t.cc

#include <cstdint>

#include "js/Initialization.h"
#include "jsapi.h"

extern "C" char *grammarfuzz_js_generate(const uint8_t *, size_t);
extern "C" void grammarfuzz_js_free(char *);

static JSClassOps global_ops = {nullptr,
                                nullptr,
                                nullptr,
                                nullptr,
                                nullptr,
                                nullptr,
                                nullptr,
                                nullptr,
                                nullptr,
                                nullptr,
                                JS_GlobalObjectTraceHook};

static JSClass global_class = {"global", JSCLASS_GLOBAL_FLAGS, &global_ops};

extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) {
  JS_Init();
  return 1;
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  std::unique_ptr<JSContext, decltype(&JS_DestroyContext)> cx(
      JS_NewContext(8 * 1024 * 1024), &JS_DestroyContext);
  if (!cx) {
    return 0;
  }

  if (!JS::InitSelfHostedCode(cx.get())) {
    return 0;
  }

  {
    JSAutoRequest ar(cx.get());
    JS::CompartmentOptions options;
    JS::RootedObject global(
        cx.get(), JS_NewGlobalObject(cx.get(), &global_class, nullptr,
                                     JS::FireOnNewGlobalHook, options));
    if (!global) {
      return 0;
    }

    JS::RootedValue rval(cx.get());
    {
      JSAutoCompartment ac(cx.get(), global);
      JS_InitStandardClasses(cx.get(), global);

      std::unique_ptr<char[], decltype(&grammarfuzz_js_free)> source(
          grammarfuzz_js_generate(data, size), &grammarfuzz_js_free);
      JS::CompileOptions opts(cx.get());
      JS::Evaluate(cx.get(), opts, source.get(), strlen(source.get()), &rval);
    }
  }

  return 0;
}