summaryrefslogtreecommitdiffstats
path: root/compiler-rt/lib/fuzzer/FuzzerOptions.h
Commit message (Collapse)AuthorAgeFilesLines
* [libFuzzer] Remove lazy counters.Matt Morehouse2019-10-011-1/+0
| | | | | | | | | | | | | | | | Summary: Lazy counters haven't improved performance for large fuzz targets. Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits Tags: #llvm Differential Revision: https://reviews.llvm.org/D67476 llvm-svn: 373403
* [libFuzzer] implement a better queue for the fork mode. Add an internal flag ↵Kostya Serebryany2019-06-141-0/+1
| | | | | | -stop_file to allow graceful shutdown of fuzzing. Enhance the logging in the fork mode llvm-svn: 363470
* [libFuzzer] automatically collect the data flow trace (DFT) in the fork mode ↵Kostya Serebryany2019-05-231-0/+1
| | | | | | if -collect_data_flow= is given llvm-svn: 361448
* [libFuzzer] add -features_dir= flag to dump unique input features on diskKostya Serebryany2019-04-131-0/+1
| | | | llvm-svn: 358317
* [libFuzzer] form mode: add -ignore_crashes flag, honor the max_total_time ↵Kostya Serebryany2019-02-151-2/+3
| | | | | | flag, print the number of ooms/timeouts/crashes, fix a typo llvm-svn: 354175
* [libFuzzer] teach the fork mode to ignore OOMs and timeoutsKostya Serebryany2019-02-121-0/+2
| | | | llvm-svn: 353792
* [libFuzzer] more refactoring; change some of the exit codes (timeout, OOM, ↵Kostya Serebryany2019-02-091-1/+3
| | | | | | interrupt) so that the parent process can distinguish those llvm-svn: 353584
* [libFuzzer] experimental performance optimization -lazy_counters, off by ↵Kostya Serebryany2019-01-311-0/+1
| | | | | | default. Posix-only for now, tested on Linux llvm-svn: 352700
* Update the file headers across all of the LLVM projects in the monorepoChandler Carruth2019-01-191-4/+3
| | | | | | | | | | | | | | | | | to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636
* [libFuzzer] Remove unstable edge handlingJonathan Metzman2019-01-151-2/+0
| | | | | | | | | | Summary: Remove code for handling unstable edges from libFuzzer since it has not been found useful. Differential Revision: https://reviews.llvm.org/D56730 llvm-svn: 351262
* [libFuzzer] Remove mutation stats and weighted mutation selection.Max Moroz2018-08-291-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This was an experimental feature. After evaluating it with: 1) https://github.com/google/fuzzer-test-suite/tree/master/engine-comparison 2) enabling on real world fuzz targets running at ClusterFuzz and OSS-Fuzz The following conclusions were made: 1) With fuzz targets that have reached a code coverage plateau, the feature does not improve libFuzzer's ability to discover new coverage and may actually negatively impact it. 2) With fuzz targets that have not yet reached a code coverage plateau, the feature might speed up new units discovery in some cases, but it is quite rare and hard to confirm with a high level on confidence. Revert of https://reviews.llvm.org/D48054 and https://reviews.llvm.org/D49621. Reviewers: metzman, morehouse Reviewed By: metzman, morehouse Subscribers: delcypher, #sanitizers, llvm-commits, kcc Differential Revision: https://reviews.llvm.org/D51455 llvm-svn: 340976
* [libFuzzer] Initial implementation of weighted mutation leveraging during ↵Max Moroz2018-08-021-0/+1
| | | | | | | | | | | | | | | | | | | | | runtime. Summary: Added functions that calculate stats while fuzz targets are running and give mutations weight based on how much new coverage they provide, and choose better performing mutations more often. Patch by Kodé Williams (@kodewilliams). Reviewers: Dor1s, metzman, morehouse Reviewed By: Dor1s, morehouse Subscribers: delcypher, kcc, llvm-commits, #sanitizers Differential Revision: https://reviews.llvm.org/D49621 llvm-svn: 338776
* [libFuzzer] Handle unstable edges by using minimum hit countsMax Moroz2018-07-231-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Summary: Created unstable_handle flag that takes 1 or 2, depending on the handling type. Modified RunOne to accommodate the following heuristic: Use the first CollectFeatures to count how many features there are. If no new features, CollectFeatures like before. If there is new feature, we run CB 2 more times, Check which edges are unstable per input and we store the least amount of hit counts for each edge. Apply these hit counts back to inline8bitcounters so that CollectFeatures can work as intended. Modified UnstableCounters to 8int_t and created a bitset UnstableSet to tell which edges are unstable. Patch by Kyungtak Woo (@kevinwkt). Reviewers: Dor1s, metzman, morehouse Reviewed By: Dor1s, morehouse Subscribers: delcypher, #sanitizers, llvm-commits, kcc Differential Revision: https://reviews.llvm.org/D49525 llvm-svn: 337696
* [libFuzzer] Mutation tracking and logging implemented.Max Moroz2018-07-171-0/+1
| | | | | | | | | | | | | | | | | | | Summary: Code now exists to track number of mutations that are used in fuzzing in total and ones that produce new coverage. The stats are currently being dumped to the command line. Patch by Kodé Williams (@kodewilliams). Reviewers: metzman, Dor1s, morehouse, kcc Reviewed By: Dor1s, morehouse, kcc Subscribers: delcypher, kubamracek, kcc, morehouse, llvm-commits, #sanitizers, mgorny Differential Revision: https://reviews.llvm.org/D48054 llvm-svn: 337324
* Revert r337194 (https://reviews.llvm.org/D48891) due to compilation errors.Max Moroz2018-07-161-1/+0
| | | | llvm-svn: 337206
* [libFuzzer] Mutation tracking and logging implemented.Max Moroz2018-07-161-0/+1
| | | | | | | | | | | | | | | | | | | Summary: Code now exists to track number of mutations that are used in fuzzing in total and ones that produce new coverage. The stats are currently being dumped to the command line. Patch by Kodé Williams (@kodewilliams). Reviewers: metzman, Dor1s, morehouse, kcc Reviewed By: Dor1s, morehouse, kcc Subscribers: delcypher, kubamracek, kcc, morehouse, llvm-commits, #sanitizers, mgorny Differential Revision: https://reviews.llvm.org/D48054 llvm-svn: 337194
* [libFuzzer] Implement stat::stability_rate based on the percentage of ↵Max Moroz2018-07-161-0/+1
| | | | | | | | | | | | | | | | | | | | | unstable edges. Summary: Created a -print_unstable_stats flag. When -print_unstable_stats=1, we run it 2 more times on interesting inputs poisoning unstable edges in an array. On program termination, we run PrintUnstableStats() which will print a line with a stability percentage like AFL does. Patch by Kyungtak Woo (@kevinwkt). Reviewers: metzman, Dor1s, kcc, morehouse Reviewed By: metzman, Dor1s, morehouse Subscribers: delcypher, llvm-commits, #sanitizers, kcc, morehouse, Dor1s Differential Revision: https://reviews.llvm.org/D49212 llvm-svn: 337187
* Revert r337175 (https://reviews.llvm.org/D49212) due to unintentional format ↵Max Moroz2018-07-161-1/+0
| | | | | | changes. llvm-svn: 337180
* [libFuzzer] Implement stat::stability_rate based on the percentage of ↵Max Moroz2018-07-161-0/+1
| | | | | | | | | | | | | | | | | | | | | unstable edges. Summary: Created a -print_unstable_stats flag. When -print_unstable_stats=1, we run it 2 more times on interesting inputs poisoning unstable edges in an array. On program termination, we run PrintUnstableStats() which will print a line with a stability percentage like AFL does. Patch by Kyungtak Woo (@kevinwkt). Reviewers: metzman, Dor1s, kcc, morehouse Reviewed By: metzman, Dor1s, morehouse Subscribers: delcypher, llvm-commits, #sanitizers, kcc, morehouse, Dor1s Differential Revision: https://reviews.llvm.org/D49212 llvm-svn: 337175
* Revert "[libFuzzer] Mutation tracking and logging implemented"Matt Morehouse2018-07-091-1/+0
| | | | | | This reverts r336597 due to bot breakage. llvm-svn: 336616
* [libFuzzer] Mutation tracking and logging implementedMatt Morehouse2018-07-091-0/+1
| | | | | | | | | | | | Code now exists to track number of mutations that are used in fuzzing in total and ones that produce new coverage. The stats are currently being dumped to the command line. Patch By: Kode Williams Differntial Revision: https://reviews.llvm.org/D48054 llvm-svn: 336597
* [libFuzzer] add one more value profile metric, under a flag (experimental)Kostya Serebryany2018-07-031-1/+1
| | | | llvm-svn: 336234
* [libFuzzer] remove an experimental flag -use_feature_frequencyKostya Serebryany2018-06-061-1/+0
| | | | llvm-svn: 334146
* [libFuzzer] initial implementation of -data_flow_trace. It parses the data ↵Kostya Serebryany2018-06-061-0/+1
| | | | | | flow trace and prints the summary, but doesn't use the information in any other way yet llvm-svn: 334058
* [libFuzzer] reinstate -dump_coverage, which is still in use (reverts r332036)Kostya Serebryany2018-05-211-0/+1
| | | | llvm-svn: 332876
* [libFuzzer] add an experimental flag -focus_function: libFuzzer will try to ↵Kostya Serebryany2018-05-161-0/+1
| | | | | | focus on inputs that trigger that function llvm-svn: 332554
* [libFuzzer] remove the dump_coverage flag, it hasn't been working with the ↵Kostya Serebryany2018-05-101-1/+0
| | | | | | inline sanitizer coverage anyway llvm-svn: 332036
* [libFuzzer] remove the experimental support for clang coverage ↵Kostya Serebryany2018-05-101-1/+0
| | | | | | instrumentation. This mode has not been used and our experiments with https://github.com/google/fuzzer-test-suite show that this signal is weaker than the SanitizerCoverage llvm-svn: 332034
* [libFuzzer] Set -experimental_len_control=1000 as default.Matt Morehouse2018-02-131-1/+1
| | | | | | | | | | | | | | | | | | | | Summary: Experiments using https://github.com/google/fuzzer-test-suite/tree/master/engine-comparison show a significant increase in coverage and reduction in corpus size with this option enabled. Addresses https://llvm.org/pr36371. Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D42932 llvm-svn: 325050
* [libFuzzer] honor -use_counters, sligntly change the meaning of ↵Kostya Serebryany2017-12-081-1/+1
| | | | | | -experimental_len_control, call UpdateFeatureFrequency only if instructed by the flag llvm-svn: 320205
* [libFuzzer] add a flag -malloc_limit_mbKostya Serebryany2017-12-011-0/+1
| | | | llvm-svn: 319590
* [libFuzzer] remove stale flags; NFCKostya Serebryany2017-12-011-1/+0
| | | | llvm-svn: 319572
* [libFuzzer] add an experimental search heuristic flag -reduce_depthKostya Serebryany2017-12-011-0/+1
| | | | llvm-svn: 319571
* [libFuzzer] handle SIGUSR1/SIGUSR2 and try to exit grafully on these signalsKostya Serebryany2017-11-091-0/+2
| | | | llvm-svn: 317829
* [libFuzzer] Periodically purge allocator's quarantine to prolong fuzzing ↵Alex Shlyapnikov2017-10-231-0/+1
| | | | | | | | | | | | | | | | | | | | | sessions. Summary: Fuzzing targets that allocate/deallocate a lot of memory tend to consume a lot of RSS when ASan quarantine is enabled. Purging quarantine between iterations and returning memory to OS keeps RSS down and should not reduce the quarantine effectiveness provided the fuzz target does not preserve state between iterations (in this case this feature can be turned off). Based on D39153. Reviewers: vitalybuka Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D39155 llvm-svn: 316382
* [libFuzzer] experimental flag to tweak the corpus distribution. Seems to ↵Kostya Serebryany2017-10-111-0/+1
| | | | | | improve the situation dramatically on the png benchmark and make things worse on a number of micro-puzzles. Needs more A/B testing llvm-svn: 315407
* [libFuzzer] Disable experimental clang coverage support by default.Max Moroz2017-10-051-0/+1
| | | | | | | | | | | | | | | | | Summary: It can be enabled via "-use_clang_coverage=1" flag. Reason for disabling: libFuzzer resets Clang Counters and makes it impossible to generate coverage report for a regular fuzz target (i.e. not standalone build). Reviewers: kcc Reviewed By: kcc Subscribers: kcc Differential Revision: https://reviews.llvm.org/D38604 llvm-svn: 315029
* [libFuzzer] allow -print_funcs=N: N is the max number of new covered ↵Kostya Serebryany2017-08-281-1/+1
| | | | | | function printed llvm-svn: 311945
* [libFuzzer] add -print_funcs=1 (on bey default): print newly discovered ↵Kostya Serebryany2017-08-251-0/+1
| | | | | | functions during fuzzing llvm-svn: 311797
* Move libFuzzer to compiler_rt.George Karpenkov2017-08-211-0/+68
Resulting library binaries will be named libclang_rt.fuzzer*, and will be placed in Clang toolchain, allowing redistribution. Differential Revision: https://reviews.llvm.org/D36908 llvm-svn: 311407
OpenPOWER on IntegriCloud