[libFuzzer] new experimental feature: value profiling. Profiles values that affect control flow and treats new values as new coverage.

llvm-svn: 278839

8 files changed, 65 insertions, 1 deletions

diff --git a/llvm/lib/Fuzzer/test/CMakeLists.txt b/llvm/lib/Fuzzer/test/CMakeLists.txt
index 2164086b5a7..1d82408d7cb 100644
--- a/llvm/lib/Fuzzer/test/CMakeLists.txt
+++ b/llvm/lib/Fuzzer/test/CMakeLists.txt
@@ -88,6 +88,9 @@ set(Tests
   SimpleHashTest
   SimpleTest
   SimpleThreadedTest
+  SingleMemcmpTest
+  SingleStrcmpTest
+  SingleStrncmpTest
   SpamyTest
   StrcmpTest
   StrncmpTest
diff --git a/llvm/lib/Fuzzer/test/SingleMemcmpTest.cpp b/llvm/lib/Fuzzer/test/SingleMemcmpTest.cpp
new file mode 100644
index 00000000000..c73f68a7ee6
--- /dev/null
+++ b/llvm/lib/Fuzzer/test/SingleMemcmpTest.cpp
@@ -0,0 +1,17 @@
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+
+// Simple test for a fuzzer. The fuzzer must find a particular string.
+#include <cstring>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  char *S = (char*)Data;
+  if (Size >= 6 && !memcmp(S, "qwerty", 6)) {
+    fprintf(stderr, "BINGO\n");
+    exit(1);
+  }
+  return 0;
+}
diff --git a/llvm/lib/Fuzzer/test/SingleStrcmpTest.cpp b/llvm/lib/Fuzzer/test/SingleStrcmpTest.cpp
new file mode 100644
index 00000000000..73470b527ee
--- /dev/null
+++ b/llvm/lib/Fuzzer/test/SingleStrcmpTest.cpp
@@ -0,0 +1,17 @@
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+
+// Simple test for a fuzzer. The fuzzer must find a particular string.
+#include <cstring>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  char *S = (char*)Data;
+  if (Size >= 7 && !strcmp(S, "qwerty")) {
+    fprintf(stderr, "BINGO\n");
+    exit(1);
+  }
+  return 0;
+}
diff --git a/llvm/lib/Fuzzer/test/SingleStrncmpTest.cpp b/llvm/lib/Fuzzer/test/SingleStrncmpTest.cpp
new file mode 100644
index 00000000000..dbcc464b0a7
--- /dev/null
+++ b/llvm/lib/Fuzzer/test/SingleStrncmpTest.cpp
@@ -0,0 +1,17 @@
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+
+// Simple test for a fuzzer. The fuzzer must find a particular string.
+#include <cstring>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  char *S = (char*)Data;
+  if (Size >= 6 && !strncmp(S, "qwerty", 6)) {
+    fprintf(stderr, "BINGO\n");
+    exit(1);
+  }
+  return 0;
+}
diff --git a/llvm/lib/Fuzzer/test/StrncmpTest.cpp b/llvm/lib/Fuzzer/test/StrncmpTest.cpp
index 8575c2682f1..5ffd011dcdf 100644
--- a/llvm/lib/Fuzzer/test/StrncmpTest.cpp
+++ b/llvm/lib/Fuzzer/test/StrncmpTest.cpp
@@ -17,7 +17,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
   if (Size >= 8 && strncmp(S, "01234567", 8) == 0) {
     if (Size >= 12 && strncmp(S + 8, "ABCD", 4) == 0) {
       if (Size >= 14 && strncmp(S + 12, "XY", 2) == 0) {
-        if (Size >= 16 && strncmp(S + 14, "KLM", 3) == 0) {
+        if (Size >= 17 && strncmp(S + 14, "KLM", 3) == 0) {
           fprintf(stderr, "BINGO\n");
           exit(1);
         }
diff --git a/llvm/lib/Fuzzer/test/value-profile-cmp.test b/llvm/lib/Fuzzer/test/value-profile-cmp.test
new file mode 100644
index 00000000000..e4059cd82ee
--- /dev/null
+++ b/llvm/lib/Fuzzer/test/value-profile-cmp.test
@@ -0,0 +1,3 @@
+CHECK: BINGO
+RUN: not LLVMFuzzer-SimpleCmpTest -use_value_profile=1 -runs=100000000 2>&1 | FileCheck %s
+
diff --git a/llvm/lib/Fuzzer/test/value-profile-mem.test b/llvm/lib/Fuzzer/test/value-profile-mem.test
new file mode 100644
index 00000000000..2052e879164
--- /dev/null
+++ b/llvm/lib/Fuzzer/test/value-profile-mem.test
@@ -0,0 +1,4 @@
+CHECK: BINGO
+RUN: not LLVMFuzzer-SingleMemcmpTest -use_memcmp=0 -use_value_profile=1 -runs=10000000 2>&1 | FileCheck %s
+RUN: not LLVMFuzzer-SingleStrcmpTest -use_memcmp=0 -use_value_profile=1 -runs=10000000 2>&1 | FileCheck %s
+RUN: not LLVMFuzzer-SingleStrncmpTest -use_memcmp=0 -use_value_profile=1 -runs=10000000 2>&1 | FileCheck %s
diff --git a/llvm/lib/Fuzzer/test/value-profile-set.test b/llvm/lib/Fuzzer/test/value-profile-set.test
new file mode 100644
index 00000000000..300afa9320d
--- /dev/null
+++ b/llvm/lib/Fuzzer/test/value-profile-set.test
@@ -0,0 +1,3 @@
+CHECK: BINGO
+RUN: not LLVMFuzzer-FourIndependentBranchesTest -seed=1 -use_value_profile=1 -runs=100000000 2>&1 | FileCheck %s
+