[llvm] r308577 - [libFuzzer] prototype implementation of recursion-depth coverage features (commented out; real implementation needs to use inlined instrumentation)
Kostya Serebryany via llvm-commits
llvm-commits at lists.llvm.org
Wed Jul 19 18:35:17 PDT 2017
Author: kcc
Date: Wed Jul 19 18:35:17 2017
New Revision: 308577
URL: http://llvm.org/viewvc/llvm-project?rev=308577&view=rev
Log:
[libFuzzer] prototype implementation of recursion-depth coverage features (commented out; real implementation needs to use inlined instrumentation)
Modified:
llvm/trunk/lib/Fuzzer/FuzzerLoop.cpp
llvm/trunk/lib/Fuzzer/FuzzerTracePC.cpp
llvm/trunk/lib/Fuzzer/FuzzerTracePC.h
llvm/trunk/lib/Fuzzer/FuzzerValueBitMap.h
llvm/trunk/lib/Fuzzer/test/DeepRecursionTest.cpp
Modified: llvm/trunk/lib/Fuzzer/FuzzerLoop.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Fuzzer/FuzzerLoop.cpp?rev=308577&r1=308576&r2=308577&view=diff
==============================================================================
--- llvm/trunk/lib/Fuzzer/FuzzerLoop.cpp (original)
+++ llvm/trunk/lib/Fuzzer/FuzzerLoop.cpp Wed Jul 19 18:35:17 2017
@@ -456,6 +456,7 @@ static bool LooseMemeq(const uint8_t *A,
}
void Fuzzer::ExecuteCallback(const uint8_t *Data, size_t Size) {
+ TPC.RecordInitialStack();
TotalNumberOfRuns++;
assert(InFuzzingThread());
if (SMR.IsClient())
Modified: llvm/trunk/lib/Fuzzer/FuzzerTracePC.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Fuzzer/FuzzerTracePC.cpp?rev=308577&r1=308576&r2=308577&view=diff
==============================================================================
--- llvm/trunk/lib/Fuzzer/FuzzerTracePC.cpp (original)
+++ llvm/trunk/lib/Fuzzer/FuzzerTracePC.cpp Wed Jul 19 18:35:17 2017
@@ -319,6 +319,8 @@ void __sanitizer_cov_trace_pc_guard(uint
uint32_t Idx = *Guard;
__sancov_trace_pc_pcs[Idx] = PC;
__sancov_trace_pc_guard_8bit_counters[Idx]++;
+ // Uncomment the following line to get stack-depth profiling.
+ // fuzzer::TPC.RecordCurrentStack();
}
// Best-effort support for -fsanitize-coverage=trace-pc, which is available
Modified: llvm/trunk/lib/Fuzzer/FuzzerTracePC.h
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Fuzzer/FuzzerTracePC.h?rev=308577&r1=308576&r2=308577&view=diff
==============================================================================
--- llvm/trunk/lib/Fuzzer/FuzzerTracePC.h (original)
+++ llvm/trunk/lib/Fuzzer/FuzzerTracePC.h Wed Jul 19 18:35:17 2017
@@ -115,6 +115,20 @@ class TracePC {
return PCs()[Idx];
}
+ void RecordCurrentStack() {
+ uintptr_t Stack = GetCurrentStack();
+ if (Stack < LowestStack)
+ LowestStack = Stack;
+ }
+ void RecordInitialStack() {
+ InitialStack = GetCurrentStack();
+ LowestStack = InitialStack;
+ }
+ uintptr_t GetCurrentStack() const {
+ return reinterpret_cast<uintptr_t>(__builtin_frame_address(0));
+ }
+ uintptr_t GetMaxStackOffset() const { return InitialStack - LowestStack; }
+
private:
bool UseCounters = false;
bool UseValueProfile = false;
@@ -138,6 +152,7 @@ private:
std::set<uintptr_t> *PrintedPCs;
ValueBitMap ValueProfileMap;
+ uintptr_t InitialStack, LowestStack; // Assume stack grows down.
};
template <class Callback> // void Callback(size_t Idx, uint8_t Value);
@@ -196,11 +211,17 @@ void TracePC::CollectFeatures(Callback H
ForEachNonZeroByte(ExtraCountersBegin(), ExtraCountersEnd(), FirstFeature,
Handle8bitCounter);
+ FirstFeature += (ExtraCountersEnd() - ExtraCountersBegin()) * 8;
- if (UseValueProfile)
+ if (UseValueProfile) {
ValueProfileMap.ForEach([&](size_t Idx) {
- HandleFeature(N * 8 + Idx);
+ HandleFeature(FirstFeature + Idx);
});
+ FirstFeature += ValueProfileMap.SizeInBits();
+ }
+
+ if (auto MaxStackOffset = GetMaxStackOffset())
+ HandleFeature(FirstFeature + MaxStackOffset);
}
extern TracePC TPC;
Modified: llvm/trunk/lib/Fuzzer/FuzzerValueBitMap.h
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Fuzzer/FuzzerValueBitMap.h?rev=308577&r1=308576&r2=308577&view=diff
==============================================================================
--- llvm/trunk/lib/Fuzzer/FuzzerValueBitMap.h (original)
+++ llvm/trunk/lib/Fuzzer/FuzzerValueBitMap.h Wed Jul 19 18:35:17 2017
@@ -52,6 +52,8 @@ struct ValueBitMap {
return Map[WordIdx] & (1UL << BitIdx);
}
+ size_t SizeInBits() const { return kMapSizeInBits; }
+
size_t GetNumBitsSinceLastMerge() const { return NumBits; }
// Merges 'Other' into 'this', clears 'Other', updates NumBits,
Modified: llvm/trunk/lib/Fuzzer/test/DeepRecursionTest.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Fuzzer/test/DeepRecursionTest.cpp?rev=308577&r1=308576&r2=308577&view=diff
==============================================================================
--- llvm/trunk/lib/Fuzzer/test/DeepRecursionTest.cpp (original)
+++ llvm/trunk/lib/Fuzzer/test/DeepRecursionTest.cpp Wed Jul 19 18:35:17 2017
@@ -3,7 +3,7 @@
// Simple test for a fuzzer. The fuzzer must find the deep recursion.
// To generate a crashy input:
-// for((i=0;i<100;i++)); do echo -n ABCDEFGHIJKLMNOPQRSTUVWXYZ >> INPUT; done
+// for((i=0;i<110;i++)); do echo -n ABCDEFGHIJ >> INPUT; done
#include <cstddef>
#include <cstdint>
#include <cstdlib>
@@ -13,7 +13,7 @@ static volatile int Sink;
void Recursive(const uint8_t *Data, size_t Size, int Depth) {
if (Depth > 1000) abort();
if (!Size) return;
- if (*Data == ('A' + Depth % 26))
+ if (*Data == ('A' + Depth % 10))
Recursive(Data + 1, Size - 1, Depth + 1);
Sink++;
}
More information about the llvm-commits
mailing list