RPCS3/llvm-mirror
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm-mirror.git synced 2024-10-25 05:52:53 +02:00
Code Issues Projects Releases Wiki Activity
135,013 Commits 4 Branches 5 Tags 704 MiB
6dc1488d32
Commit Graph

134 Commits

Author SHA1 Message Date
Mike Aizatsky
a189dc444c [libfuzzer] moving is_ascii handler inside mutation dispatcher. 
Summary: It also fixes a bug, when first random might not be ascii.

Differential Revision: http://reviews.llvm.org/D21573

llvm-svn: 273611
 2016-06-23 20:44:48 +00:00
Kostya Serebryany
865f69ffc1 [libFuzzer] use the new chainable malloc hooks instead of the old un-chainable ones, use atomic for malloc/free counters instead of a thread local counter in the main thread. This should make on-the-spot leak detection in libFuzzer more reliable 
llvm-svn: 272948
 2016-06-16 20:17:41 +00:00
Kostya Serebryany
1b5f4c4e10 [libFuzzer] add 'weak' back to __sanitizer_malloc_hook and __sanitizer_free_hook 
llvm-svn: 272116
 2016-06-08 04:49:29 +00:00
Kostya Serebryany
1d9584b1f3 [libFuzzer] add a test that is built w/o coverage instrumentation but has the coverage rt (it should now fail with a descriptive message) 
llvm-svn: 272090
 2016-06-08 01:46:13 +00:00
Dan Liew
c8948855b6 [LibFuzzer] Declare and use sanitizer functions in `fuzzer::ExternalFunctions` 
This fixes linking problems on OSX.

Unfortunately it turns out we need to use an instance of the
``fuzzer::ExternalFunctions`` object in several places so this
commit also replaces all instances with a single global instance.

It also turns out initializing a global ``fuzzer::ExternalFunctions``
before main is entered (i.e. letting the object be initialised by the
global initializers) is not safe (on OSX the call to ``Printf()`` in the
CTOR crashes if it is called from a global initializer) so we instead
have a global ``fuzzer::ExternalFunctions*`` and initialize it inside
``FuzzerDriver()``.

Multiple unit tests depend also depend on the
``fuzzer::ExternalFunctions*`` global so a ``main()`` function has been
added that initializes it before running any tests.

Differential Revision: http://reviews.llvm.org/D20943

llvm-svn: 272072
 2016-06-07 23:32:50 +00:00
Mike Aizatsky
971be03956 [libfuzzer] prune_corpus option for disabling pruning during the load. 
Summary:
The option is very useful for testing, plus I intend to measure
its effect on fuzzer effectiveness.

Differential Revision: http://reviews.llvm.org/D21084

llvm-svn: 272035
 2016-06-07 18:16:32 +00:00
Mike Aizatsky
e89c6e8b16 [libfuzzer] hiding custom mutator handling in MutationDispatcher. 
Summary: Refactoring, no functional changes.

Differential Revision: http://reviews.llvm.org/D20975

llvm-svn: 271740
 2016-06-03 21:34:29 +00:00
Dan Liew
8b5c81728c [LibFuzzer] Reimplement how the optional user functions are called. 
The motivation for this change is to fix linking issues on OSX.
However this only partially fixes linking issues (the uninstrumented
tests and a few others  won't succesfully link yet).

This change introduces a struct of function pointers
(``fuzzer::ExternalFuntions``) which when initialised will point to the
optional functions if they are available.  Currently these
``LLVMFuzzerInitialize`` and ``LLVMFuzzerCustomMutator`` functions.

Two implementations of ``fuzzer::ExternalFunctions`` constructor are
provided one for Linux and one for OSX.

The OSX implementation uses ``dlsym()`` because the prior implementation
using weak symbols does not work unless the additional flags are passed
to the linker.

The Linux implementation continues to use weak symbols because the
``dlsym()`` approach does not work unless additional flags are passed
to the linker.

Differential Revision: http://reviews.llvm.org/D20741

llvm-svn: 271491
 2016-06-02 05:48:02 +00:00
Kostya Serebryany
e2d6b2454c [libFuzzer] use __sanitizer_print_memory_profile to print the memory profile on OOM 
llvm-svn: 271465
 2016-06-02 01:33:11 +00:00
Kostya Serebryany
21c058bf71 [libFuzzer] fix a use-after-free (!) in libFuzzer caused by r270905: that CL caused a push_back in the main corpus invalidating the vector<> iterators in rare cases. 
llvm-svn: 271186
 2016-05-29 15:58:57 +00:00
Kostya Serebryany
30ef81698e [libFuzzer] fix a failure that occurs when running individual inputs 
llvm-svn: 271095
 2016-05-28 04:19:46 +00:00
Kostya Serebryany
9f5eabe7a7 [libFuzzer] make OOM-handling more portable. Instead of sending a signal to the main fuzzing thread, print the message in the getrusage thread and exit. 
llvm-svn: 270945
 2016-05-27 00:54:15 +00:00
Kostya Serebryany
becd6c1393 [libFuzzer] more refactoring: make sure CurrentUnitData is awlays a valid pointer to read from 
llvm-svn: 270942
 2016-05-27 00:21:33 +00:00
Kostya Serebryany
c5d4c0f8da [libFuzzer] more refactoring around CurrentUnit. Also add a threading test on which we currently have a race (when reporting bugs from multiple threads) 
llvm-svn: 270929
 2016-05-26 22:17:32 +00:00
Kostya Serebryany
14432c81d1 [libFuzzer] refactor: hide CurrentUnitData inside an interface function. NFC 
llvm-svn: 270922
 2016-05-26 21:32:30 +00:00
Kostya Serebryany
e6c20bc756 [libFuzzer] when there is a leak in the existing corpus report the reproducer properly 
llvm-svn: 270905
 2016-05-26 20:25:49 +00:00
Kostya Serebryany
7477d2d4c2 [libFuzzer] reimplement the way we do -only_ascii to allow more 'const' in function declarations. Add a test for -only_ascii. NFC intended 
llvm-svn: 270900
 2016-05-26 20:03:02 +00:00
Kostya Serebryany
10bbd18b43 [libFuzzer] print stats if we crash on empty input 
llvm-svn: 270639
 2016-05-25 00:15:36 +00:00
Mike Aizatsky
785d92e27f [libfuzzer] Trying random unit prefixes during corpus load. 
Differential Revision: http://reviews.llvm.org/D20301

llvm-svn: 270632
 2016-05-24 23:14:29 +00:00
Dan Liew
2063e3f97b [LibFuzzer] 
Work around crashes in ``__sanitizer_malloc_hook()`` under Mac OSX.

Under Mac OSX we intercept calls to malloc before thread local
storage is initialised leading to a crash when accessing
``AllocTracer``. To workaround this ``AllocTracer`` is only accessed
in the hook under Linux. For symmetry ``__sanitizer_free_hook()``
is also modified in the same way.

To support this change a set of new macros
LIBFUZZER_LINUX and LIBFUZZER_APPLE has been defined which can be
used to check the target being compiled for.

Differential Revision: http://reviews.llvm.org/D20402

llvm-svn: 270145
 2016-05-19 22:00:33 +00:00
Kostya Serebryany
1748b79bc0 [libFuzzer] do the merge faster and a bit less precise 
llvm-svn: 269497
 2016-05-13 22:11:23 +00:00
Kostya Serebryany
50c6e0a004 [libFuzzer] simplify FuzzerInterface.h 
llvm-svn: 269448
 2016-05-13 18:04:35 +00:00
Mike Aizatsky
af34cb696d [libfuzzer] Refactoring coverage state-management code. 
It is now less state-dependent and will allow easier comparing of
coverages of different units.

Differential Revision: http://reviews.llvm.org/D20085

llvm-svn: 269140
 2016-05-10 23:43:15 +00:00
Kostya Serebryany
6a10031791 [libFuzzer] enhance -rss_limit_mb and enable by default. Now it will print the OOM reproducer. 
llvm-svn: 268821
 2016-05-06 23:38:07 +00:00
Kostya Serebryany
2583e597c6 [libFuzzer] add exeprimental -rss_limit_mb flag to fight against OOMs 
llvm-svn: 268807
 2016-05-06 21:58:35 +00:00
Kostya Serebryany
51ec9a55f7 [libFuzzer] disable leak detection if we have tried it for 1000 times w/o finding a leak 
llvm-svn: 267770
 2016-04-27 19:52:34 +00:00
Kostya Serebryany
1b0fefb3d9 [libFuzzer] remove dead code 
llvm-svn: 267455
 2016-04-25 19:41:45 +00:00
Kostya Serebryany
13bad441e8 [libFuzzer] added -detect_leaks flag (0 by default for now). When enabled, it will help finding leaks while fuzzing 
llvm-svn: 266838
 2016-04-20 00:24:21 +00:00
Kostya Serebryany
f09765cd99 [libFuzzer] try to print correct time in seconds when reporting a timeout. Don't report timeouts while still loading the corpus. 
llvm-svn: 266693
 2016-04-18 22:50:39 +00:00
Mike Aizatsky
3b54b31344 [libfuzzer] defensive assert 
llvm-svn: 265866
 2016-04-08 23:32:24 +00:00
Kostya Serebryany
0cd69a5030 [libFuzzer] don't report memory leaks if we are dying due to a timeout (just use _Exit instead of exit in the timeout callback) 
llvm-svn: 264237
 2016-03-24 01:32:08 +00:00
Benjamin Kramer
fe1074fc43 [Fuzzer] Guard no_sanitize_memory attributes behind __has_feature. 
Otherwise GCC fails to build it because it doesn't know the attribute.

llvm-svn: 263787
 2016-03-18 14:19:19 +00:00
Kostya Serebryany
c99e69af78 [libFuzzer] improve -merge functionality 
llvm-svn: 263769
 2016-03-18 00:23:29 +00:00
Kostya Serebryany
e634bbeadd [libFuzzer] deprecate several flags 
llvm-svn: 263739
 2016-03-17 19:59:39 +00:00
Kostya Serebryany
d8cee1fdf1 [libFuzzer] add __attribute__((no_sanitize_memory)) to two functions that may be called from signal handler(s) or from msan. This will hopefully avoid msan false reports which I can't reproduce 
llvm-svn: 263737
 2016-03-17 19:42:35 +00:00
Kostya Serebryany
5b93d4b15a [libFuzzer] try to use max_len based on the items of the corpus instead of blindly defaulting to 64 bytes. 
llvm-svn: 263323
 2016-03-12 01:57:04 +00:00
Kostya Serebryany
fc674d4015 [libFuzzer] when interrupted, call _Exit() instead of exit() 
llvm-svn: 262667
 2016-03-03 22:36:37 +00:00
Kostya Serebryany
96af1208c1 [libFuzzer] deprecate exit_on_first flag 
llvm-svn: 262417
 2016-03-01 22:33:14 +00:00
Kostya Serebryany
d5755334e5 [libFuzzer] add generic signal handlers so that libFuzzer can report at least something if ASan is not handlig the signals for us. Remove abort_on_timeout flag. 
llvm-svn: 262415
 2016-03-01 22:19:21 +00:00
Kostya Serebryany
503e17c728 [libFuzzer] add -print_final_stats=1 flag 
llvm-svn: 262084
 2016-02-26 22:42:23 +00:00
Kostya Serebryany
a9a412139e [libFuzzer] initial implementation of path coverage based on -fsanitize-coverage=trace-pc. This does not scale well yet, but already cracks FullCoverageSetTest in seconds 
llvm-svn: 262073
 2016-02-26 21:33:56 +00:00
Kostya Serebryany
7ef7f142ff [libFuzzer] only read MaxLen bytes from every file in the corpus to speedup loading the corpus 
llvm-svn: 261267
 2016-02-18 21:49:10 +00:00
Kostya Serebryany
a45a009f24 [libFuzzer] don't timeout when loading the corpus. Be a bit more verbose when loading large corpus. 
llvm-svn: 261143
 2016-02-17 19:42:34 +00:00
Kostya Serebryany
abc380db58 [libFuzzer] remove std::vector operations from hot paths, NFC 
llvm-svn: 260829
 2016-02-13 17:56:51 +00:00
Kostya Serebryany
bf966c5f23 [libFuzzer] don't require seed in fuzzer::Mutate, instead use the global Fuzzer object for fuzzer::Mutate. This makes custom mutators fast 
llvm-svn: 260810
 2016-02-13 06:24:18 +00:00
Kostya Serebryany
b9687a1cc3 [libFuzzer] get rid of UserSuppliedFuzzer; NFC 
llvm-svn: 260798
 2016-02-13 03:25:16 +00:00
Kostya Serebryany
b2451a8b09 [libFuzzer] provide a plain C interface for custom mutators (experimental) 
llvm-svn: 260794
 2016-02-13 02:29:38 +00:00
Kostya Serebryany
036c2a2dea [libFuzzer] don't write the test unit when a leak is detected (since we don't know which unit causes the leak) 
llvm-svn: 259731
 2016-02-04 00:02:17 +00:00
Kostya Serebryany
e3ec64cf18 [libFuzzer] add -timeout_exitcode option 
llvm-svn: 259265
 2016-01-29 23:30:07 +00:00
Kostya Serebryany
0c11655f17 [libFuzzer] add -abort_on_timeout option 
llvm-svn: 258631
 2016-01-23 19:34:19 +00:00