DL: Add display locking fuzzer.

This patch adds a display locking fuzzer with the wpt tests as the corpus.
This is using a content fuzzer base to help with the loading, and rafs
a few times depending on input.

R=chrishtr@chromium.org, rakina@chromium.org

Change-Id: I1f1f3dd5e7711158cc1f7a148c226395939cf8d0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1677008
Commit-Queue: vmpstr <vmpstr@chromium.org>
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Reviewed-by: Rakina Zata Amni <rakina@chromium.org>
Cr-Commit-Position: refs/heads/master@{#678439}

content/test/fuzzer/fuzzer_support.cc

@@ -28,6 +28,7 @@ constexpr gin::V8Initializer::V8SnapshotFileType kSnapshotType =
 
 void RenderViewTestAdapter::SetUp() {
   RenderViewTest::SetUp();
+  CreateFakeWebURLLoaderFactory();
 }
 
 Env::Env() {

content/test/fuzzer/fuzzer_support.h

@@ -26,6 +26,8 @@ class RenderViewTestAdapter : public RenderViewTest {
     RenderViewTest::LoadHTMLWithUrlOverride(html.c_str(), url.c_str());
   }
 
+  using RenderViewTest::GetMainFrame;
+
  private:
   DISALLOW_COPY_AND_ASSIGN(RenderViewTestAdapter);
 };

third_party/blink/renderer/core/display_lock/BUILD.gn

@@ -2,6 +2,7 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//testing/libfuzzer/fuzzer_test.gni")
 import("//third_party/blink/renderer/core/core.gni")
 
 blink_core_sources("display_lock") {
@@ -26,3 +27,15 @@ blink_core_sources("display_lock") {
     "//third_party/blink/renderer/bindings/core/v8:bindings_core_v8_generated",
   ]
 }
+
+fuzzer_test("display_lock_fuzzer") {
+  sources = [
+    "display_lock_fuzzer.cc",
+  ]
+  deps = [
+    "//content/test/fuzzer:fuzzer_support",
+  ]
+
+  seed_corpus = "//third_party/blink/web_tests/wpt_internal/display-lock"
+  dict = "display_lock.dict"
+}

third_party/blink/renderer/core/display_lock/DEPS

+specific_include_rules = {
+  "display_lock_fuzzer.cc" : [ "+content/test/fuzzer/fuzzer_support.h" ],
+}

third_party/blink/renderer/core/display_lock/display_lock.dict

+"displayLock.acquire"
+"displayLock.commit()"
+"displayLock.update()"
+"displayLock.updateAndCommit()"
+"activatable: true"
+"activatable: false"
+"timeout: Infinity"
+"timeout: 0"
+"timeout: 17"
+"size: [100, 100]"
+"contain: style layout"

third_party/blink/renderer/core/display_lock/display_lock_fuzzer.cc

+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/test/fuzzer/fuzzer_support.h"
+#include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
+#include "third_party/blink/public/platform/web_runtime_features.h"
+#include "third_party/blink/public/web/web_local_frame.h"
+#include "third_party/blink/public/web/web_view.h"
+#include "third_party/blink/public/web/web_widget.h"
+
+static content::Env* env;
+
+bool Initialize() {
+  blink::WebRuntimeFeatures::EnableDisplayLocking(true);
+  env = new content::Env();
+  return true;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  static bool initialized = Initialize();
+  // Suppress unused variable warning.
+  (void)initialized;
+
+  // Only handle reasonable size inputs.
+  if (size < 1 || size > 10000)
+    return 0;
+
+  std::string data_as_string(reinterpret_cast<const char*>(data), size);
+  int num_rafs = std::hash<std::string>()(data_as_string) % 10;
+  env->adapter->LoadHTML(data_as_string, "");
+
+  // Delay each frame 17ms which is roughly the length of a frame when running
+  // at 60fps.
+  auto frame_delay = base::TimeDelta::FromMillisecondsD(17);
+
+  for (int i = 0; i < num_rafs; ++i) {
+    base::RunLoop run_loop;
+    blink::scheduler::GetSingleThreadTaskRunnerForTesting()->PostDelayedTask(
+        FROM_HERE, run_loop.QuitClosure(), frame_delay);
+    run_loop.Run();
+
+    env->adapter->GetMainFrame()
+        ->View()
+        ->MainFrameWidget()
+        ->UpdateAllLifecyclePhases(
+            blink::WebWidget::LifecycleUpdateReason::kTest);
+  }
+  return 0;
+}

third_party/blink/tools/blinkpy/presubmit/audit_non_blink_usage.py

@@ -943,7 +943,7 @@ def check(path, contents):
     # Because Windows.
     path = path.replace('\\', '/')
     basename, ext = os.path.splitext(path)
-    # Only check code. Ignore tests.
+    # Only check code. Ignore tests and fuzzers.
     # TODO(tkent): Remove 'Test' after the great mv.
     if (ext not in ('.cc', '.cpp', '.h', '.mm')
             or path.find('/testing/') >= 0
@@ -951,7 +951,8 @@ def check(path, contents):
             or basename.endswith('Test')
             or basename.endswith('_test')
             or basename.endswith('_test_helpers')
-            or basename.endswith('_unittest')):
+            or basename.endswith('_unittest')
+            or basename.endswith('_fuzzer')):
         return results
     entries = _find_matching_entries(path)
     if not entries: