RPCSX/llvm
1
0
Fork 0
mirror of https://github.com/RPCSX/llvm.git synced 2024-12-28 15:33:14 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
138,504 Commits 27 Branches 0 Tags 473 MiB
60dd435850
Commit Graph

144 Commits

Author SHA1 Message Date
Kostya Serebryany
60dd435850 [libFuzzer] refactoring: move the Corpus into a separate class; delete two unused experimental features 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282042 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-21 01:04:43 +00:00
Kostya Serebryany
304a0b44f3 [libFuzzer] add -print_coverage=1 flag to print coverage directly from libFuzzer 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281866 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-18 21:47:08 +00:00
Kostya Serebryany
2bed90363f [libFuzzer] use 'if guard' instead of 'if guard >= 0' with trace-pc; change the guard type to intptr_t; use separate array for 8-bit counters 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281845 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-18 04:52:23 +00:00
Kostya Serebryany
338f974b6e [libFuzzer] properly reset the guards when reseting the coverage. Also try to fix check-fuzzer on the bot 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281814 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-17 06:01:55 +00:00
Kostya Serebryany
b9cc2c457f [libFuzzer] change trace-pc to use 8-byte guards 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281810 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-17 05:04:47 +00:00
Kostya Serebryany
dcc5ba2671 [libFuzzer] make caller-callee feedback work with trace-pc-guard 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281667 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-15 22:16:15 +00:00
Kostya Serebryany
f0b5dd76ab [libFuzzer] implement print_pcs with trace-pc-guard. Change the trace-pc-guard heuristic for 8-bit counters to look more like in AFL (not that it's provable better, but the existin test preferes this heuristic) 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281577 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-15 04:36:45 +00:00
Kostya Serebryany
26586a8660 [libFuzzer] add 8-bit counters to trace-pc-guard handler 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281568 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-15 01:30:18 +00:00
Kostya Serebryany
a4826c1b99 [libFuzzer] start using trace-pc-guard as an alternative source of coverage 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281435 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-14 02:13:06 +00:00
Kostya Serebryany
7942244fd1 [libFuzzer] print a visible message if merge fails due to a crash 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281122 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-10 00:15:41 +00:00
Kostya Serebryany
4475d671c4 [libFuzzer] improve -print_pcs to not print new PCs coming from libFuzzer itself 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281016 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-09 02:38:28 +00:00
Kostya Serebryany
ddc2d44ce2 [libFuzzer] remove unneeded call 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281014 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-09 01:57:38 +00:00
Kostya Serebryany
05e1dea79e [libFuzzer] remove use_traces=1 since use_value_profile seems to be strictly better 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281007 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-09 01:17:03 +00:00
Kostya Serebryany
7750b380af [libFizzer] rename -print_new_cov_pcs=1 into -print_pcs=1 and make it more useful: print PCs only after the initial corpus has been read and symbolize them 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@279787 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-25 22:35:08 +00:00
Kostya Serebryany
cf1269a0b2 [libFuzzer] simplify the code, NFC 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@279697 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-25 01:25:03 +00:00
Kostya Serebryany
0c7940eaf1 [libFuzzer] use __attribute__((target("popcnt"))) only on x86_64 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@279601 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-24 01:38:42 +00:00
Kostya Serebryany
9744bb48e4 [libFuzzer] one more mutation: ChangeBinaryInteger; also fix the breakage from r278970 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@278982 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-17 21:30:30 +00:00
Kostya Serebryany
7526feb22f [libFuzzer] when printing the reproducer input, also print the base input and the mutation sequence 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@278975 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-17 20:45:23 +00:00
Kostya Serebryany
79d100891f [libFuzzer] more mutations 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@278950 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-17 18:10:42 +00:00
Kostya Serebryany
2e1aa9cd1c [libFuzzer] new experimental feature: value profiling. Profiles values that affect control flow and treats new values as new coverage. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@278839 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-16 19:33:51 +00:00
Kostya Serebryany
b4d6119096 [libFuzzer] refactoring around PCMap, NFC 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@278825 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-16 17:37:13 +00:00
Kostya Serebryany
137c3957ed [libFuzzer] add InsertRepeatedBytes and EraseBytes. 
New mutation: InsertRepeatedBytes.
Updated mutation: EraseByte => EraseBytes.

This helps https://github.com/google/sanitizers/issues/710
where libFuzzer was not able to find a known bug.
Now it finds it in minutes.

Hopefully, the change is general enough to help other targets.



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@278687 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-15 17:48:28 +00:00
Mike Aizatsky
4613003000 [sanitizers] trace buffer API to use user-allocated buffer. 
Differential Revision: https://reviews.llvm.org/D23185

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@277859 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-05 20:09:53 +00:00
Kostya Serebryany
730992dc3b [libFuzzer] add hooks for strstr, strcasestr, strcasecmp, strncasecmp 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@275648 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-07-15 23:27:19 +00:00
Mike Aizatsky
8bbe924637 [libfuzzer] moving is_ascii handler inside mutation dispatcher. 
Summary: It also fixes a bug, when first random might not be ascii.

Differential Revision: http://reviews.llvm.org/D21573

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@273611 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-06-23 20:44:48 +00:00
Dan Liew
1a1c8bea2d [LibFuzzer] Declare and use sanitizer functions in `fuzzer::ExternalFunctions` 
This fixes linking problems on OSX.

Unfortunately it turns out we need to use an instance of the
``fuzzer::ExternalFunctions`` object in several places so this
commit also replaces all instances with a single global instance.

It also turns out initializing a global ``fuzzer::ExternalFunctions``
before main is entered (i.e. letting the object be initialised by the
global initializers) is not safe (on OSX the call to ``Printf()`` in the
CTOR crashes if it is called from a global initializer) so we instead
have a global ``fuzzer::ExternalFunctions*`` and initialize it inside
``FuzzerDriver()``.

Multiple unit tests depend also depend on the
``fuzzer::ExternalFunctions*`` global so a ``main()`` function has been
added that initializes it before running any tests.

Differential Revision: http://reviews.llvm.org/D20943

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@272072 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-06-07 23:32:50 +00:00
Mike Aizatsky
b1953d8c1b [libfuzzer] custom crossover interface function. 
Differential Revision: http://reviews.llvm.org/D21089

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@272054 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-06-07 20:22:15 +00:00
Mike Aizatsky
c7f790d744 [libfuzzer] prune_corpus option for disabling pruning during the load. 
Summary:
The option is very useful for testing, plus I intend to measure
its effect on fuzzer effectiveness.

Differential Revision: http://reviews.llvm.org/D21084

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@272035 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-06-07 18:16:32 +00:00
Mike Aizatsky
664513feca [libfuzzer] hiding custom mutator handling in MutationDispatcher. 
Summary: Refactoring, no functional changes.

Differential Revision: http://reviews.llvm.org/D20975

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@271740 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-06-03 21:34:29 +00:00
Dan Liew
8bb56ccbc0 [LibFuzzer] Reimplement how the optional user functions are called. 
The motivation for this change is to fix linking issues on OSX.
However this only partially fixes linking issues (the uninstrumented
tests and a few others  won't succesfully link yet).

This change introduces a struct of function pointers
(``fuzzer::ExternalFuntions``) which when initialised will point to the
optional functions if they are available.  Currently these
``LLVMFuzzerInitialize`` and ``LLVMFuzzerCustomMutator`` functions.

Two implementations of ``fuzzer::ExternalFunctions`` constructor are
provided one for Linux and one for OSX.

The OSX implementation uses ``dlsym()`` because the prior implementation
using weak symbols does not work unless the additional flags are passed
to the linker.

The Linux implementation continues to use weak symbols because the
``dlsym()`` approach does not work unless additional flags are passed
to the linker.

Differential Revision: http://reviews.llvm.org/D20741

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@271491 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-06-02 05:48:02 +00:00
Kostya Serebryany
6effb7148b [libFuzzer] make OOM-handling more portable. Instead of sending a signal to the main fuzzing thread, print the message in the getrusage thread and exit. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@270945 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-05-27 00:54:15 +00:00
Kostya Serebryany
d59f71d0d3 [libFuzzer] more refactoring: make sure CurrentUnitData is awlays a valid pointer to read from 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@270942 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-05-27 00:21:33 +00:00
Kostya Serebryany
b987d27af9 [libFuzzer] more refactoring around CurrentUnit. Also add a threading test on which we currently have a race (when reporting bugs from multiple threads) 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@270929 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-05-26 22:17:32 +00:00
Kostya Serebryany
1c5d1efdb3 [libFuzzer] refactor: hide CurrentUnitData inside an interface function. NFC 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@270922 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-05-26 21:32:30 +00:00
Kostya Serebryany
ddaf22d2ba [libFuzzer] when there is a leak in the existing corpus report the reproducer properly 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@270905 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-05-26 20:25:49 +00:00
Kostya Serebryany
34fca4b9ec [libFuzzer] reimplement the way we do -only_ascii to allow more 'const' in function declarations. Add a test for -only_ascii. NFC intended 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@270900 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-05-26 20:03:02 +00:00
Mike Aizatsky
b0d0618635 [libfuzzer] Trying random unit prefixes during corpus load. 
Differential Revision: http://reviews.llvm.org/D20301

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@270632 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-05-24 23:14:29 +00:00
Dan Liew
86af2862c5 [LibFuzzer] 
Work around crashes in ``__sanitizer_malloc_hook()`` under Mac OSX.

Under Mac OSX we intercept calls to malloc before thread local
storage is initialised leading to a crash when accessing
``AllocTracer``. To workaround this ``AllocTracer`` is only accessed
in the hook under Linux. For symmetry ``__sanitizer_free_hook()``
is also modified in the same way.

To support this change a set of new macros
LIBFUZZER_LINUX and LIBFUZZER_APPLE has been defined which can be
used to check the target being compiled for.

Differential Revision: http://reviews.llvm.org/D20402

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@270145 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-05-19 22:00:33 +00:00
Kostya Serebryany
22dd3bbcf0 [libFuzzer] simplify FuzzerInterface.h 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@269448 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-05-13 18:04:35 +00:00
Mike Aizatsky
0d68393b0f [libfuzzer] Refactoring coverage state-management code. 
It is now less state-dependent and will allow easier comparing of
coverages of different units.

Differential Revision: http://reviews.llvm.org/D20085

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@269140 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-05-10 23:43:15 +00:00
Kostya Serebryany
f01dfdd8aa [libFuzzer] enhance -rss_limit_mb and enable by default. Now it will print the OOM reproducer. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@268821 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-05-06 23:38:07 +00:00
Kostya Serebryany
815a884f59 [libFuzzer] add exeprimental -rss_limit_mb flag to fight against OOMs 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@268807 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-05-06 21:58:35 +00:00
Kostya Serebryany
18c0216842 [libFuzzer] print stats after running individual inputs 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@268547 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-05-04 20:44:50 +00:00
Kostya Serebryany
168e51186d [libFuzzer] enable detect_leaks=1, add proper docs 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@268088 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-04-29 18:49:55 +00:00
Kostya Serebryany
30f53168fa [libFuzzer] disable leak detection if we have tried it for 1000 times w/o finding a leak 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@267770 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-04-27 19:52:34 +00:00
Kostya Serebryany
cb05ff9241 [libFuzzer] remove dead code 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@267455 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-04-25 19:41:45 +00:00
Kostya Serebryany
a0a13e0ee1 [libFuzzer] added -detect_leaks flag (0 by default for now). When enabled, it will help finding leaks while fuzzing 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@266838 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-04-20 00:24:21 +00:00
Kostya Serebryany
d3f038dc3e [libFuzzer] try to print correct time in seconds when reporting a timeout. Don't report timeouts while still loading the corpus. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@266693 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-04-18 22:50:39 +00:00
Kostya Serebryany
d32f138d30 [libFuzzer] handle SIGTERM 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@264338 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-03-24 21:03:58 +00:00
Kostya Serebryany
4aa62c5d17 [libFuzzer] add a flag close_fd_mask so that we can silence spammy targets by closing stderr/stdout 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@263831 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-03-18 20:58:29 +00:00