summaryrefslogtreecommitdiff
path: root/lib/fuzzer/FuzzerTracePC.cpp
AgeCommit message (Collapse)Author
2018-07-23[libFuzzer] Handle unstable edges by using minimum hit countsMax Moroz
Summary: Created unstable_handle flag that takes 1 or 2, depending on the handling type. Modified RunOne to accommodate the following heuristic: Use the first CollectFeatures to count how many features there are. If no new features, CollectFeatures like before. If there is new feature, we run CB 2 more times, Check which edges are unstable per input and we store the least amount of hit counts for each edge. Apply these hit counts back to inline8bitcounters so that CollectFeatures can work as intended. Modified UnstableCounters to 8int_t and created a bitset UnstableSet to tell which edges are unstable. Patch by Kyungtak Woo (@kevinwkt). Reviewers: Dor1s, metzman, morehouse Reviewed By: Dor1s, morehouse Subscribers: delcypher, #sanitizers, llvm-commits, kcc Differential Revision: https://reviews.llvm.org/D49525 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337696 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-19[libFuzzer] when -print_coverage=1 is given, print more stats (the number of ↵Kostya Serebryany
seeds that hit every given function) git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337501 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-18[libFuzzer] Create single template for visiting Inline8bitCountersMax Moroz
Summary: Created IterateInline8bitCounters, a single template for visiting Inline8bitCounters (nested for loop) Made InitializeUnstableCounters and UpdateUnstableCounters both send a lambda to IterateInline8bitCounters. Patch by Kyungtak Woo (@kevinwkt). Reviewers: Dor1s, metzman, kcc, morehouse Reviewed By: metzman, morehouse Subscribers: delcypher, llvm-commits, #sanitizers Differential Revision: https://reviews.llvm.org/D49453 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337403 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-17libFuzzer: prevent irrelevant strings from leaking into auto-dictionaryMatt Morehouse
This is a fix for bug 37047. https://bugs.llvm.org/show_bug.cgi?id=37047 Implemented by basically reversing the logic. Previously all strings were considered, with some operations excluded. Now strings are excluded by default, and only strings during the CB considered. Patch By: pdknsk Differential Revision: https://reviews.llvm.org/D48800 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337296 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-16[libFuzzer] Implement stat::stability_rate based on the percentage of ↵Max Moroz
unstable edges. Summary: Created a -print_unstable_stats flag. When -print_unstable_stats=1, we run it 2 more times on interesting inputs poisoning unstable edges in an array. On program termination, we run PrintUnstableStats() which will print a line with a stability percentage like AFL does. Patch by Kyungtak Woo (@kevinwkt). Reviewers: metzman, Dor1s, kcc, morehouse Reviewed By: metzman, Dor1s, morehouse Subscribers: delcypher, llvm-commits, #sanitizers, kcc, morehouse, Dor1s Differential Revision: https://reviews.llvm.org/D49212 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337187 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-16Revert r337175 (https://reviews.llvm.org/D49212) due to unintentional format ↵Max Moroz
changes. git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337180 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-16[libFuzzer] Implement stat::stability_rate based on the percentage of ↵Max Moroz
unstable edges. Summary: Created a -print_unstable_stats flag. When -print_unstable_stats=1, we run it 2 more times on interesting inputs poisoning unstable edges in an array. On program termination, we run PrintUnstableStats() which will print a line with a stability percentage like AFL does. Patch by Kyungtak Woo (@kevinwkt). Reviewers: metzman, Dor1s, kcc, morehouse Reviewed By: metzman, Dor1s, morehouse Subscribers: delcypher, llvm-commits, #sanitizers, kcc, morehouse, Dor1s Differential Revision: https://reviews.llvm.org/D49212 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337175 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-06libFuzzer: always print line-break for NEW_FUNC/PC outputKostya Serebryany
Summary: This is a minor cosmetic change. When function/path exceed ~1000 characters, the output is truncated before the line-break. I noticed this for NEW_FUNC. Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits, #sanitizers Differential Revision: https://reviews.llvm.org/D48799 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@336461 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-03[libFuzzer] add one more value profile metric, under a flag (experimental)Kostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@336234 91177308-0d34-0410-b5e6-96231b3b80d8
2018-06-25[libFuzzer] Use Vector rather than std::vector.Matt Morehouse
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@335487 91177308-0d34-0410-b5e6-96231b3b80d8
2018-06-07[libFuzzer] When printing NEW_FUNC, use 1-base indexing.Kostya Serebryany
Summary: Otherwise we print things like [0/1] which is visually confusing. Reviewers: kcc Reviewed By: kcc Subscribers: delcypher, llvm-commits, #sanitizers Differential Revision: https://reviews.llvm.org/D47837 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@334234 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-21[libFuzzer] reinstate -dump_coverage, which is still in use (reverts r332036)Kostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@332876 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-16[libFuzzer] add an experimental flag -focus_function: libFuzzer will try to ↵Kostya Serebryany
focus on inputs that trigger that function git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@332554 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-11[libFuzzer] refactor the implementation of -print_coverageKostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@332073 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-10[libFuzzer] remove the dump_coverage flag, it hasn't been working with the ↵Kostya Serebryany
inline sanitizer coverage anyway git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@332036 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-10[libFuzzer] remove the experimental support for clang coverage ↵Kostya Serebryany
instrumentation. This mode has not been used and our experiments with https://github.com/google/fuzzer-test-suite show that this signal is weaker than the SanitizerCoverage git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@332034 91177308-0d34-0410-b5e6-96231b3b80d8
2018-04-20[LibFuzzer] Report when custom counters are available.Dan Liew
This upstreams a feature from the JFS solver's fork of LibFuzzer. Differential Revision: https://reviews.llvm.org/D45675 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@330391 91177308-0d34-0410-b5e6-96231b3b80d8
2017-10-14[libFuzzer] print a better warning if we hit the ld bugKostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@315778 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-28[libFuzzer] allow -print_funcs=N: N is the max number of new covered ↵Kostya Serebryany
function printed git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@311945 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-27[libFuzzer] Use custom allocators for STL containers in libFuzzer.George Karpenkov
Avoids ODR violations causing spurious ASAN warnings. Differential Revision: https://reviews.llvm.org/D37086 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@311866 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-26Revert "[libFuzzer] Use custom allocators for STL containers in libFuzzer"George Karpenkov
This reverts commit 3539efc2f2218dba2bcbd645d0fe276f2b5cf588. git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@311831 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-26[libFuzzer] Use custom allocators for STL containers in libFuzzerGeorge Karpenkov
Avoids ODR violations causing spurious ASAN container overflow warnings. Differential Revision: https://reviews.llvm.org/D37086 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@311830 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-25[libFuzzer] add -print_funcs=1 (on bey default): print newly discovered ↵Kostya Serebryany
functions during fuzzing git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@311797 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-25[sanitizer-coverage] extend fsanitize-coverage=pc-table with flags for every PCKostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@311794 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-22[SanitizerCoverage] Optimize stack-depth instrumentation.Matt Morehouse
Summary: Use the initialexec TLS type and eliminate calls to the TLS wrapper. Fixes the sanitizer-x86_64-linux-fuzzer bot failure. Reviewers: vitalybuka, kcc Reviewed By: kcc Subscribers: hiraditya, llvm-commits Differential Revision: https://reviews.llvm.org/D37026 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@311490 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-22[libFuzzer] fix the stack-depth initialization, add a lit test for ↵Kostya Serebryany
DeepRecursionTest.cpp git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@311421 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-22[libFuzzer] apply changes lost during the migration to compiler-rtKostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@311420 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-21Move libFuzzer to compiler_rt.George Karpenkov
Resulting library binaries will be named libclang_rt.fuzzer*, and will be placed in Clang toolchain, allowing redistribution. Differential Revision: https://reviews.llvm.org/D36908 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@311407 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-04 09:34:51 +0000