Commit Graph

25 Commits

Author SHA1 Message Date
Kostya Serebryany
ae0620c4e9 [sanitizer/coverage] Add AFL-style coverage counters (search heuristic for fuzzing).
Introduce -mllvm -sanitizer-coverage-8bit-counters=1
which adds imprecise thread-unfriendly 8-bit coverage counters.

The run-time library maps these 8-bit counters to 8-bit bitsets in the same way
AFL (http://lcamtuf.coredump.cx/afl/technical_details.txt) does:
counter values are divided into 8 ranges and based on the counter
value one of the bits in the bitset is set.
The AFL ranges are used here: 1, 2, 3, 4-7, 8-15, 16-31, 32-127, 128+.

These counters provide a search heuristic for single-threaded
coverage-guided fuzzers, we do not expect them to be useful for other purposes.

Depending on the value of -fsanitize-coverage=[123] flag,
these counters will be added to the function entry blocks (=1),
every basic block (=2), or every edge (=3).

Use these counters as an optional search heuristic in the Fuzzer library.
Add a test where this heuristic is critical.


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231166 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-03 23:27:02 +00:00
Kostya Serebryany
f7c1020041 [fuzzer] one more experimental search mode: -use_coverage_pairs=1
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@229957 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-20 03:02:37 +00:00
Kostya Serebryany
ce7a848558 [fuzzer] split main() into FuzzerDriver() that takes a callback as a parameter and a tiny main() in a separate file
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@229882 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-19 18:45:37 +00:00
Kostya Serebryany
0b1ec08b77 [fuzzer] properly annotate fallthrough, add one more entry to FAQ
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@229880 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-19 18:21:12 +00:00
Kostya Serebryany
9b13b8c338 [fuzzer] move default sanitizer options to a separate file
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228429 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-06 19:52:07 +00:00
Kostya Serebryany
5d85a10810 [fuzzer] add flag prefer_small_during_initial_shuffle, be a bit more verbose
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228235 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-04 23:42:42 +00:00
Kostya Serebryany
46c638cfc8 [fuzzer] add -runs=N to limit the number of runs per session. Also, make sure we do some mutations w/o cross over.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228214 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-04 22:20:09 +00:00
Kostya Serebryany
eb884daa38 [fuzzer] make multi-process execution more verbose; fix mutation to actually respect mutation depth and to never produce empty units
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228170 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-04 19:10:20 +00:00
Kostya Serebryany
8fa9947e4d [fuzzer]: fix exit code, add more diagnostics
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228103 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-04 01:22:57 +00:00
Kostya Serebryany
04e540582b [fuzzer] Add proper dependensices to the fuzzer tests
Summary: Make sure that FileCheck is built when running check-fuzzer

Test Plan:
run on bot:
lab.llvm.org:8011/builders/sanitizer-x86_64-linux-fuzzer

Reviewers: samsonov

Reviewed By: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7387

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228045 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-03 21:57:32 +00:00
Kostya Serebryany
32a12b924e [fuzzer] update the include line to use the new header name
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228018 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-03 19:42:05 +00:00
Kostya Serebryany
a1667be228 [fuzzer] add flags to run fuzzer in multiple parallel processes
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227664 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-31 01:14:40 +00:00
Kostya Serebryany
05efde62f5 [fuzzer] Add a gtest-style test
Summary: Add one gtest-style test.

Test Plan: run on bot

Reviewers: samsonov

Reviewed By: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7287

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227639 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-30 23:26:57 +00:00
Kostya Serebryany
4ac4c33f2d [fuzzer] add -use_full_coverage_set=1 which solves FullCoverageSetTest. This does not scale very well yet, but might be a good start.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227507 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-29 23:01:07 +00:00
Kostya Serebryany
df31d7bea7 [fuzzer] fix warning in a test
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227478 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-29 18:13:36 +00:00
Kostya Serebryany
c8f69d069e [fuzzer] minor cleanup based on reviews: remove redundant includes, fix a copy-pasto in tests
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227468 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-29 17:16:23 +00:00
Kostya Serebryany
a51685f651 [fuzzer] add FAQ section to the README.txt
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227466 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-29 17:11:30 +00:00
Aaron Ballman
94879c0134 Reverting r227452, which adds back the fuzzer library. Now excluding the fuzzer library based on LLVM_USE_SANITIZE_COVERAGE being set or unset.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227464 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-29 16:58:29 +00:00
Aaron Ballman
f316f2ea52 Temporarily reverting the fuzzer library as it causes too many build issues for MSVC users. This reverts: 227445, 227395, 227389, 227357, 227254, 227252
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227452 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-29 15:49:22 +00:00
Aaron Ballman
c77764d5a4 Adding missing #includes to try to get this to compile on Windows with Visual Studio.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227445 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-29 15:19:13 +00:00
Kostya Serebryany
1f3043175c [fuzzer] add option -save_minimized_corpus
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227395 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-28 23:48:39 +00:00
Kostya Serebryany
408796c672 Add lit-style tests for the Fuzzer library
Summary: Add test targets and the lit-style runner.

Test Plan: Run the tests on bot.

Reviewers: samsonov

Reviewed By: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7217

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227389 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-28 22:49:25 +00:00
Kostya Serebryany
b0f9090173 [fuzzer] instructions for building/running clang-format-fuzzer
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227357 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-28 19:51:58 +00:00
Kostya Serebryany
556d1a3b80 [fuzzer] properly enable asan's coverage feedback
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227254 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-27 22:19:55 +00:00
Kostya Serebryany
c9baf3befb Add a Fuzzer library
Summary:
A simple genetic in-process coverage-guided fuzz testing library.

I've used this fuzzer to test clang-format
(it found 12+ bugs, thanks djasper@ for the fixes!)
and it may also help us test other parts of LLVM.
So why not keep it in the LLVM repository?

I plan to add the cmake build rules later (in a separate patch, if that's ok)
and also add a clang-format-fuzzer target.

See README.txt for details.

Test Plan: Tests will follow separately.

Reviewers: djasper, chandlerc, rnk

Reviewed By: rnk

Subscribers: majnemer, ygribov, dblaikie, llvm-commits

Differential Revision: http://reviews.llvm.org/D7184

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227252 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-27 22:08:41 +00:00