Commit Graph

392 Commits

Author SHA1 Message Date
Kostya Serebryany
ec25365d1b [libFuzzer] add a standalone build script
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282321 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-24 04:00:00 +00:00
Kostya Serebryany
e2e54904b7 [libFuzzer] simplify HandleTrace again, start re-running interesting units and collecting their features.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282316 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 23:51:58 +00:00
Kostya Serebryany
b5dbd9f60f [libFuzzer] first steps in adding a proper automated test suite based on real-life code: add a script to build RE2 at a revision that has known bugs
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282292 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 20:43:22 +00:00
Kostya Serebryany
a6754db00d [libFuzzer] reset Counters (trace-pc-guard) before every run
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282284 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 20:04:13 +00:00
Kostya Serebryany
fd1fd77cb1 [libFuzzer] be more precise about what we reset in TracePC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282225 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 02:18:59 +00:00
Kostya Serebryany
07016d4bd5 [libFuzzer] fix merging with trace-pc-guard
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282224 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 01:58:51 +00:00
Kostya Serebryany
73508a3cb1 [libFuzzer] simplify the TracePC logic
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282222 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 01:20:07 +00:00
Kostya Serebryany
5a965a68f3 [libFuzzer] move value profiling logic into TracePC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282219 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 00:46:18 +00:00
Kostya Serebryany
28f017d845 [libFuzzer] change ValueBitMap to remember the number of bits in it
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282216 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-23 00:22:46 +00:00
Kostya Serebryany
43896df9dd [libFuzzer] simplify the crash minimizer; split MaxLen into two: MaxInputLen and MaxMutationLen, allow MaxMutationLen to be less than MaxInputLen
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282211 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-22 23:16:36 +00:00
Kostya Serebryany
e9b850b5c5 [libFuzzer] add 'features' to the corpus elements, allow mutations with Size > MaxSize, fix sha1 in corpus stats; various refactorings
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282129 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-22 01:34:58 +00:00
Kostya Serebryany
3f3f2cd606 [libFuzzer] one more test
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282127 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-22 00:57:29 +00:00
Kostya Serebryany
e4977b2b7e [libFuzzer] add stats to the corpus; more refactoring
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282121 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-21 22:42:17 +00:00
Kostya Serebryany
a6b3c30ea2 [libFuzzer] more refactoring; don't compute sha1sum every time we mutate a unit from the corpus, use the stored one.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282115 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-21 21:41:48 +00:00
Kostya Serebryany
e52f15bf1a [libFuzzer] more refactoring
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282113 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-21 21:17:23 +00:00
Kostya Serebryany
da9d4eb529 [libFuzzer] fix libc++ build
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282050 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-21 03:50:37 +00:00
Kostya Serebryany
77ab75a9d6 [libFuzzer] more refactoring; NFC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282047 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-21 02:05:39 +00:00
Kostya Serebryany
2a546868cb [libFuzzer] refactoring: split the large header into many; NFC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282044 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-21 01:50:50 +00:00
Kostya Serebryany
60dd435850 [libFuzzer] refactoring: move the Corpus into a separate class; delete two unused experimental features
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282042 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-21 01:04:43 +00:00
Kostya Serebryany
b3d4112198 [libFuzzer] use sleep() instead of std::this_thread::sleep_for to avoid coverage from instrumented libc++
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281933 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-19 20:32:34 +00:00
Kostya Serebryany
304a0b44f3 [libFuzzer] add -print_coverage=1 flag to print coverage directly from libFuzzer
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281866 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-18 21:47:08 +00:00
Kostya Serebryany
2bed90363f [libFuzzer] use 'if guard' instead of 'if guard >= 0' with trace-pc; change the guard type to intptr_t; use separate array for 8-bit counters
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281845 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-18 04:52:23 +00:00
Kostya Serebryany
338f974b6e [libFuzzer] properly reset the guards when reseting the coverage. Also try to fix check-fuzzer on the bot
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281814 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-17 06:01:55 +00:00
Kostya Serebryany
b9cc2c457f [libFuzzer] change trace-pc to use 8-byte guards
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281810 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-17 05:04:47 +00:00
Kostya Serebryany
dcc5ba2671 [libFuzzer] make caller-callee feedback work with trace-pc-guard
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281667 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-15 22:16:15 +00:00
Kostya Serebryany
d52d05173f [libFuzzer] fix the build for AFLDriverTest
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281633 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-15 18:10:38 +00:00
Kostya Serebryany
577674bc4f [libFuzzer] disable test that requires debug info -- it fails on the bot
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281584 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-15 05:46:58 +00:00
Kostya Serebryany
3f6d6753de [libFuzzer] move the AFL driver build rule test into the uninstrumented dir
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281583 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-15 05:17:39 +00:00
Kostya Serebryany
7e2d153c71 [libFuzzer] fix print_pcs test
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281580 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-15 04:43:06 +00:00
Kostya Serebryany
f0b5dd76ab [libFuzzer] implement print_pcs with trace-pc-guard. Change the trace-pc-guard heuristic for 8-bit counters to look more like in AFL (not that it's provable better, but the existin test preferes this heuristic)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281577 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-15 04:36:45 +00:00
Kostya Serebryany
26586a8660 [libFuzzer] add 8-bit counters to trace-pc-guard handler
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281568 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-15 01:30:18 +00:00
Kostya Serebryany
a4826c1b99 [libFuzzer] start using trace-pc-guard as an alternative source of coverage
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281435 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-14 02:13:06 +00:00
Kostya Serebryany
05082bd46a [libFuzzer] print a failed-merge warning only in the merge mode
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281130 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-10 02:17:22 +00:00
Kostya Serebryany
74ad0cfa1d [libFuzzer] don't print help for internal flags
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281124 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-10 00:35:30 +00:00
Kostya Serebryany
7942244fd1 [libFuzzer] print a visible message if merge fails due to a crash
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281122 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-10 00:15:41 +00:00
Kostya Serebryany
2c9e9a6439 [libFuzzer] use sizeof() in tests instead of 4 and 8
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281111 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-09 22:21:16 +00:00
Kostya Serebryany
fb49dafc05 [libFuzzer] one more puzzle for value profile
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281106 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-09 21:58:42 +00:00
Kostya Serebryany
9af2b5e4e4 [libFuzzer] one more puzzle, value_profile cracks it in a second
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281066 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-09 18:00:04 +00:00
Kostya Serebryany
4475d671c4 [libFuzzer] improve -print_pcs to not print new PCs coming from libFuzzer itself
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281016 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-09 02:38:28 +00:00
Kostya Serebryany
ddc2d44ce2 [libFuzzer] remove unneeded call
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281014 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-09 01:57:38 +00:00
Kostya Serebryany
05e1dea79e [libFuzzer] remove use_traces=1 since use_value_profile seems to be strictly better
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281007 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-09 01:17:03 +00:00
Kostya Serebryany
501485f6e4 [libFuzzer] add -minimize_crash flag (to minimize crashers). also add two tests that I failed to commit last time
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@280332 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-01 01:22:27 +00:00
Mike Aizatsky
d7a5ad2193 [libfuzzer] simplified unit truncation; do not write trunc items to disc
Differential Revision: https://reviews.llvm.org/D24049

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@280153 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-30 20:49:07 +00:00
Kostya Serebryany
72187d4993 [libFuzzer] fix a bug when running a single unit of N bytes with -max_len=M, M<N, caused a buffer overflow
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@280098 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-30 14:52:05 +00:00
Kostya Serebryany
773652b49c [libFuzzer] stop using bits for memcmp's value profile -- seems to blow up the corpus too much
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@280096 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-30 14:39:33 +00:00
Kostya Serebryany
c7c6f45c22 [libFuzzer] use bits instead of bytes for memcmp/strcmp value profile -- the fuzzer reaches the goal much faster, at least on the simple puzzles
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@280054 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-30 03:05:50 +00:00
Kostya Serebryany
ff612bcd8e [libFuzzer] use trace-div and trace-gep for guided fuzzing, add tests
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@280046 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-30 01:30:14 +00:00
Kostya Serebryany
be74ea271b [libFuzzer] simplify a test to make it pass on the bot
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@279796 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-26 00:18:16 +00:00
Kostya Serebryany
cf34910507 [libFuzzer] make sure we have symbols on fuzzer tests
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@279792 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-25 23:30:02 +00:00
Kostya Serebryany
7750b380af [libFizzer] rename -print_new_cov_pcs=1 into -print_pcs=1 and make it more useful: print PCs only after the initial corpus has been read and symbolize them
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@279787 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-25 22:35:08 +00:00