Commit Graph

47 Commits

Author SHA1 Message Date
Kostya Serebryany
ae8f1d8b85 [libFuzzer] remove more stale code
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297785 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-14 21:47:52 +00:00
Kostya Serebryany
05628fa8ff [libFuzzer] don't clear Counters in TracePC::CollectFeatures since they will be cleared anyway in ResetMaps
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297783 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-14 21:40:53 +00:00
Kostya Serebryany
5459106ddf [libFuzzer] reorganize the tracing code to make it easier to experiment with inlined coverage instrumentation. NFC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293928 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-02 19:56:01 +00:00
Kostya Serebryany
49c910dae1 [libFuzzer] simplify the value profiling callback further: don't use (idx MOD prime) on the hot path where it is useless anyway
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293239 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-27 00:39:12 +00:00
Kostya Serebryany
bcc64b878f [libFuzzer] simplify the value profile code and disable asan/msan on it
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293236 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-27 00:09:59 +00:00
Kostya Serebryany
c43e0682f2 [libFuzzer] further simplify __sanitizer_cov_trace_pc_guard
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293128 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-26 01:34:58 +00:00
Mike Aizatsky
56992074d3 [libfuzzer] fixing collected pc addresses for coverage
Summary: The causes google/ossfuzz#84

Reviewers: kcc

Subscribers: mgorny

Differential Revision: https://reviews.llvm.org/D28827

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292289 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-17 23:11:32 +00:00
Kostya Serebryany
db5325aae3 [libFuzzer] use table of recent compares for memcmp/strcmp (to unify the code between cmp and memcmp handling)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292287 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-17 23:09:05 +00:00
Kostya Serebryany
f178652c93 [libFuzzer] cleaner implementation of -print_pcs=1
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290739 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-30 01:13:07 +00:00
Mike Aizatsky
d576930959 [libfuzzer] dump_coverage command line flag
Reviewers: kcc, vitalybuka

Differential Revision: https://reviews.llvm.org/D27942

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290138 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-19 22:18:08 +00:00
Kostya Serebryany
fdff3a8925 [libFuzzer] when tracing switch statements, handle only one case at a time (to make things faster). Also ensure that the signals from value profile do not intersect with the regular coverage
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290031 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-17 02:03:34 +00:00
Kostya Serebryany
57d813c8da [libFuzzer] fix an UB (invalid shift) spotted by ubsan. The code worked fine by luck, because the way shifts actually work on clang+x86
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289607 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-13 22:49:14 +00:00
Marcos Pividori
f51c50474c [libFuzzer] Clean up headers and file formatting of LibFuzzer files.
Reorganize #includes to follow LLVM Coding Standards.
Include some missing headers. Required to use `Printf()`.

Aside from that, this patch contains no functional change.
It is purely a re-organization.

Differential Revision: https://reviews.llvm.org/D27363

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289560 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-13 17:46:11 +00:00
Kostya Serebryany
fe3cc4d2c5 [libFuzzer] refactor the code to allow collecting features in different ways. Also initialize a couple of Fuzzer:: members that might have been used uninitialized :(
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@288731 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-05 23:35:22 +00:00
Kostya Serebryany
04777c43f9 [libFuzzer] do not initialize parts of TracePC -- let them be initialized by the linker. Add no-msan attribute to the memcmp hook.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@286665 91177308-0d34-0410-b5e6-96231b3b80d8
2016-11-11 23:06:53 +00:00
Kostya Serebryany
56a90b623f [libFuzzer] speculatively trying to fix the Mac build; second attempt
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285262 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-27 00:36:38 +00:00
Kostya Serebryany
9df8914246 [libFuzzer] revert 285259 -- hit commit too soon
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285260 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-27 00:24:34 +00:00
Kostya Serebryany
06289376f7 [libFuzzer] speculatively trying to fix the Mac build
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285259 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-27 00:22:39 +00:00
Kostya Serebryany
3c0deb17ec [libFuzzer] simplify TracePC::HandleTrace even further. Also, when dealing with -exit_on_src_pos, symbolize every PC only once
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285223 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-26 18:52:04 +00:00
Kostya Serebryany
7f59a4b62d [libFuzzer] simplify the code in TracePC::HandleTrace a bit more
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285147 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-26 00:42:52 +00:00
Kostya Serebryany
9c904557f1 [libFuzzer] simplify the code to print new PCs
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285145 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-26 00:20:51 +00:00
Kostya Serebryany
cbe5db8703 [libFuzzer] simplify the code in TracePC::HandleTrace
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285142 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-25 23:52:25 +00:00
Kostya Serebryany
d2c91bff2f [libFuzzer] simplify the code for use_cmp, also use the position hint when available, add a test
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285049 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-25 02:04:43 +00:00
Kostya Serebryany
3af68729f8 [libFuzzer] add -trace_cmp=1 (guiding mutations based on the observed CMP instructions). This is a reincarnation of the previously deleted -use_traces, but using a different approach for collecting traces. Still a toy, but at least it scales well. Also fix -merge in trace-pc-guard mode
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@284273 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-14 20:20:33 +00:00
Kostya Serebryany
53176d2749 [libFuzzer] reapply r283946: refactoring to speed things up, NFC. Now with a fix for gcc build
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@284132 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-13 16:19:09 +00:00
Daniel Jasper
6f0cfa7ab9 Revert "[libFuzzer] refactoring to speed things up, NFC"
This reverts commit r283946.

This breaks when build with GCC:
lib/Fuzzer/FuzzerTracePC.cpp:169:6: error: always_inline function might not be inlinable [-Werror=attributes]
lib/Fuzzer/FuzzerTracePC.cpp:169:6: error: inlining failed in call to always_inline 'void fuzzer::TracePC::HandleCmp(void*, T, T) [with T = long unsigned int]': target specific option mismatch
lib/Fuzzer/FuzzerTracePC.cpp:198:65: error: called from here

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@283979 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-12 07:26:46 +00:00
Kostya Serebryany
61ec54d21d [libFuzzer] refactoring to speed things up, NFC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@283946 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-11 21:27:37 +00:00
Kostya Serebryany
bb0318af25 [libFuzzer] implement value profile for switch, increase the size of the PCs array, make sure we don't overflow it
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@283841 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-11 01:14:41 +00:00
Kostya Serebryany
cc6cbfdebc [libFuzzer] refactoring to make -shrink=1 work for value profile, added a test.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@283409 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-05 22:56:21 +00:00
Kostya Serebryany
d4d50f6f47 [libFuzzer] add ShrinkValueProfileTest, move code around, NFC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@283286 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-05 01:09:40 +00:00
Kostya Serebryany
f46303af79 [libFuzzer] implement the -shrink=1 option that tires to make elements of the corpus smaller, off by default
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282995 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-01 01:04:29 +00:00
Kostya Serebryany
ec49d2d369 [libFuzzer] more the feature set to InputCorpus; on feature update, change the feature counter of the old best input
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282829 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-30 01:19:56 +00:00
Kostya Serebryany
efa54824a3 [sanitizer-coverage/libFuzzer] make the guards for trace-pc 32-bit; create one array of guards per function, instead of one guard per BB. reorganize the code so that trace-pc-guard does not create unneeded globals
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282735 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-29 17:43:24 +00:00
Kostya Serebryany
d3cf92ddf9 [libFuzzer] speedup TracePC::FinalizeTrace
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282562 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-28 01:16:24 +00:00
Kostya Serebryany
65f502816c [libFuzzer] add -exit_on_src_pos to test libFuzzer itself, add a test script for RE2 that uses this flag
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282458 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-27 00:10:20 +00:00
Kostya Serebryany
e2e54904b7 [libFuzzer] simplify HandleTrace again, start re-running interesting units and collecting their features.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282316 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 23:51:58 +00:00
Kostya Serebryany
a6754db00d [libFuzzer] reset Counters (trace-pc-guard) before every run
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282284 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 20:04:13 +00:00
Kostya Serebryany
fd1fd77cb1 [libFuzzer] be more precise about what we reset in TracePC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282225 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 02:18:59 +00:00
Kostya Serebryany
07016d4bd5 [libFuzzer] fix merging with trace-pc-guard
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282224 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 01:58:51 +00:00
Kostya Serebryany
73508a3cb1 [libFuzzer] simplify the TracePC logic
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282222 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 01:20:07 +00:00
Kostya Serebryany
5a965a68f3 [libFuzzer] move value profiling logic into TracePC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282219 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 00:46:18 +00:00
Kostya Serebryany
28f017d845 [libFuzzer] change ValueBitMap to remember the number of bits in it
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282216 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 00:22:46 +00:00
Kostya Serebryany
e9b850b5c5 [libFuzzer] add 'features' to the corpus elements, allow mutations with Size > MaxSize, fix sha1 in corpus stats; various refactorings
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282129 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-22 01:34:58 +00:00
Kostya Serebryany
e52f15bf1a [libFuzzer] more refactoring
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282113 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-21 21:17:23 +00:00
Kostya Serebryany
2a546868cb [libFuzzer] refactoring: split the large header into many; NFC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282044 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-21 01:50:50 +00:00
Kostya Serebryany
b4d6119096 [libFuzzer] refactoring around PCMap, NFC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@278825 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-16 17:37:13 +00:00
Mike Aizatsky
0d68393b0f [libfuzzer] Refactoring coverage state-management code.
It is now less state-dependent and will allow easier comparing of
coverages of different units.

Differential Revision: http://reviews.llvm.org/D20085

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@269140 91177308-0d34-0410-b5e6-96231b3b80d8
2016-05-10 23:43:15 +00:00