66 Commits

Author SHA1 Message Date
Mike Aizatsky
a9c2387192 output_csv libfuzzer option
Summary:
The option outputs statistics in CSV format preceded by 1 header line.
This is intended for machine processing of the output.
-verbosity=0 should likely be set.

Differential Revision: http://reviews.llvm.org/D14600

llvm-svn: 252856
2015-11-12 04:38:40 +00:00
Kostya Serebryany
dc3135db05 [libFuzzer] experimental flag -drill (another search heuristic; Mike Aizatsky's idea)
llvm-svn: 252838
2015-11-12 01:02:01 +00:00
Kostya Serebryany
5eab74e9bc [libFuzzer] make libFuzzer link if there is no sanitizer coverage instrumentation (it will fail at start-up time)
llvm-svn: 252533
2015-11-09 23:17:45 +00:00
Kostya Serebryany
b8d0da1386 [libFuzzer] print a bit fewer lines
llvm-svn: 252123
2015-11-05 01:19:42 +00:00
Kostya Serebryany
e692621a9d [libFuzzer] when choosing the next unit to mutate, give some preference to the most recent units (they are more likely to be interesting)
llvm-svn: 252097
2015-11-04 23:22:25 +00:00
Kostya Serebryany
9cc3b0ddb6 [libFuzzer] add -merge flag to merge corpora
llvm-svn: 251168
2015-10-24 01:16:40 +00:00
Kostya Serebryany
94660b3c36 [libFuzzer] remove some old code; also make __sanitizer_get_total_unique_caller_callee_pairs weak so that newer libFuzzer works with older asan
llvm-svn: 251133
2015-10-23 18:37:58 +00:00
Kostya Serebryany
2e9fca9f88 [libFuzzer] use the indirect caller-callee counter as an independent search heuristic
llvm-svn: 251078
2015-10-22 23:55:39 +00:00
Kostya Serebryany
09d2a5f6e1 [libFuzzer] more refactoring the code that checks the coverage. NFC
llvm-svn: 251075
2015-10-22 22:56:45 +00:00
Kostya Serebryany
007c9b25f4 [libFuzzer] refactoring the code that checks the coverage. NFC
llvm-svn: 251074
2015-10-22 22:50:47 +00:00
Kostya Serebryany
b36025619c [libFuzzer] remove the deprecated 'tokens' feature
llvm-svn: 251069
2015-10-22 21:48:09 +00:00
Kostya Serebryany
fed509e73d [libFuzzer] add -shuffle flag
llvm-svn: 250603
2015-10-17 04:38:26 +00:00
Kostya Serebryany
d6edce97fb [libFuzzer] print a stack trace on timeout
llvm-svn: 250571
2015-10-16 23:04:31 +00:00
Kostya Serebryany
a9da9b48ef [libFuzzer] reduce the size of artifacts printed on the screen
llvm-svn: 250565
2015-10-16 22:47:20 +00:00
Kostya Serebryany
b91c62b1f3 [libFuzzer] When -test_single_input crashes the test it is not necessary to write crash-file because input is already known to the user. Patch by Mike Aizatsky
llvm-svn: 250564
2015-10-16 22:41:47 +00:00
Kostya Serebryany
e95022ac14 [libFuzzer] don't print large artifacts to stderr
llvm-svn: 249808
2015-10-09 04:03:14 +00:00
Kostya Serebryany
bd5d1cdbb9 [libFuzzer] add -artifact_prefix flag
llvm-svn: 249807
2015-10-09 03:57:59 +00:00
Kostya Serebryany
20bb5e71b2 [libFuzzer] make LLVMFuzzerTestOneInput (the fuzzer target function) return int instead of void. The actual return value is not *yet* used (and expected to be 0). This change is API breaking, so the fuzzers will need to be updated.
llvm-svn: 249214
2015-10-02 23:34:06 +00:00
Kostya Serebryany
65d0a1458f [libFuzzer] remove experimental flag and functionality
llvm-svn: 249194
2015-10-02 22:00:32 +00:00
Kostya Serebryany
b85db178a0 [libFuzzer] add a flag -max_total_time
llvm-svn: 249181
2015-10-02 20:47:55 +00:00
Kostya Serebryany
dd02f1f8ab [libFuzzer] perform fewer crossover operations compared to plain mutations
llvm-svn: 247364
2015-09-11 00:20:58 +00:00
Kostya Serebryany
468ed78434 [libFuzzer] remove -iterations as redundant (there is also -num_runs)
llvm-svn: 247030
2015-09-08 17:30:35 +00:00
Kostya Serebryany
7d21166218 [libFuzzer] actually make the dictionaries work (+docs)
llvm-svn: 246825
2015-09-04 00:12:11 +00:00
Kostya Serebryany
a9346c2e65 [libFuzzer] honour -only_ascii=1 when reading the initial corpus. Also, remove ugly #ifdef
llvm-svn: 246689
2015-09-02 19:08:08 +00:00
Kostya Serebryany
12c7837381 [libFuzzer] add two flags, -tbm_depth and -tbm_width to control how the trace-based-mutations are applied
llvm-svn: 244712
2015-08-12 01:55:37 +00:00
Kostya Serebryany
1688098cb5 [libFuzzer] add colons to the stats output to avoid confusion
llvm-svn: 244708
2015-08-12 01:04:27 +00:00
Nick Lewycky
69ab31a3fa Fix unused variable 'X' in release builds.
llvm-svn: 244571
2015-08-11 05:57:10 +00:00
Kostya Serebryany
bc7c0ad24d [libFuzzer] add -only_ascii flag
llvm-svn: 244559
2015-08-11 01:44:42 +00:00
Kostya Serebryany
70926aed6b [libFuzzer] add option -report_slow_units=Nsec to control when slow units are printed
llvm-svn: 244152
2015-08-05 21:43:48 +00:00
Kostya Serebryany
1165efdbf9 [libFuzzer] limit the size of the inputs printed to stderr
llvm-svn: 243795
2015-07-31 22:07:17 +00:00
Kostya Serebryany
404c69f2c8 [libFuzzer] allow users to supply their own implementation of rand
llvm-svn: 243078
2015-07-24 01:06:40 +00:00
Kostya Serebryany
2b7d2e91cc [libFuzzer] dump long running units to disk
llvm-svn: 243031
2015-07-23 18:37:22 +00:00
Kostya Serebryany
2ea204e645 [lib/Fuzzer] make assertions more informative and update comments for the user-supplied mutator
llvm-svn: 238658
2015-05-30 17:33:13 +00:00
Kostya Serebryany
316b571007 [lib/Fuzzer] make the fuzzing timeout 1200 seconds by default (was: infinity)
llvm-svn: 238251
2015-05-26 20:57:47 +00:00
Kostya Serebryany
c8228dd9fb [lib/Fuzzer] fix build with assertions
llvm-svn: 238235
2015-05-26 19:29:33 +00:00
Kostya Serebryany
7c180eafc1 [lib/Fuzzer] fully get rid of std::cerr in libFuzzer
llvm-svn: 238081
2015-05-23 01:22:35 +00:00
Kostya Serebryany
f3c7cb464e [lib/Fuzzer] remove -use_coverage_pairs=1, an experimental feature that is unlikely to ever scale
llvm-svn: 238063
2015-05-22 22:47:03 +00:00
Kostya Serebryany
f342459aa4 [lib/Fuzzer] extend the fuzzer interface to allow user-supplied mutators
llvm-svn: 238059
2015-05-22 22:35:31 +00:00
Kostya Serebryany
490bbd6fa4 [lib/Fuzzer] change the meaning of -timeout flag: now timeout is applied to every unit of work separately
llvm-svn: 237735
2015-05-19 22:12:57 +00:00
Kostya Serebryany
cbb2334b7a [lib/Fuzzer] more efficient reload logic; also don't spam git too much
llvm-svn: 237649
2015-05-19 01:06:07 +00:00
Kostya Serebryany
2da7b84852 [lib/Fuzzer] when -sync_command=<CMD> is given, periodically execute 'CMD CORPUS' to synchronize with other processes
llvm-svn: 237617
2015-05-18 21:34:20 +00:00
Logan Chien
a8f01bc8e1 Code cleanup: Reindent Fuzzer::MutateAndTestOne.
llvm-svn: 237533
2015-05-17 02:44:31 +00:00
Kostya Serebryany
225262562f [lib/Fuzzer] rename FuzzerDFSan.cpp to FuzzerTraceState.cpp; update comments. NFC expected
llvm-svn: 237050
2015-05-11 21:16:27 +00:00
Kostya Serebryany
1ac8055bc7 [lib/Fuzzer] use -fsanitize-coverage=trace-cmp when building LLVM with LLVM_USE_SANITIZE_COVERAGE; in lib/Fuzzer try to reload the corpus to pick up new units from other processes
llvm-svn: 236906
2015-05-08 21:30:55 +00:00
Kostya Serebryany
beb24c38e7 [lib/Fuzzer] change the way we use taint information for fuzzing. Now, we run a single unit and collect suggested mutations based on tracing+taint data, then apply the suggested mutations one by one. The previous scheme was slower and more complex.
llvm-svn: 236772
2015-05-07 21:02:11 +00:00
Kostya Serebryany
7d470cfb0c [lib/Fuzzer] minor refactoring/simplification, NFC
llvm-svn: 236757
2015-05-07 18:32:29 +00:00
Kostya Serebryany
ca6a2a2f1c [lib/Fuzzer] on crash print the contents of the crashy input as base64
llvm-svn: 236548
2015-05-05 21:59:51 +00:00
Kostya Serebryany
52a788e503 [fuzzer] Add support for token-based fuzzing (e.g. for C++). Allow string flags.
llvm-svn: 233745
2015-03-31 20:13:20 +00:00
Kostya Serebryany
16901a901d [fuzzer] when a single unit takes over 1 second to run and it is the slowest one so far, print it.
llvm-svn: 233637
2015-03-30 23:04:35 +00:00
Kostya Serebryany
03db8b9225 [fuzzer] print various stats in a unified way
llvm-svn: 233624
2015-03-30 22:44:03 +00:00