summaryrefslogtreecommitdiffstats
path: root/compiler-rt/lib/fuzzer/tests
Commit message (Collapse)AuthorAgeFilesLines
* reland [gtest] Fix printing of StringRef and SmallString in assert messages.Sam McCall2019-08-211-2/+2
| | | | | | | | | Renames GTEST_NO_LLVM_RAW_OSTREAM -> GTEST_NO_LLVM_SUPPORT and guards the new features behind it. This reverts commit a063bcf3ef5a879adbe9639a3c187d876eee0e66. llvm-svn: 369527
* [compiler-rt] Add ConsumeProbability and ConsumeFloatingPoint methods to FDP.Max Moroz2019-08-082-2/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: Also slightly cleaned up the comments and changed the header's extension back to `.h` as per comments on https://reviews.llvm.org/D65812. New methods added: * `ConsumeProbability` returns [0.0, 1.0] by consuming an unsigned integer value from the input data and dividing that value by the integer's max value. * `ConsumeFloatingPointInRange` returns a floating point value in the given range. Relies on `ConsumeProbability` method. This method does not have the limitation of `std::uniform_real_distribution` that requires the given range to be <= the floating point type's max. If the range is too large, this implementation will additionally call `ConsumeBool` to decide whether the result will be in the first or the second half of the range. * `ConsumeFloatingPoint` returns a floating point value in the range `[std::numeric_limits<T>::lowest(), std::numeric_limits<T>::min()]`. Tested on Linux, Mac, Windows. Reviewers: morehouse Reviewed By: morehouse Subscribers: kubamracek, mgorny, dberris, delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D65905 llvm-svn: 368331
* [compiler-rt] Rename FuzzedDataProvider.h to .hpp and other minor changes.Max Moroz2019-08-061-1/+1
| | | | | | | | | | | | | | | | | | Summary: .hpp makes more sense for this header as it's C++ only, plus it contains the actual implementation. Reviewers: Dor1s Reviewed By: Dor1s Subscribers: kubamracek, dberris, mgorny, delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D65812 llvm-svn: 368054
* [compiler-rt] Move FDP to include/fuzzer/FuzzedDataProvider.h for easier use.Max Moroz2019-08-052-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: FuzzedDataProvider is a helper class for writing fuzz targets that fuzz multple inputs simultaneously. The header is supposed to be used for fuzzing engine agnostic fuzz targets (i.e. the same target can be used with libFuzzer, AFL, honggfuzz, and other engines). The common thing though is that fuzz targets are typically compiled with clang, as it provides all sanitizers as well as different coverage instrumentation modes. Therefore, making this FDP class a part of the compiler-rt installation package would make it easier to develop and distribute fuzz targets across different projects, build systems, etc. Some context also available in https://github.com/google/oss-fuzz/pull/2547. This CL does not delete the header from `lib/fuzzer/utils` directory in order to provide the downstream users some time for a smooth migration to the new header location. Reviewers: kcc, morehouse Reviewed By: morehouse Subscribers: lebedev.ri, kubamracek, dberris, mgorny, delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D65661 llvm-svn: 367917
* [libFuzzer] Include FuzzedDataProvider.h in the test without "utils" subdir.Max Moroz2019-07-092-1/+3
| | | | | | | | | | | | | | | | | | Summary: This way the test would better match the intended usage of the header, plus it makes some additional testing (e.g. in CI) a bit easier to set up. Reviewers: morehouse Reviewed By: morehouse Subscribers: mgorny, delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D64440 llvm-svn: 365544
* [libFuzzer] Improve FuzzedDataProvider helper.Max Moroz2019-06-181-9/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: The following changes are made based on the feedback from Tim King: - Removed default template parameters, to have less assumptions. - Implemented `ConsumeBytesWithTerminator` method. - Made `PickValueInArray` method work with `initializer_list` argument. - Got rid of `data_type` type alias, that was redundant. - Refactored `ConsumeBytes` logic into a private method for better code reuse. - Replaced implementation defined unsigned to signed conversion. - Fixed `ConsumeRandomLengthString` to always call `shrink_to_fit`. - Clarified and fixed some commments. - Applied clang-format to both the library and the unittest source. Tested on Linux, Mac, Windows. Reviewers: morehouse, metzman Reviewed By: morehouse Subscribers: delcypher, #sanitizers, llvm-commits, kcc Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D63348 llvm-svn: 363735
* [libFuzzer] in autofocus mode, give more weight to functions with DFTKostya Serebryany2019-06-141-1/+7
| | | | llvm-svn: 363473
* Add FuzzedDataProvider helper class / single header library.Max Moroz2019-06-112-2/+338
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This class is useful for writing fuzz target that have multiple inputs. Current CL imports the existing `FuzzedDataProvider` from Chromium without any modifications. Feel free to review it thoroughly, if you're interested, but I'd prefer changing the class in a follow up CL. The CL also introduces an exhaustive test for the library, as the behavior of `FuzzedDataProvider` must not change over time. In follow up CLs I'm planning on changing some implementation details (I can share a doc with some comments to be addressed). After that, we will document how `FuzzedDataProvider` should be used. I have tested this on Linux, Windows and Mac platforms. Reviewers: morehouse, metzman, kcc Reviewed By: morehouse Subscribers: metzman, thakis, rnk, mgorny, ormris, delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D62733 llvm-svn: 363071
* [libFuzzer] implement -focus_function=auto, to be used with Data Flow TracesKostya Serebryany2019-05-091-0/+86
| | | | llvm-svn: 360378
* [CMake][LibFuzzer] Match symbol visibility setting between LibFuzzer object ↵Dan Liew2019-02-281-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | files and unit tests. Summary: This fixes inconsistent symbol visibility. This shows up as a linker warning if r336238 (43f633564e338a6dde83d49a48e5bfcbfdce292c) is reverted. ``` ld: warning: direct access in function 'fuzzer::CleanseCrashInput(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, fuzzer::fuzzer_allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&, fuzzer::FuzzingOptions const&)' from file '/Volumes/data/dev/llvm/upstream/master/builds/projects/compiler-rt/lib/fuzzer/tests/libRTFuzzerTest.x86_64.a(FuzzerDriver.cpp.o)' to global weak symbol 'fuzzer::Command::ignoreRemainingArgs()::kIgnoreRemaining' from file 'FuzzerTestObjects.FuzzerUnittest.cpp.x86_64.o' means the weak symbol cannot be overridden at runtime. This was likely caused by different translation units being compiled with different visibility settings. ``` r336238 just hid the issue rather than fixing the real issue. On macOS and other platforms we usually compile with `-fvisibility=hidden` but the unit tests were compiled without this flag. Reviewers: george.karpenkov, kubamracek, kcc, yln Subscribers: mgorny, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D58055 llvm-svn: 355143
* [compiler-rt] Fix broken sanitizer bots (hopefully)Jonas Hahnfeld2019-02-171-3/+0
| | | | | | | | | | | | | | | | | | | According to the logs and local debugging there were two issues: 1) tsan tests listed libc++.a before the source file. That's usually ok for shared libraries, but the linker will not add symbols from a static library unless needed at that time. As a result the tests that rely upon symbols from the library (and not only include the headers) had undefined references. To solve this I'm adding a new substitution %link_libcxx_tsan which expands to libc++.a if available. 2) The target Fuzzer-x86_64-Test linked in SANITIZER_TEST_CXX_LIBRARIES which defaults to -lstdc++. This resulted in error messages like hidden symbol '_ZdlPv' is not defined locally hidden symbol '_Znwm' is not defined locally when using GNU gold (ld.bfd and lld are fine). Removing the linkage is fine because we build a custom libc++ for that purpose. llvm-svn: 354231
* [compiler-rt] Build custom libcxx with libcxxabiJonas Hahnfeld2019-02-171-2/+6
| | | | | | | | | | | | | | | This changes add_custom_libcxx to also build libcxxabi and merges the two into a static and hermetic library. There are multiple advantages: 1) The resulting libFuzzer doesn't expose C++ internals and looks like a plain C library. 2) We don't have to manually link in libstdc++ to provide cxxabi. 3) The sanitizer tests cannot interfere with an installed version of libc++.so in LD_LIBRARY_PATH. Differential Revision: https://reviews.llvm.org/D58013 llvm-svn: 354212
* [compiler-rt] Cleanup usage of C++ ABI libraryJonas Hahnfeld2019-02-161-4/+5
| | | | | | | | | | | | | Add missed value "libcxxabi" and introduce SANITIZER_TEST_CXX for linking unit tests. This needs to be a full C++ library and cannot be libcxxabi. Recommit r354132 which I reverted in r354153 because it broke a sanitizer bot. This was because of the "fixes" for pthread linking, so I've removed these changes. Differential Revision: https://reviews.llvm.org/D58012 llvm-svn: 354198
* Revert "[compiler-rt] Cleanup usage of C++ ABI library"Jonas Hahnfeld2019-02-151-5/+4
| | | | | | | This reverts r354132 because it breaks sanitizer-x86_64-linux: http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux/builds/19915 llvm-svn: 354153
* [compiler-rt] Cleanup usage of C++ ABI libraryJonas Hahnfeld2019-02-151-4/+5
| | | | | | | | | Add missed value "libcxxabi" and introduce SANITIZER_TEST_CXX for linking unit tests. This needs to be a full C++ library and cannot be libcxxabi. Differential Revision: https://reviews.llvm.org/D58012 llvm-svn: 354132
* [libFuzzer] fix the unit testsKostya Serebryany2019-02-151-6/+6
| | | | llvm-svn: 354088
* [libFuzzer] when doing the merge, keep track of the coveraged edges, not ↵Kostya Serebryany2019-02-141-25/+25
| | | | | | just features llvm-svn: 354076
* [libFuzzer] replace slow std::mt19937 with a much faster std::minstd_rand; ↵Kostya Serebryany2019-02-121-1/+2
| | | | | | second attempt after failed r352732, this time with a fix for cmake llvm-svn: 353782
* [libFuzzer] more refactoring; change some of the exit codes (timeout, OOM, ↵Kostya Serebryany2019-02-091-4/+6
| | | | | | interrupt) so that the parent process can distinguish those llvm-svn: 353584
* [libFuzzer] remove two unused experimental flagsKostya Serebryany2019-02-081-3/+0
| | | | llvm-svn: 353573
* [libFuzzer] introduce an experimental mode -fork=1, where fuzzing happens in ↵Kostya Serebryany2019-02-081-3/+3
| | | | | | a subprocess (still running multiple inputs per process), thus making the fuzzing more resilient to timeouts and OOMs. This is just a skeleton of the code, and some associated refactoring, not a fully working feature yet. llvm-svn: 353570
* Update the file headers across all of the LLVM projects in the monorepoChandler Carruth2019-01-191-2/+3
| | | | | | | | | | | | | | | | | to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636
* [test] Add missing cmake include for building libFuzzer aloneMichal Gorny2018-12-061-0/+2
| | | | | | | | | | | | | | Include CompilerRTCompile in fuzzer tests explicitly. Otherwise, when building only libFuzzer, CMake fails due to: CMake Error at cmake/Modules/AddCompilerRT.cmake:395 (sanitizer_test_compile): Unknown CMake command "sanitizer_test_compile". Call Stack (most recent call first): lib/fuzzer/tests/CMakeLists.txt:53 (generate_compiler_rt_tests) Differential Revision: https://reviews.llvm.org/D55378 llvm-svn: 348524
* [compiler-rt][Fuzzer] Fix the fuzzer test buildPetr Hosek2018-11-021-2/+2
| | | | | | | | | This fixes the issue introduced in r345765 which changed the way in which the embedded libc++ is being built but omitted tests. Differential Revision: https://reviews.llvm.org/D54058 llvm-svn: 346052
* [libfuzzer][Windows] Silence linker warning in unittestJonathan Metzman2018-10-141-3/+1
| | | | | | | | | | | | | | | | Summary: Silence warning when linking unittest binary by not passing -lstdc++ to the linker since it is ignored. Reviewers: morehouse Reviewed By: morehouse Subscribers: mgorny Differential Revision: https://reviews.llvm.org/D53225 llvm-svn: 344480
* [libFuzzer] Port to WindowsMatt Morehouse2018-08-302-0/+9
| | | | | | | | | | | | | | | | | | | | Summary: Port libFuzzer to windows-msvc. This patch allows libFuzzer targets to be built and run on Windows, using -fsanitize=fuzzer and/or fsanitize=fuzzer-no-link. It allows these forms of coverage instrumentation to work on Windows as well. It does not fix all issues, such as those with -fsanitize-coverage=stack-depth, which is not usable on Windows as of this patch. It also does not fix any libFuzzer integration tests. Nearly all of them fail to compile, fixing them will come in a later patch, so libFuzzer tests are disabled on Windows until them. Patch By: metzman Reviewers: morehouse, rnk Reviewed By: morehouse, rnk Subscribers: #sanitizers, delcypher, morehouse, kcc, eraman Differential Revision: https://reviews.llvm.org/D51022 llvm-svn: 341082
* Revert "[libFuzzer] Port to Windows"Matt Morehouse2018-08-292-9/+0
| | | | | | This reverts r340949 due to bot breakage again. llvm-svn: 340954
* [libFuzzer] Port to WindowsMatt Morehouse2018-08-292-0/+9
| | | | | | | | | | | | | | | | | | Summary: Port libFuzzer to windows-msvc. This patch allows libFuzzer targets to be built and run on Windows, using -fsanitize=fuzzer and/or fsanitize=fuzzer-no-link. It allows these forms of coverage instrumentation to work on Windows as well. It does not fix all issues, such as those with -fsanitize-coverage=stack-depth, which is not usable on Windows as of this patch. It also does not fix any libFuzzer integration tests. Nearly all of them fail to compile, fixing them will come in a later patch, so libFuzzer tests are disabled on Windows until them. Reviewers: morehouse, rnk Reviewed By: morehouse, rnk Subscribers: #sanitizers, delcypher, morehouse, kcc, eraman Differential Revision: https://reviews.llvm.org/D51022 llvm-svn: 340949
* Revert "[libFuzzer] Port to Windows"Matt Morehouse2018-08-282-9/+0
| | | | | | This reverts commit r340860 due to failing tests. llvm-svn: 340867
* [libFuzzer] Port to WindowsMatt Morehouse2018-08-282-0/+9
| | | | | | | | | | | | | | | | | | | | Summary: Port libFuzzer to windows-msvc. This patch allows libFuzzer targets to be built and run on Windows, using -fsanitize=fuzzer and/or fsanitize=fuzzer-no-link. It allows these forms of coverage instrumentation to work on Windows as well. It does not fix all issues, such as those with -fsanitize-coverage=stack-depth, which is not usable on Windows as of this patch. It also does not fix any libFuzzer integration tests. Nearly all of them fail to compile, fixing them will come in a later patch, so libFuzzer tests are disabled on Windows until them. Patch By: metzman Reviewers: morehouse, rnk Reviewed By: morehouse, rnk Subscribers: morehouse, kcc, eraman Differential Revision: https://reviews.llvm.org/D51022 llvm-svn: 340860
* [libFuzzer] first experimental attempt at DFT-based mutations ↵Kostya Serebryany2018-07-191-1/+2
| | | | | | (DFT=data-flow-trace) llvm-svn: 337434
* [libFuzzer] Do not turn unittest warnings into errors.Matt Morehouse2018-06-261-1/+0
| | | | | | | | Some warnings originating from googletest were causing bots to fail while bulding unit tests. The sanitizers address this issue by not using -Werror. We adopt this approach for libFuzzer. llvm-svn: 335640
* [Fuzzer] Don't hardcode target architecture for Fuzzer testsPetr Hosek2018-06-151-32/+34
| | | | | | | | | Don't hardcode the architecture for Fuzzer tests which breaks when compiler-rt is being compiled for architectures other than x86_64. Differential Revision: https://reviews.llvm.org/D48207 llvm-svn: 334852
* [libFuzzer] [NFC] Support multi-arch and multi-OS building and testingGeorge Karpenkov2018-06-141-0/+4
| | | | | | Differential Revision: https://reviews.llvm.org/D47296 llvm-svn: 334768
* [libFuzzer] make the corpus elements aware of their data flow tracesKostya Serebryany2018-06-071-1/+2
| | | | llvm-svn: 334158
* [libFuzzer] initial implementation of -data_flow_trace. It parses the data ↵Kostya Serebryany2018-06-061-0/+8
| | | | | | flow trace and prints the summary, but doesn't use the information in any other way yet llvm-svn: 334058
* [libFuzzer] Run libFuzzer unit tests only on host architecture.George Karpenkov2018-05-241-32/+33
| | | | | | | | | | LIT tests are used to test other cross-compiled architectures, unit tests are only run on the host. NFC now as currently only a single architecture is supported. Differential Revision: https://reviews.llvm.org/D47286 llvm-svn: 333241
* [libFuzzer] add an experimental flag -focus_function: libFuzzer will try to ↵Kostya Serebryany2018-05-161-1/+1
| | | | | | focus on inputs that trigger that function llvm-svn: 332554
* [LibFuzzer] Tweak `MutationDispatcher::Mutate_CopyPart` mutation.Dan Liew2018-04-241-0/+15
| | | | | | | | | | | | It doesn't make sense to non-deterministically choose between `CopyPart(..)` and `InsertPart(..)` when it is known that `InsertPart(..)` will fail. This upstream's a change from JFS solver's fork of LibFuzzer. Differential Revision: https://reviews.llvm.org/D45693 llvm-svn: 330687
* [LibFuzzer] Try to unbreak the `FuzzerMutate.ShuffleBytes1` unit test.Dan Liew2018-04-201-1/+1
| | | | | | | | | | | | | | This test is failing on my Linux box. Just increasing the number of iterations works around this. The divergence is likely due to our reliance on `std::shuffle()` which is not guaranteed to have the same behaviour across platforms. This is a strong argument for us to implement our own shuffle function to avoid divergence in behaviour across platforms. Differential Revision: https://reviews.llvm.org/D45767 llvm-svn: 330390
* [Fuzzer] Avoid the unnecessary rebuild of the custom libc++Petr Hosek2018-03-071-1/+1
| | | | | | | | | | | | This changes the add_custom_libcxx macro to resemble the llvm_ExternalProject_Add. The primary motivation is to avoid unnecessary libFuzzer rebuilds that are being done on every Ninja/Make invocation. The libc++ should be only rebuilt whenever the libc++ source itself changes. Differential Revision: https://reviews.llvm.org/D43213 llvm-svn: 326921
* Reland "[Fuzzer] Parametrize add_custom_libcxx"Petr Hosek2018-01-211-4/+4
| | | | | | | | | | | | | add_custom_libcxx uses the just built compiler and installs the built libc++, e.g. for testing, neither of which is desirable in case of Fuzzer where the libc++ should be built using the host compiler and it's only linked into the libFuzzer and should never be installed. This change introduces additional arguments to add_custom_libcxx to allow parametrizing its behavior. Differential Revision: https://reviews.llvm.org/D42330 llvm-svn: 323054
* Revert "[Fuzzer] Parametrize add_custom_libcxx"Petr Hosek2018-01-201-2/+2
| | | | | | This reverts commit r323032: failing on the sanitizer-x86_64-linux-autoconf bot. llvm-svn: 323033
* [Fuzzer] Parametrize add_custom_libcxxPetr Hosek2018-01-201-2/+2
| | | | | | | | | | | | | add_custom_libcxx uses the just built compiler and installs the built libc++, e.g. for testing, neither of which is desirable in case of Fuzzer where the libc++ should be built using the host compiler and it's only linked into the libFuzzer and should never be installed. This change introduces additional arguments to add_custom_libcxx to allow parametrizing its behavior. Differential Revision: https://reviews.llvm.org/D42330 llvm-svn: 323032
* Reland "[libFuzzer] Support using libc++"Petr Hosek2018-01-171-3/+13
| | | | | | | | | | | | This is needed in case the users of libFuzzer use libc++ in their code, which the fuzz target (libFuzzer) will be linked against. When libc++ source is available, we build a private version of it and link it against libFuzzer which allows using the same static library against codebases which use both libc++ and libstdc++. Differential Revision: https://reviews.llvm.org/D37631 llvm-svn: 322755
* Revert "[libFuzzer] Support using libc++"Petr Hosek2018-01-171-13/+3
| | | | | | This reverts commit r322604: test is failing for standalone compiler-rt. llvm-svn: 322689
* [libFuzzer] Support using libc++Petr Hosek2018-01-171-3/+13
| | | | | | | | | | | | This is needed in case the users of libFuzzer use libc++ in their code, which the fuzz target (libFuzzer) will be linked against. When libc++ source is available, we build a private version of it and link it against libFuzzer which allows using the same static library against codebases which use both libc++ and libstdc++. Differential Revision: https://reviews.llvm.org/D37631 llvm-svn: 322604
* lib Fuzzer FreeBSD supportKamil Rytarowski2018-01-121-2/+2
| | | | | | | | | | | | | | Summary: Patch by David CARLIER Reviewers: vitalybuka, kcc, dim, emaste, davide, morehouse, george.karpenkov Reviewed By: morehouse Subscribers: george.karpenkov, kubamracek, srhines, mgorny, emaste, krytarowski Differential Revision: https://reviews.llvm.org/D41642 llvm-svn: 322380
* [libFuzzer] Decrease stack usage in unit testsKostya Serebryany2017-12-061-26/+26
| | | | | | | | | | | | Summary: With 3 Dictionary objects, each containing space of ~16k DictionaryEntry objects, the MutationDispatcher object is fairly memory heavy. On platforms with a lower default stack size, this can cause panics in FuzzerUnittest as those tests stack-allocate the MutationDispatcher. This may be especially problematic for platforms that do not (yet) have a way to programmatically change their stack size, aside from link-time flags. In general, it seems more prudent to use the heap for an object of this size. Reviewers: kcc, morehouse Reviewed By: kcc Differential Revision: https://reviews.llvm.org/D40926 llvm-svn: 319988
* [libFuzzer] Make redirects happen in proper sequence.Matt Morehouse2017-12-051-1/+1
| | | | | | | "> file" must come before "2>&1" to have redirection occur correctly in all cases. Fixes a regression on minimize_two_crashes.test. llvm-svn: 319792
OpenPOWER on IntegriCloud