[compiler-rt] r339081 - [libFuzzer] Add unstable function printing to print_unstable_stats flag

[Max Moroz via llvm-commits]

Author: dor1s
Date: Mon Aug  6 16:14:13 2018
New Revision: 339081

URL: http://llvm.org/viewvc/llvm-project?rev=339081&view=rev
Log:
[libFuzzer] Add unstable function printing to print_unstable_stats flag

Summary:
There may be cases in which a user wants to know which part of their code is unstable.
We use ObservedFuncs and UnstableCounters to print at exit which of the ObservedFunctions
are unstable under the -print_unstable_stats flag.

Patch by Kyungtak Woo (@kevinwkt).

Reviewers: Dor1s, metzman, morehouse

Reviewed By: Dor1s, metzman, morehouse

Subscribers: delcypher, #sanitizers, llvm-commits, kcc

Differential Revision: https://reviews.llvm.org/D50264

Modified:
    compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.cpp
    compiler-rt/trunk/test/fuzzer/PrintUnstableStatsTest.cpp
    compiler-rt/trunk/test/fuzzer/handle-unstable.test
    compiler-rt/trunk/test/fuzzer/print_unstable_stats.test

Modified: compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.cpp
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.cpp?rev=339081&r1=339080&r2=339081&view=diff
==============================================================================
--- compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.cpp (original)
+++ compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.cpp Mon Aug  6 16:14:13 2018
@@ -351,9 +351,21 @@ void TracePC::DumpCoverage() {
 
 void TracePC::PrintUnstableStats() {
   size_t count = 0;
-  for (size_t i = 0; i < NumInline8bitCounters; i++)
-    if (UnstableCounters[i].IsUnstable)
+  Printf("UNSTABLE_FUNCTIONS:\n");
+  IterateInline8bitCounters([&](int i, int j, int UnstableIdx) {
+    const PCTableEntry &TE = ModulePCTable[i].Start[j];
+    if (UnstableCounters[UnstableIdx].IsUnstable) {
       count++;
+      if (ObservedFuncs.count(TE.PC)) {
+        auto VisualizePC = GetNextInstructionPc(TE.PC);
+        std::string FunctionStr = DescribePC("%F", VisualizePC);
+        if (FunctionStr.find("in ") == 0)
+          FunctionStr = FunctionStr.substr(3);
+        Printf("%s\n", FunctionStr.c_str());
+      }
+    }
+  });
+
   Printf("stat::stability_rate: %.2f\n",
          100 - static_cast<float>(count * 100) / NumInline8bitCounters);
 }

Modified: compiler-rt/trunk/test/fuzzer/PrintUnstableStatsTest.cpp
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/test/fuzzer/PrintUnstableStatsTest.cpp?rev=339081&r1=339080&r2=339081&view=diff
==============================================================================
--- compiler-rt/trunk/test/fuzzer/PrintUnstableStatsTest.cpp (original)
+++ compiler-rt/trunk/test/fuzzer/PrintUnstableStatsTest.cpp Mon Aug  6 16:14:13 2018
@@ -18,11 +18,11 @@ __attribute__((noinline)) void ini0() {
 __attribute__((noinline)) void ini1() { x++; }
 __attribute__((noinline)) void ini2() { x++; }
 
-__attribute__((noinline)) void t0() { x++; }
+__attribute__((noinline)) void t0(int a) { x += a; }
 __attribute__((noinline)) void t1() { x++; }
-__attribute__((noinline)) void t2() { x++; }
+__attribute__((noinline)) void t2(int a, int b) { x += a + b; }
 __attribute__((noinline)) void t3() { x++; }
-__attribute__((noinline)) void t4() { x++; }
+__attribute__((noinline)) void t4(int a, int b, int c) { x += a + b +c; }
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
   if (Size == 1 && Data[0] == 'A' && !skip0) {
@@ -45,19 +45,19 @@ extern "C" int LLVMFuzzerTestOneInput(co
 
   switch (a % 5) {
   case 0:
-    t0();
+    t0(a);
     break;
   case 1:
     t1();
     break;
   case 2:
-    t2();
+    t2(a, a);
     break;
   case 3:
     t3();
     break;
   case 4:
-    t4();
+    t4(a, a, a);
     break;
   default:
     assert(false);

Modified: compiler-rt/trunk/test/fuzzer/handle-unstable.test
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/test/fuzzer/handle-unstable.test?rev=339081&r1=339080&r2=339081&view=diff
==============================================================================
--- compiler-rt/trunk/test/fuzzer/handle-unstable.test (original)
+++ compiler-rt/trunk/test/fuzzer/handle-unstable.test Mon Aug  6 16:14:13 2018
@@ -13,11 +13,11 @@ NORMAL-DAG: det4()
 NORMAL-DAG: ini0()
 NORMAL-DAG: ini1()
 NORMAL-DAG: ini2()
-NORMAL-DAG: t0()
+NORMAL-DAG: t0(int)
 NORMAL-DAG: t1()
-NORMAL-DAG: t2()
+NORMAL-DAG: t2(int, int)
 NORMAL-DAG: t3()
-NORMAL-DAG: t4()
+NORMAL-DAG: t4(int, int, int)
 
 ; MinUnstable
 RUN: %run %t-HandleUnstableTest -print_coverage=1 -handle_unstable=1 -runs=100000 2>&1 | FileCheck %s --check-prefix=MIN

Modified: compiler-rt/trunk/test/fuzzer/print_unstable_stats.test
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/test/fuzzer/print_unstable_stats.test?rev=339081&r1=339080&r2=339081&view=diff
==============================================================================
--- compiler-rt/trunk/test/fuzzer/print_unstable_stats.test (original)
+++ compiler-rt/trunk/test/fuzzer/print_unstable_stats.test Mon Aug  6 16:14:13 2018
@@ -1,3 +1,21 @@
 RUN: %cpp_compiler %S/PrintUnstableStatsTest.cpp -o %t-PrintUnstableStatsTest
+
 RUN: %run %t-PrintUnstableStatsTest -print_unstable_stats=1 -runs=100000 2>&1 | FileCheck %s --check-prefix=LONG
-LONG: stat::stability_rate: 27.59
+; We do not observe ini functions since we take the minimum hit counts, and minimum hit counts for ini is 0.
+LONG: UNSTABLE_FUNCTIONS:
+LONG-NOT: det0()
+LONG-NOT: det1()
+LONG-NOT: det2()
+LONG-NOT: det3()
+LONG-NOT: det4()
+LONG-NOT: ini0()
+LONG-NOT: ini1()
+LONG-NOT: ini2()
+LONG-DAG: t0(int)
+LONG-DAG: t1()
+LONG-DAG: t2(int, int)
+LONG-DAG: t3()
+LONG-DAG: t4(int, int, int)
+
+LONG-DAG: stat::stability_rate: 27.59
+