_COMMA_##in) \
2039 IPC_MEMBERS_IN_##in(p) \
2040 IPC_COMMA_AND_##out(IPC_COMMA_##in) \
2041 IPC_MEMBERS_OUT_##out()); \
2042 } \
2043 if (real_msg && new_msg) { \
2044 MessageCracker::CopyMessageID(new_msg, real_msg); \
2045 } \
2046 else if (!new_msg) { \
2047 std::cerr << "Don't know how to handle " << #name << "\n"; \
2048 } \
2049 return new_msg; \
2050 }
2051
2052 #define MAX_FAKE_ROUTING_ID 15
2053
2054 #define IPC_MEMBERS_IN_0(p)
2055 #define IPC_MEMBERS_IN_1(p) base::get<0>(p)
2056 #define IPC_MEMBERS_IN_2(p) base::get<0>(p), base::get<1>(p)
2057 #define IPC_MEMBERS_IN_3(p) base::get<0>(p), base::get<1>(p), base::get<2>(p)
2058 #define IPC_MEMBERS_IN_4(p) base::get<0>(p), base::get<1>(p), base::get<2>(p), \
2059 base::get<3>(p)
2060 #define IPC_MEMBERS_IN_5(p) base::get<0>(p), base::get<1>(p), base::get<2>(p), \
2061 base::get<3>(p), base::get<4>(p)
2062
2063 #define IPC_MEMBERS_OUT_0()
2064 #define IPC_MEMBERS_OUT_1() NULL
2065 #define IPC_MEMBERS_OUT_2() NULL, NULL
2066 #define IPC_MEMBERS_OUT_3() NULL, NULL, NULL
2067 #define IPC_MEMBERS_OUT_4() NULL, NULL, NULL, NULL
2068 #define IPC_MEMBERS_OUT_5() NULL, NULL, NULL, NULL, NULL
2069
2070 #include "tools/ipc_fuzzer/message_lib/all_messages.h"
2071 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h"
2072
2073 void PopulateFuzzerFunctionVector(
2074 FuzzerFunctionVector* function_vector) {
2075 #undef IPC_MESSAGE_DECL
2076 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \
2077 function_vector->push_back(fuzzer_for_##name);
2078 #include "tools/ipc_fuzzer/message_lib/all_messages.h"
2079 }
2080
2081 // Redefine macros to register fuzzing functions into map.
2082 #include "tools/ipc_fuzzer/message_lib/all_message_null_macros.h"
2083 #undef IPC_MESSAGE_DECL
2084 #define IPC_MESSAGE_DECL(kind, type, name, in, out, ilist, olist) \
2085 (*map)[static_cast<uint32>(name::ID)] = fuzzer_for_##name;
2086
2087 void PopulateFuzzerFunctionMap(FuzzerFunctionMap* map) {
2088 #include "tools/ipc_fuzzer/message_lib/all_messages.h"
2089 }
2090
2091 } // namespace ipc_fuzzer