Implement fuzzing of VP9 depacketization.

webrtc/test/fuzzers/BUILD.gn

Index: webrtc/test/fuzzers/BUILD.gn
diff --git a/webrtc/test/fuzzers/BUILD.gn b/webrtc/test/fuzzers/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..d8b194913382d70fedfed8f7ba50f3f62c7749e3
--- /dev/null
+++ b/webrtc/test/fuzzers/BUILD.gn
@@ -0,0 +1,51 @@
+# Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
+#
+# Use of this source code is governed by a BSD-style license
+# that can be found in the LICENSE file in the root of the source
+# tree. An additional intellectual property rights grant can be found
+# in the file PATENTS.  All contributing project authors may
+# be found in the AUTHORS file in the root of the source tree.
+
+import("//build/config/features.gni")
+import("//testing/test.gni")
+
+# TODO(pbos): Do not copy libfuzzer from chromium, instead depend on it.
+static_library("webrtcfuzzer_main") {
+  # libfuzzer should be compiled without coverage (infinite loop in trace_cmp).
+  configs -= [ "//build/config/sanitizers:default_sanitizer_coverage_flags" ]
+
+  sources = [
+    "../../../third_party/llvm/lib/Fuzzer/FuzzerCrossOver.cpp",

[kjellander_webrtc, 2015/11/19 15:23:06]

I believe the right thing to do about these sources is to add a BUILD.gn file in
Chromium's
src/build/secondary/third_party/llvm and put the sources into a libfuzzer target
there.
That of course would require us to wait for the revision to be rolled down to
WebRTC, but that happens three times a day now.

[pbos-webrtc, 2015/11/19 15:39:25]

That's not a problem, I expect to rebase this about once or twice before it
lands. I wanted to put this up to show aizatsky@ what my current option was (and
I don't like it) to see if we can do something about this dependency upstream.

[kjellander_webrtc, 2015/11/19 16:18:41]

Then at least add a comment/TODO about that these should be covered by a target
in 
src/build/secondary/third_party/llvm/BUILD.gn in Chromium (which we could reuse
here).

+    "../../../third_party/llvm/lib/Fuzzer/FuzzerDriver.cpp",
+    "../../../third_party/llvm/lib/Fuzzer/FuzzerFlags.def",
+    "../../../third_party/llvm/lib/Fuzzer/FuzzerIO.cpp",
+    "../../../third_party/llvm/lib/Fuzzer/FuzzerInterface.cpp",
+    "../../../third_party/llvm/lib/Fuzzer/FuzzerLoop.cpp",
+    "../../../third_party/llvm/lib/Fuzzer/FuzzerMain.cpp",
+    "../../../third_party/llvm/lib/Fuzzer/FuzzerMutate.cpp",
+    "../../../third_party/llvm/lib/Fuzzer/FuzzerSHA1.cpp",
+    "../../../third_party/llvm/lib/Fuzzer/FuzzerSanitizerOptions.cpp",
+    "../../../third_party/llvm/lib/Fuzzer/FuzzerTraceState.cpp",
+    "../../../third_party/llvm/lib/Fuzzer/FuzzerUtil.cpp",
+    "webrtc_fuzzer_main.cc",
+  ]
+  deps = [
+    "..:field_trial",
+  ]
+}
+
+test("vp9_depacketizer_fuzzer") {
+  sources = [
+    "vp9_depacketizer_fuzzer.cc",
+  ]
+  deps = [
+    ":webrtcfuzzer_main",
+    "../../modules/rtp_rtcp/",

[kjellander_webrtc, 2015/11/19 15:23:06]

Remove leading slash.

[kjellander_webrtc, 2015/11/19 15:29:44]

*sigh* I meant trailing slash.

[pbos-webrtc, 2015/11/19 15:39:25]

Done.

+  ]
+
+  if (is_clang) {
+    # Suppress warnings from Chrome's Clang plugins.
+    # See http://code.google.com/p/webrtc/issues/detail?id=163 for details.
+    configs -= [ "//build/config/clang:find_bad_constructs" ]
+  }
+}