| # Fuzzilli x Chrome | |
| This experimental driver integrates Fuzzilli with Chrome for fuzz testing. It | |
| is currently under active development, so some functionalities may not behave | |
| as expected. | |
| # How to use this driver? | |
| ## Pre-requisite | |
| To use this driver, your fuzzer must: | |
| - Take JS as input. | |
| - Return `-1` from the fuzzing function if JS throws an exception. Return `0` | |
| otherwise. | |
| You must also build [Fuzzilli](https://github.com/googleprojectzero/fuzzilli). | |
| See Fuzzilli documentation. | |
| ## Mandatory compile flags | |
| Ensure the following build flags are enabled when compiling Chrome: | |
| ``` | |
| dcheck_always_on = false | |
| is_asan = true | |
| use_chromium_fuzzilli = true | |
| use_remoteexec=true | |
| symbol_level=2 | |
| v8_fuzzilli = true | |
| v8_static_library = true | |
| v8_dcheck_always_on = true | |
| ``` | |
| ## Running with Fuzzilli | |
| ``` | |
| swift run -c release FuzzilliCli --storagePath=/path/to/tmp/storage --profile=your_profile --jobs=1 /out/fuzzilli/your_fuzzer | |
| ``` |