Commit Graph

729 Commits

Author SHA1 Message Date
George Karpenkov 96d6008145 Fixing buildbots: do not register check-fuzzer if clang or asan are not
present.

llvm-svn: 310077
2017-08-04 17:43:29 +00:00
George Karpenkov a5de052362 Drop Windows support from libFuzzer tests.
Differential Revision: https://reviews.llvm.org/D36205

llvm-svn: 310076
2017-08-04 17:43:28 +00:00
George Karpenkov 8ecdd7be15 Port libFuzzer tests to LIT. Do not require two-stage build for check-fuzzer.
This revision ports all libFuzzer tests apart from the unittest to LIT.
The advantages of doing so include:

 - Tests being self-contained
 - Much easier debugging of a single test
 - No need for using a two-stage compilation

The unit-test is still compiled using CMake, but it does not need a
freshly built compiler.

NOTE: The previous two-stage bot configuration will NOT work, as in the
second stage build LLVM_USE_SANITIZER is set, which disables ASAN from
being built.
Thus bots will be reconfigured in the next few commits.

Differential Revision: https://reviews.llvm.org/D36295

llvm-svn: 310075
2017-08-04 17:19:45 +00:00
George Karpenkov 5bd0503680 Disable libFuzzer tests on Windows
Differential Revision: https://reviews.llvm.org/D36297

llvm-svn: 310009
2017-08-04 00:26:12 +00:00
George Karpenkov f020c98912 [libFuzzer] Un-reverting change in tests after fixing the failure on Linux.
Differential Revision: https://reviews.llvm.org/D36242

llvm-svn: 309982
2017-08-03 20:28:16 +00:00
George Karpenkov 6f046b4dd7 Revert "[libFuzzer tests] Use substring comparison in libFuzzer tests"
This reverts commit 3592d8049660dcdd07f7c2e797f2de9790f93111.

Breaks the bots, reverting for now.

llvm-svn: 309899
2017-08-02 23:09:57 +00:00
George Karpenkov 03f9506477 [libFuzzer tests] Use substring comparison in libFuzzer tests
LIT launches executables with absolute, and not relative, path.
strncmp would try to do exact comparison and fail.

Differential Revision: https://reviews.llvm.org/D36242

llvm-svn: 309889
2017-08-02 21:38:50 +00:00
Kostya Serebryany 0fc5ee2db0 [libFuzzer] temporarty remove pc-tables and disable test/fuzzer-printcovpcs.test until this can be fixed on Windows
llvm-svn: 309716
2017-08-01 18:02:19 +00:00
Kostya Serebryany 6cdb5a61b5 [libFuzzer] implement more correct way of computing feature index for Inline8bitCounters
llvm-svn: 309647
2017-08-01 01:16:26 +00:00
Kostya Serebryany 4f2970037a [libFuzzer] enable -fsanitize-coverage=pc-table for all tests
llvm-svn: 309646
2017-08-01 00:48:44 +00:00
Kostya Serebryany b2a1eba2f5 [libFuzzer] implement __sanitizer_cov_pcs_init and add pc-table to build flags for one test (for now)
llvm-svn: 309615
2017-07-31 20:20:59 +00:00
Kostya Serebryany f14996b962 [libFuzzer] improve support for inline-8bit-counters (make it more correct and faster)
llvm-svn: 309443
2017-07-28 22:00:56 +00:00
Kostya Serebryany 6eab1a8ee6 [libFuzzer] don't disable msan for TracePC::CollectFeatures: this started to cause false positives in msan. No tests for libFuzzer+msan yet -- tests will need to wait until we move libFuzzer to compiler-rt
llvm-svn: 309038
2017-07-25 22:05:31 +00:00
Kostya Serebryany 6f7befd10f [libFuzzer] make one test faster, fix compiler warnings in tests
llvm-svn: 308945
2017-07-25 02:09:46 +00:00
George Karpenkov 9bc64acf90 Revert "Revert "[libFuzzer] Add a dependency on symbolizer from libFuzzer tests""
This reverts commit 15425f2bc6eac6249ee957a2a280511306c07547.

Should work now that atos is a default symbolizer on Darwin.

llvm-svn: 308910
2017-07-24 18:38:14 +00:00
Kostya Serebryany 8cb63ec20b [libFuzzer] reimplement experimental_len_control=1: bump the temporary max_len every time we failed to find new coverage during the last 1000 runs and 1 second. Also fix FileToVector to not load unfinished files
llvm-svn: 308811
2017-07-22 00:10:29 +00:00
Matt Morehouse 9e689792b2 Generate error reports when a fuzz target exits.
Summary:
Implements https://github.com/google/sanitizers/issues/835.

Flush stdout before exiting in test cases.

Since the atexit hook is used for exit reports, pending prints to
stdout can be lost if they aren't flushed before calling exit().

Expect tests to have non-zero exit code if exit() is called.

Reviewers: vitalybuka, kcc

Reviewed By: kcc

Subscribers: eraman, llvm-commits, hiraditya

Differential Revision: https://reviews.llvm.org/D35602

llvm-svn: 308669
2017-07-20 20:43:39 +00:00
Kostya Serebryany d1b731d57b [libFuzzer] delete stale code
llvm-svn: 308663
2017-07-20 20:15:13 +00:00
Kostya Serebryany a763be3d5f [libFuzzer] make sure CheckExitOnSrcPosOrItem is called after the new input is saved to the corpus
llvm-svn: 308653
2017-07-20 18:53:25 +00:00
Kostya Serebryany e55828c740 [libFuzzer] prototype implementation of recursion-depth coverage features (commented out; real implementation needs to use inlined instrumentation)
llvm-svn: 308577
2017-07-20 01:35:17 +00:00
Kostya Serebryany 15cc3713d3 [libFuzzer] add DeepRecursionTest, inspired by https://guidovranken.wordpress.com/2017/07/08/libfuzzer-gv-new-techniques-for-dramatically-faster-fuzzing/ (Stack-depth-guided fuzzing). libFuzzer does not solve it yet.
llvm-svn: 308571
2017-07-20 00:37:08 +00:00
Reid Kleckner 6326639721 Try to deflake fuzzer-oom.test on Windows
llvm-svn: 308568
2017-07-20 00:11:39 +00:00
Kostya Serebryany f1bafd9bf6 [libFuzzer] simplify two more tests
llvm-svn: 308560
2017-07-19 23:52:54 +00:00
Kostya Serebryany a168af7b5f [libFuzzer] change several tests to not limit the max len: with reduce_inputs=1 they are now fast enough even w/o this
llvm-svn: 308553
2017-07-19 23:45:46 +00:00
Reid Kleckner b3283b740f Fix fuzzer-flags.test on Windows
The optional external function callbacks have to be exported in order
for them to be called. The test was failing because libFuzzer wasn't
calling LLVMFuzzerInitialize.

We can reconsider if this is the best way to mark these optional
callbacks exported later.

llvm-svn: 308548
2017-07-19 23:22:06 +00:00
Kostya Serebryany 4a27b70ed5 [libFuzzer] enable reduce_inputs=1 by default (seems to be a big win usually)
llvm-svn: 308541
2017-07-19 22:10:30 +00:00
Kostya Serebryany d01e956d38 [libFuzzer] when adding a reduced input print REDUCED instead of NEW
llvm-svn: 308336
2017-07-18 18:47:36 +00:00
Kostya Serebryany f1b5c64052 [libFuzzer] improve -reduce_inputs=1: now only consider the unique features of very input (seems to work much better)
llvm-svn: 308253
2017-07-18 01:36:50 +00:00
Kostya Serebryany 871c157b1a [libFuzzer] disable fuzzer-flags.test on windows to fix the bots
llvm-svn: 308246
2017-07-18 01:00:28 +00:00
George Karpenkov 00727af610 Revert "[libFuzzer] Add a dependency on symbolizer from libFuzzer tests"
This reverts commit 546e006a023cccd0fd32afd442ab992d3515d4b8.

Reverting until I can figure out llvm-symbolizer breakages on mac os.

llvm-svn: 308202
2017-07-17 18:18:03 +00:00
Kostya Serebryany e9838cdcc5 [libFuzzer] remove stale code
llvm-svn: 308075
2017-07-15 01:31:40 +00:00
Justin Bogner c27a70d048 [libFuzzer] Allow non-fuzzer args after -ignore_remaining_args=1
With this change, libFuzzer will ignore any arguments after a sigil
argument, but it will preserve these arguments at the end of the
command line when launching subprocesses. Using this, its possible to
handle positional and single-dash arguments to the program under test
by discarding everything up to -ignore_remaining_args=1 in
LLVMFuzzerInitialize.

llvm-svn: 308069
2017-07-14 23:33:04 +00:00
Kostya Serebryany e6823ced65 [libFuzzer] fix stats during merge
llvm-svn: 308061
2017-07-14 21:48:19 +00:00
Kostya Serebryany 71f6f7f5dc [libFuzzer] update the comments in afl/afl_driver.cpp
llvm-svn: 307981
2017-07-14 00:18:37 +00:00
Kostya Serebryany 7c83896f55 [libFuzzer] remove stale code; NFC
llvm-svn: 307980
2017-07-14 00:16:23 +00:00
Kostya Serebryany f64b8487f9 [libFuzzer] simplify the handling of memmem/strstr
llvm-svn: 307977
2017-07-14 00:06:27 +00:00
Kostya Serebryany 697f2159bb [libFuzzer] move code around; NFC
llvm-svn: 307973
2017-07-13 22:30:23 +00:00
Kostya Serebryany 8050ea16b5 [libFuzzer] make sure that -reduce_inputs=1 deletes redundant files in the corpus
llvm-svn: 307875
2017-07-13 01:56:37 +00:00
Kostya Serebryany 1ca738809a [libFuzzer] experimental feature -reduce_inputs (off by default) that tries to replace elements in the corpus with smaller ones that have the same feature set. Still needs tuning
llvm-svn: 307873
2017-07-13 01:08:53 +00:00
Kostya Serebryany aa356c3cd5 [libFuzzer] relax test/shrink.test a bit (got broken on windows)
llvm-svn: 307862
2017-07-12 23:22:32 +00:00
Kostya Serebryany 398b414179 [libFuzzer] remove include <sanitizer/coverage_interface.h>, not needed any more
llvm-svn: 307858
2017-07-12 22:22:36 +00:00
Kostya Serebryany 1e99d543d2 [libFuzzer] refactoring in preparation for -reduce_inputs; NFC intended
llvm-svn: 307857
2017-07-12 22:20:04 +00:00
George Karpenkov 52b2dbb673 [libFuzzer] Add a dependency on symbolizer from libFuzzer tests
Some libFuzzer tests on Linux would fail with bizarre error messages
unless llvm-symbolizer binary is present.

Differential Revision: https://reviews.llvm.org/D35313

llvm-svn: 307826
2017-07-12 18:17:34 +00:00
George Karpenkov cf26a86601 [libFuzzer] NFC Declare LIBFUZZER_FLAGS_BASE outside of an if-block
The current code relies on the assumption that tests are included only
if LLVM_USE_SANITIZE_COVERAGE is enabled.
This commit makes it easier to relax the assumption in the future, as
the variable LIBFUZZER_FLAGS_BASE is used further in libFuzzer tests.

Differential Revision: https://reviews.llvm.org/D35314

llvm-svn: 307825
2017-07-12 18:16:09 +00:00
George Karpenkov 6eab75fbb0 [libFuzzer] Do not use LLVM ostream in tests
Differential Revision: https://reviews.llvm.org/D35312

llvm-svn: 307824
2017-07-12 18:14:19 +00:00
Dan Liew 368d8a7351 [LibFuzzer] Fix `-Wcomment` warning emitted by GCC.
```
./FuzzerIOWindows.cpp:185:1: warning: multi-line comment [-Wcomment]
 // Parse a directory ending in separator, like: SomeDir\
 ^
./FuzzerIOWindows.cpp:200:1: warning: multi-line comment [-Wcomment]
 // Parse a servername and share, like: SomeServer\SomeShare\
 ^
```

Differential Revision: https://reviews.llvm.org/D35244

llvm-svn: 307687
2017-07-11 18:27:52 +00:00
Dan Liew 2d06d7e512 [LibFuzzer] Fix `-Wpedantic` warning reported by Eric Christopher.
The warning is reproducible with GCC 4.8. Thanks to David Blaikie for
the suggested fix.

The reported warning was

```
/usr/local/google/home/echristo/sources/llvm/lib/Fuzzer/FuzzerExtFunctions.def:29:10: warning: ISO C++ forbids casting between pointer-to-function and pointer-to-object [-Wpedantic]
 EXT_FUNC(__lsan_enable, void, (), false);
          ^
/usr/local/google/home/echristo/sources/llvm/lib/Fuzzer/FuzzerExtFunctionsWeak.cpp:44:24: note: in definition of macro ‘EXT_FUNC’
   CheckFnPtr((void *)::NAME, #NAME, WARN);
                        ^
```

Differential Revision: https://reviews.llvm.org/D35243

llvm-svn: 307686
2017-07-11 18:27:48 +00:00
Matthias Braun af7442abd0 FuzzerUtilDarwin.cpp: We need to pass modifiable strings to posix_spawn
This fixes a bug where unmodifiable strings where passed to posix_spawn.

This is an attempt to unbreak the greendragon libFuzzer bot.

llvm-svn: 307424
2017-07-07 18:53:24 +00:00
Kostya Serebryany 589eae515e [libFuzzer] change the default max_len from 64 to 4096. This will affect cases where libFuzzer is run w/o initial corpus or with a corpus of very small items.
llvm-svn: 305521
2017-06-15 22:43:40 +00:00
George Karpenkov 406c113103 Fixing section name for Darwin platforms for sanitizer coverage
On Darwin, section names have a 16char length limit.

llvm-svn: 305429
2017-06-14 23:40:25 +00:00