Commit Graph

621 Commits

Author SHA1 Message Date
Vitaly Buka b99247e608 [libFuzzer] Use ChooseUnitIdxToMutate to pick item for crossover.
Differential Revision: https://reviews.llvm.org/D30683

llvm-svn: 297891
2017-03-15 20:59:27 +00:00
Kostya Serebryany 70240430d9 [libFuzzer] remove even more stale code
llvm-svn: 297797
2017-03-15 00:39:06 +00:00
Kostya Serebryany 862a845aa5 [libFuzzer] simplify code a bit
llvm-svn: 297796
2017-03-15 00:34:25 +00:00
Kostya Serebryany f81cc098ca [libFuzzer] remove more stale code
llvm-svn: 297785
2017-03-14 21:47:52 +00:00
Kostya Serebryany 24d0016bbd [libFuzzer] don't clear Counters in TracePC::CollectFeatures since they will be cleared anyway in ResetMaps
llvm-svn: 297783
2017-03-14 21:40:53 +00:00
Kostya Serebryany a43a299382 [libFuzzer] remove stale code
llvm-svn: 297781
2017-03-14 21:30:14 +00:00
Vitaly Buka 0c736d8b36 [libFuzzer] Reorder includes in test
llvm-svn: 297692
2017-03-13 23:49:00 +00:00
Vitaly Buka 27441e5c47 [libFuzzer] Fix compilation of CustomCrossOverAndMutateTest on Windows
llvm-svn: 297690
2017-03-13 23:46:30 +00:00
Kostya Serebryany d481e1c361 [libFuzzer] add more iterations to LLVMFuzzer-Memcmp64BytesTest
llvm-svn: 297554
2017-03-11 05:14:49 +00:00
Kostya Serebryany 5dfa9642a8 [libFuzzer] reduce the number of vector resizes during merge (https://github.com/google/oss-fuzz/issues/445)
llvm-svn: 297551
2017-03-11 02:50:47 +00:00
Kostya Serebryany 81d1744519 [libFuzzer] print how much memory is consumed by the outer merge process (https://github.com/google/oss-fuzz/issues/445)
llvm-svn: 297546
2017-03-11 02:26:20 +00:00
Kostya Serebryany b6b2f18ea8 [libFuzzer] add test/LargeTest.cpp, mostly for manual experiments with large number of edges, not yet suitable for unit testing
llvm-svn: 297544
2017-03-11 01:54:06 +00:00
Kostya Serebryany 7939ee4d51 [libFuzzer] remove fuzzer-jobs.test which is flaky and not very useful
llvm-svn: 297543
2017-03-11 01:48:54 +00:00
Vitaly Buka 91266b4752 [fuzzer] Don't crash if LLVMFuzzerMutate was called by CustomCrossOver
Reviewers: kcc

Subscribers: llvm-commits, mgorny

Differential Revision: https://reviews.llvm.org/D30682

llvm-svn: 297202
2017-03-07 20:37:38 +00:00
Kuba Mracek 00c7592a6b Un-XFAIL Fuzzer/test/dump_coverage.test. This now passes on Darwin (after r297094).
llvm-svn: 297110
2017-03-07 01:01:38 +00:00
Mike Aizatsky 15492af547 [libfuzzer] do not use xargs for shell expansion
Summary:
After https://reviews.llvm.org/rL296904 xargs shouldn't be necesssary.

Differential Revision: https://reviews.llvm.org/D30371

llvm-svn: 297094
2017-03-06 23:42:14 +00:00
Mehdi Amini 6dabadab78 un-Xfail Fuzzer test that decided to pass on Green Dragon
It may be flacky, I'll turn it into unsupported if it fails again.

llvm-svn: 296913
2017-03-03 21:28:05 +00:00
Kostya Serebryany 41e7a27811 [libFuzzer] remove usage of the old coverage instrumentation
llvm-svn: 296536
2017-02-28 23:23:48 +00:00
Mehdi Amini 1d9f3fe77c Mark some libFuzzer tests as XFAIL'd on Darwin
We're bringing up a bot on Green Dragon right now:

http://green.lab.llvm.org/green/view/Experimental/job/libFuzzer

llvm-svn: 296526
2017-02-28 21:45:59 +00:00
Justin Bogner d519a92a27 [libFuzzer] Update traces hooks test after r293741
This test now passes on darwin.

llvm-svn: 295902
2017-02-22 23:12:36 +00:00
Justin Bogner 59c8420018 [libFuzzer] Mark a test that infinite loops as unsupported
We need to investigate this, but for now it just causes too much
headache when trying to run these tests.

llvm-svn: 295900
2017-02-22 23:05:17 +00:00
Kostya Serebryany 32c5004cf5 [libFuzzer] increase the size of FixedWord from 27 to 64, see PR31950
llvm-svn: 295117
2017-02-14 23:02:37 +00:00
Kostya Serebryany ae579a79c0 Use "%zd" format specifier for printing number of testcases executed.
Summary:
This helps to avoid signed integer overflow after running a fast fuzz target for several hours, e.g.:

<...>
Done -1097903291 runs in 54001 second(s)



Reviewers: kcc

Reviewed By: kcc

Differential Revision: https://reviews.llvm.org/D29941

llvm-svn: 295112
2017-02-14 22:14:36 +00:00
Marcos Pividori e81f9cc63d [libFuzzer] Use stoull instead of stol to ensure 64 bits.
Differential revision: https://reviews.llvm.org/D29831

llvm-svn: 294769
2017-02-10 18:44:14 +00:00
Eric Fiselier 87c87f4c30 [CMake] Fix pthread handling for out-of-tree builds
LLVM defines `PTHREAD_LIB` which is used by AddLLVM.cmake and various projects
to correctly link the threading library when needed. Unfortunately
`PTHREAD_LIB` is defined by LLVM's `config-ix.cmake` file which isn't installed
and therefore can't be used when configuring out-of-tree builds. This causes
such builds to fail since `pthread` isn't being correctly linked.

This patch attempts to fix that problem by renaming and exporting
`LLVM_PTHREAD_LIB` as part of`LLVMConfig.cmake`. I renamed `PTHREAD_LIB`
because It seemed likely to cause collisions with downstream users of
`LLVMConfig.cmake`.

llvm-svn: 294690
2017-02-10 01:59:20 +00:00
Marcos Pividori a0b23b8e63 [libFuzzer] Export external functions on tests.
We need to export external functions so they are found when calling
GetProcAddress() on Windows. But we can't use `__declspec(dllexport)` because
we want the targets to be completely independent from the fuzz engines and don't
depend on other header files. Also, we don't want to include platform specific
code managed with conditional macros.
So, the solution is to add the exported symbols with linker flags in cmake.

Differential revision: https://reviews.llvm.org/D29752

llvm-svn: 294688
2017-02-10 01:40:28 +00:00
Marcos Pividori 0ae27e80b0 [libFuzzer] Use dynamic loading for External Functions on Windows.
Replace weak aliases with dynamic loading.
Weak aliases were generating some problems when linking for MT on Windows. For
MT, compiler-rt's libraries are statically linked to the main executable the
same than libFuzzer, so if we use weak aliases, we are providing two different
default implementations for the same weak function and the linker fails.

In this diff I re implement ExternalFunctions() using dynamic loading, so it
works in both cases (MD and MT). Also, dynamic loading is simpler, since we are
not defining any auxiliary external function, and we don't need to deal with
weak aliases.
This is equivalent to the implementation using dlsym(RTLD_DEFAULT, FnName) for
Posix.

Differential revision: https://reviews.llvm.org/D29751

llvm-svn: 294687
2017-02-10 01:35:46 +00:00
Marcos Pividori 5a53567620 [libFuzzer] Use long long to ensure 64 bits.
We should always use unsigned long long to ensure 64 bits. On Windows, unsigned
long is 4 bytes. This was the reason why value-profile-cmp4.test was failing on
Windows.

Differential Revision: https://reviews.llvm.org/D29617

llvm-svn: 294390
2017-02-08 00:03:31 +00:00
Marcos Pividori 2a318a18db [libFuzzer] Use custom target instead of list of binaries for tests.
Update cmake to use a custom target TestBinaries instead of a list of targets.
This simplifies cmake, and fix some errors. This way, we don't have to propagate
the values into parents directories. We only need to use add_dependencies.

Differential Revision: https://reviews.llvm.org/D29593

llvm-svn: 294389
2017-02-08 00:03:26 +00:00
Marcos Pividori 360be4d7ad [libFuzzer] Properly use Handle instead of FD on Windows.
For Windows, sanitizers work with Handles, not with posix file descriptors,
because they use the windows-specific API. So we need to convert the fds to
handles before passing them to the sanitizer library.
After this change, close_fd_mask is fixed for Windows (this fix some tests too).

Differential Revision: https://reviews.llvm.org/D29548

llvm-svn: 294388
2017-02-08 00:03:18 +00:00
Marcos Pividori e219d40191 [libFuzzer] Change Uninstrumented test name.
On Windows, executables with the word "uninst" included in their names are
associated with administrator privileges.

Differential Revision: https://reviews.llvm.org/D29549

llvm-svn: 294387
2017-02-08 00:03:13 +00:00
Marcos Pividori fd6578896d [libFuzzer] fuzzer-jobs requires posix.
llvm-svn: 294386
2017-02-08 00:03:07 +00:00
Marcos Pividori c7ac33454f [libFuzzer] Update fuzzer.test to properly set environment variables.
Use env to set environment variables, so it works on Windows and Linux.

Differential Revision: https://reviews.llvm.org/D29537

llvm-svn: 294385
2017-02-08 00:03:03 +00:00
Marcos Pividori 992e6308a7 [libFuzzer] Don't add newline character when using echo in tests.
Add the option "-n", so we don't add a new line character at the end of the file
when using echo. (on Windows this means 2 characters).

Differential Revision: https://reviews.llvm.org/D29536

llvm-svn: 294384
2017-02-08 00:02:59 +00:00
Marcos Pividori abcdcf9f86 [libFuzzer] Disable ulimit test on windows.
Differential Revision: https://reviews.llvm.org/D29535

llvm-svn: 294383
2017-02-08 00:02:54 +00:00
Marcos Pividori 7444aae914 [libFuzzer] Remove ? wildcard on tests.
We can not use the wildcard ? on Windows.

Differential Revision: https://reviews.llvm.org/D29534

llvm-svn: 294382
2017-02-08 00:02:50 +00:00
Marcos Pividori 8fcd6d8394 [libFuzzer] Update fuzzer-segv to set environment variables.
Use env to set environment variables, so it works on Linux and Windows.

Differential Revision: https://reviews.llvm.org/D29533

llvm-svn: 294381
2017-02-08 00:02:45 +00:00
Marcos Pividori 509d4f5aa9 [libFuzzer] Properly configure tests for Windows.
This configuration is necessary, and is included in all tests suites.
We need to execute: `config.test_format = lit.formats.ShTest(False)`
Otherwise, lit will try to use bash, which generates many problems.

Differential Revision: https://reviews.llvm.org/D29529

llvm-svn: 294380
2017-02-08 00:02:41 +00:00
Marcos Pividori 4a65bc35c3 [libFuzzer] Simplify dump_coverage test.
Environment variables are handled differently on Windows. In this case it is not
necessary to use environment variables. So, I simplify the test to work on
Windows.

Differential Revision: https://reviews.llvm.org/D29532

llvm-svn: 294379
2017-02-08 00:02:36 +00:00
Marcos Pividori 638ede81af [libFuzzer] Update Load test to work on 32 bits.
We should ensure the size of the variable `a` is 8 bytes. Otherwise, this
generates a stack buffer overflow inside the memcpy call in 32 bits machines.
(We write more bytes than the size of a, when it is 4 bytes)

Differential Revision: https://reviews.llvm.org/D29602

llvm-svn: 294378
2017-02-08 00:02:32 +00:00
Marcos Pividori 51f907f3a4 [libFuzzer] Update test to consider different exceptions.
Differential Revision: https://reviews.llvm.org/D29531

llvm-svn: 294377
2017-02-08 00:02:25 +00:00
Marcos Pividori c8cee28a5b [libFuzzer] Temporarily fix Shmem for Windows.
In this diff, I add stubs for shared memory on Windows. Now we can compile and
use libFuzzer without support for shared memory.

Differential Revision: https://reviews.llvm.org/D29544

llvm-svn: 294376
2017-02-08 00:02:12 +00:00
Kostya Serebryany 6ac64c3a6d [libFuzzer] replace std::random_shuffle with std::shuffle as std::random_shuffle is being deprecated in C++17. Also simplify fuzzer::Random. NFC
llvm-svn: 294366
2017-02-07 22:37:34 +00:00
Kostya Serebryany c24ec32370 [libFuzzer] make code less clever to avoid fallthrough in switch (and in turn avoid compiler warnings). NFC. Suggested by Christian Holler.
llvm-svn: 294239
2017-02-06 21:21:37 +00:00
Kostya Serebryany 9f8e47b28c [libFuzzer] properly hide the memcmp interceptor from msan
llvm-svn: 294061
2017-02-03 22:51:38 +00:00
Mike Aizatsky 1b65812267 [libfuzzer] chromium-related compilation fixes
Reviewers: kcc

Differential Revision: https://reviews.llvm.org/D29502

llvm-svn: 294035
2017-02-03 20:26:44 +00:00
Kostya Serebryany 68382d0900 [libFuzzer] reorganize the tracing code to make it easier to experiment with inlined coverage instrumentation. NFC
llvm-svn: 293928
2017-02-02 19:56:01 +00:00
Marcos Pividori d64360d935 [libFuzzer] Properly handle exceptions with UnhandledExceptionFilter.
Use SetUnhandledExceptionFilter instead of AddVectoredExceptionHandler.

According to the documentation on Structured Exception Handling, this is the
order for the Exception Dispatching:
+ If the process is being debugged, the system notifies the debugger.
+ The Vectored Exception Handler is called.
+ The system attempts to locate a frame-based exception handler by searching the
 stack frames of the thread in which the exception occurred.
+ If no frame-based handler can be found, the UnhandledExceptionFilter filter is
 called.
+ Default handling based on the exception type.

So, similar to what we do for asan, we should use SetUnhandledExceptionFilter
instead of AddVectoredExceptionHandler, so user's code that is being fuzzed can
execute frame-based exception handlers before we catch them . We want to catch
unhandled exceptions, not all the exceptions.

Differential Revision: https://reviews.llvm.org/D29462

llvm-svn: 293920
2017-02-02 19:07:53 +00:00
Marcos Pividori ba03abebfe [libFuzzer] Disable afl tests on non-posix systems.
AflDriver is not supported on non posix systems.

Differential Revision: https://reviews.llvm.org/D29422

llvm-svn: 293830
2017-02-01 22:40:50 +00:00
Marcos Pividori 36464dd6a5 [libFuzzer] Disable equivalence tests on non posix systems.
We can not run this test until we implement shared memory on Windows.

Differential Revision: https://reviews.llvm.org/D29421

llvm-svn: 293829
2017-02-01 22:40:45 +00:00