Commit Graph

665 Commits

Author SHA1 Message Date
Vitaly Buka
0a73805541 [libFuzzer] exit without running atexit handlers in libfuzzer's crash handler
Summary:
It's not safe to assume that atexit handlers can be run once the app crashed.

Patch by Jochen Eisinger.

Reviewers: kcc, vitalybuka

Subscribers: llvm-commits

Differential Revision: https://reviews.llvm.org/D32640

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@302076 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-03 20:31:19 +00:00
Duncan P. N. Exon Smith
acacdfca61 Fuzzer: Mark test/cxxstring.test UNSUPPORTED: windows
This has been mysteriously failing since r301593, which cleaned up the
types of things like size_t and SIZE_MAX for freestanding targets.  Reid
and Kostya suggested marking it as UNSUPPORTED on windows, given that no
one has been able to reproduce locally.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@301719 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-28 23:59:53 +00:00
Sanjoy Das
afd31bcedd Remove unnecessary semicolon
This shows up as a -Wpendatic error on GCC.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@301616 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-28 04:49:32 +00:00
Kuba Mracek
9204f8cf4a Fixup for r301054: Use an explicit constructor.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@301061 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-21 23:28:01 +00:00
Kuba Mracek
1d830459ca Fixup for r301054: Only use __attribute__((no_sanitize("memory"))) when it's available.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@301058 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-21 22:58:55 +00:00
Kuba Mracek
d0b815c06f [libFuzzer] Always build libFuzzer
There are two reasons why users might want to build libfuzzer:
- To fuzz LLVM itself
- To get the libFuzzer.a archive file, so that they can attach it to their code
This change always builds libfuzzer, and supports the second use case if the specified flag is set.

The point of this patch is to have something that can potentially be shipped with the compiler, and this also ensures that the version of libFuzzer is correct to use with that compiler.

Patch by George Karpenkov.

Differential Revision: https://reviews.llvm.org/D32096



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@301054 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-21 22:38:24 +00:00
Kuba Mracek
768a04e3df Fixup for r301007: Restrict the -D hack to Darwin.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@301017 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-21 18:19:56 +00:00
Kuba Mracek
05c05ab154 Revert r301010: Bot failures on Windows, NetBSD and even some old Darwin.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@301012 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-21 18:02:22 +00:00
Kuba Mracek
886373139e [libFuzzer] Always build libFuzzer
There are two reasons why users might want to build libfuzzer:
- To fuzz LLVM itself
- To get the libFuzzer.a archive file, so that they can attach it to their code
This change always builds libfuzzer, and supports the second use case if the specified flag is set.

The point of this patch is to have something that can potentially be shipped with the compiler, and this also ensures that the version of libFuzzer is correct to use with that compiler.

Patch by George Karpenkov.

Differential Revision: https://reviews.llvm.org/D32096



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@301010 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-21 17:47:44 +00:00
Kuba Mracek
68f048198a [libFuzzer] Changing thread_local to __thread in libFuzzer
Old Apple compilers do not support thread_local keyword. This patch adds -Dthread_local=__thread when the compiler doesn't support thread_local.

Differential Revision: https://reviews.llvm.org/D32312



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@301007 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-21 17:39:50 +00:00
Kuba Mracek
50c9a25c60 [libFuzzer] Check for target(popcnt) capability before usage
Older compilers (e.g. LLVM 3.4) do not support the attribute target("popcnt").
In order to support those, this diff check the attribute support using the preprocessor.

Patch by George Karpenkov.

Differential Revision: https://reviews.llvm.org/D32311



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300999 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-21 16:57:37 +00:00
Ahmed Bougacha
786ac2097e Revert "[libFuzzer] XFAIL fuzzer-oom.test on Darwin."
This reverts commit r300127.

r300759 implemented StopTheWorld for Darwin, so the test passes again.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300801 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-20 00:16:13 +00:00
Kostya Serebryany
7634af30c1 [libFuzzer] extend help for -minimize_crash to cover ASAN_OPTIONS=dedup_token_length=3
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300800 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-19 23:58:05 +00:00
Kuba Mracek
d92618f322 Revert r300789: There are Windows bot failures.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300794 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-19 23:44:33 +00:00
Kuba Mracek
d3e13b9862 [libFuzzer] Always build libFuzzer
There are two reasons why users might want to build libfuzzer:
- To fuzz LLVM itself
- To get the libFuzzer.a archive file, so that they can attach it to their code
This change always builds libfuzzer, and supports the second use case if the specified flag is set.

The point of this patch is to have something that can potentially be shipped with the compiler, and this also ensures that the version of libFuzzer is correct to use with that compiler.

Differential Revision: https://reviews.llvm.org/D32096



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300789 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-19 23:34:08 +00:00
Kostya Serebryany
47ba2c1622 [libFuzzer] remove -output_csv option. It duplicates the default output and got out of sync
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300768 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-19 21:34:58 +00:00
Kostya Serebryany
d4cfbc56b1 [libFuzzer] update -help: mention -exact_artifact_path in help for -minimize_crash and -cleanse_crash
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300642 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-19 01:22:04 +00:00
Kostya Serebryany
b662731542 [libFuzzer] experimental option -cleanse_crash: tries to replace all bytes in a crash reproducer with garbage, while still preserving the crash
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300498 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-17 20:58:21 +00:00
Akira Hatanaka
69dba78684 [libFuzzer] XFAIL fuzzer-oom.test on Darwin.
The test fails on Darwin because Fuzzer::DeathCallback (which calls
DumpCurrentUnit("crash-")) is called before DumpCurrentUnit("oom-") is
called in Fuzzer::RssLimitCallback. DeathCallback is transitively called
from __sanitizer_print_memory_profile.

This should fix the fuzzer bot that has been failing for a while:

http://lab.llvm.org:8080/green/job/libFuzzer/

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300127 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-12 23:15:10 +00:00
Vitaly Buka
f79a56c244 [libFuzzer] fix type in signal name.
Fixes PR32576.

Patch by Jakub Zawadzki.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299968 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-11 18:20:05 +00:00
Reid Kleckner
d6780ccb60 [Fuzzer] Flush std::cout before aborting in CxxStringEqTest
On Windows, abort() does not appear to flush std::cout. Should fix red
sanitizer-windows bot.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299398 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-03 23:00:25 +00:00
Kostya Serebryany
b6a531620b [libFuzzer] simplify the code a bit
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299180 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-31 04:17:45 +00:00
Kostya Serebryany
e857d23c61 [libFuzzer] tests: don't test 64-bit comparison on 32-bit builds
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299179 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-31 03:51:40 +00:00
Kostya Serebryany
15e73a64fc [libFuzzer] ensure that strncmp is not inlined in a test
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299177 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-31 03:34:33 +00:00
Kostya Serebryany
f43d588ee8 [libFuzzer] make sure we don't execute libFuzzer's mem* and str* hooks while calling mem*/str* inside libFuzzer itself
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299167 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-31 02:21:28 +00:00
Kostya Serebryany
e10396a06a [libFuzzer] try to fix value-profile-strncmp on the Mac bot
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299145 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-31 00:52:39 +00:00
Kostya Serebryany
5b2ce7b2d4 [libFuzzer] remove a stale flag from tests, run value-profile-strncmp.test longer (hopefully, will fix the OSX bot)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299051 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-30 04:22:20 +00:00
Kostya Serebryany
2d9dd043ff [libFuzzer] best effort support for -fsanitize-coverage=trace-pc instrumentation. It is less efficient and precise than -fsanitize-coverage=trace-pc-guard, but still works
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299046 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-30 01:27:20 +00:00
Juergen Ributzka
26cbef5f44 [libfuzzer] Remove XFAIL for OutOfMemory test.
This test is now passing on Darwin.

See rdar://problem/31282257.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298886 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-27 22:33:05 +00:00
Vitaly Buka
cc4a0d11e4 [libFuzzer] Fix test on Windows.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298757 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-25 01:19:45 +00:00
Kostya Serebryany
2061be0b30 [libFuzzer] read asan's dedup_token while minimizing a crash and stop minimization if another bug was found during minimization (https://github.com/google/oss-fuzz/issues/452)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298755 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-25 00:56:08 +00:00
Kostya Serebryany
e1646b6e51 [libFuzzer] be more careful when calling strlen of strcmp parameters, PR32357
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298746 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-24 22:19:52 +00:00
Kostya Serebryany
a149d64a7e [libFuzzer] honor -exact_artifact_path for all intermediate files during crash minimization (https://github.com/google/oss-fuzz/issues/250)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298740 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-24 21:09:16 +00:00
Kostya Serebryany
3519a8a96e [libFuzzer] split two tests to get more parallelism in test runs
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298673 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-24 00:51:18 +00:00
Kostya Serebryany
300f834d9e [libFuzzer] increase kFeatureSetSize to 2^21 and make InputCorpus scale to that size. This will potentially make libFuzzer more sensitive on targets with lots of signals
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298671 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-24 00:45:15 +00:00
Kostya Serebryany
ce68a403f2 [libFuzzer] fix non-linux build
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298666 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-23 23:48:47 +00:00
Kostya Serebryany
550e23d356 [libFuzzer] create experimental support for user-provided coverage signal
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298654 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-23 22:43:12 +00:00
Kostya Serebryany
5db3fb7fb6 [libFuzzer] add two experimental flags to make corpus merging more scalable: -save_coverage_summary/-load_coverage_summary. This is still WIP, the documentation will come later if these flags survive
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298548 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-22 20:32:44 +00:00
Kostya Serebryany
31c659fd54 [libFuzzer] inline the code of __sanitizer_cov_trace_pc_guard into it
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298032 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-17 01:45:15 +00:00
Kostya Serebryany
2362f32e0e [libFuzzer] Experimenting with dictionary minimization.
Summary:
Tracking issue: https://github.com/google/oss-fuzz/issues/331


Reviewers: kcc

Reviewed By: kcc

Differential Revision: https://reviews.llvm.org/D30940

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298031 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-17 01:40:09 +00:00
Kostya Serebryany
6ee36bcf11 [libFuzzer] add a test with two different bugs
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298030 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-17 01:33:16 +00:00
Kostya Serebryany
e79427160e [libFuzzer] add a dummy LLVMFuzzerMutate to afl/afl_driver.cpp (https://github.com/google/oss-fuzz/issues/460)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297919 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-15 23:54:40 +00:00
Kostya Serebryany
e6224abb77 [libFuzzer] call __sanitizer_print_memory_profile with two params
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297916 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-15 23:27:53 +00:00
Vitaly Buka
83daa29a86 Revert "[libFuzzer] Use ChooseUnitIdxToMutate to pick item for crossover."
Fails LLVMFuzzer.LLVMFuzzer.value-profile-strncmp.test.

This reverts commit r297891.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297912 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-15 23:08:18 +00:00
Vitaly Buka
e925a388a3 [libFuzzer] Use ChooseUnitIdxToMutate to pick item for crossover.
Differential Revision: https://reviews.llvm.org/D30683

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297891 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-15 20:59:27 +00:00
Kostya Serebryany
3785710791 [libFuzzer] remove even more stale code
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297797 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-15 00:39:06 +00:00
Kostya Serebryany
59249af18d [libFuzzer] simplify code a bit
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297796 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-15 00:34:25 +00:00
Kostya Serebryany
ae8f1d8b85 [libFuzzer] remove more stale code
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297785 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-14 21:47:52 +00:00
Kostya Serebryany
05628fa8ff [libFuzzer] don't clear Counters in TracePC::CollectFeatures since they will be cleared anyway in ResetMaps
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297783 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-14 21:40:53 +00:00
Kostya Serebryany
d18970b6b1 [libFuzzer] remove stale code
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297781 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-14 21:30:14 +00:00