[compiler-rt] r363473 - [libFuzzer] in autofocus mode, give more weight to functions with DFT

[Kostya Serebryany via llvm-commits]

Author: kcc
Date: Fri Jun 14 16:29:56 2019
New Revision: 363473

URL: http://llvm.org/viewvc/llvm-project?rev=363473&view=rev
Log:
[libFuzzer] in autofocus mode, give more weight to functions with DFT

Modified:
    compiler-rt/trunk/lib/fuzzer/FuzzerDataFlowTrace.cpp
    compiler-rt/trunk/lib/fuzzer/FuzzerDataFlowTrace.h
    compiler-rt/trunk/lib/fuzzer/tests/FuzzerUnittest.cpp

Modified: compiler-rt/trunk/lib/fuzzer/FuzzerDataFlowTrace.cpp
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/fuzzer/FuzzerDataFlowTrace.cpp?rev=363473&r1=363472&r2=363473&view=diff
==============================================================================
--- compiler-rt/trunk/lib/fuzzer/FuzzerDataFlowTrace.cpp (original)
+++ compiler-rt/trunk/lib/fuzzer/FuzzerDataFlowTrace.cpp Fri Jun 14 16:29:56 2019
@@ -42,11 +42,16 @@ bool BlockCoverage::AppendCoverage(const
 bool BlockCoverage::AppendCoverage(std::istream &IN) {
   std::string L;
   while (std::getline(IN, L, '\n')) {
-    if (L.empty() || L[0] != 'C')
-      continue; // Ignore non-coverage lines.
+    if (L.empty())
+      continue;
     std::stringstream SS(L.c_str() + 1);
     size_t FunctionId  = 0;
     SS >> FunctionId;
+    if (L[0] == 'F') {
+      FunctionsWithDFT.insert(FunctionId);
+      continue;
+    }
+    if (L[0] != 'C') continue;
     Vector<uint32_t> CoveredBlocks;
     while (true) {
       uint32_t BB = 0;
@@ -87,9 +92,12 @@ Vector<double> BlockCoverage::FunctionWe
     auto Counters = It.second;
     assert(FunctionID < NumFunctions);
     auto &Weight = Res[FunctionID];
-    Weight = 1000.;  // this function is covered.
+    // Give higher weight if the function has a DFT.
+    Weight = FunctionsWithDFT.count(FunctionID) ? 1000. : 1;
+    // Give higher weight to functions with less frequently seen basic blocks.
     Weight /= SmallestNonZeroCounter(Counters);
-    Weight *= NumberOfUncoveredBlocks(Counters) + 1;  // make sure it's not 0.
+    // Give higher weight to functions with the most uncovered basic blocks.
+    Weight *= NumberOfUncoveredBlocks(Counters) + 1;
   }
   return Res;
 }

Modified: compiler-rt/trunk/lib/fuzzer/FuzzerDataFlowTrace.h
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/fuzzer/FuzzerDataFlowTrace.h?rev=363473&r1=363472&r2=363473&view=diff
==============================================================================
--- compiler-rt/trunk/lib/fuzzer/FuzzerDataFlowTrace.h (original)
+++ compiler-rt/trunk/lib/fuzzer/FuzzerDataFlowTrace.h Fri Jun 14 16:29:56 2019
@@ -107,6 +107,8 @@ class BlockCoverage {
   // Function ID => vector of counters.
   // Each counter represents how many input files trigger the given basic block.
   std::unordered_map<size_t, CoverageVector> Functions;
+  // Functions that have DFT entry.
+  std::unordered_set<size_t> FunctionsWithDFT;
 };
 
 class DataFlowTrace {

Modified: compiler-rt/trunk/lib/fuzzer/tests/FuzzerUnittest.cpp
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/fuzzer/tests/FuzzerUnittest.cpp?rev=363473&r1=363472&r2=363473&view=diff
==============================================================================
--- compiler-rt/trunk/lib/fuzzer/tests/FuzzerUnittest.cpp (original)
+++ compiler-rt/trunk/lib/fuzzer/tests/FuzzerUnittest.cpp Fri Jun 14 16:29:56 2019
@@ -840,11 +840,17 @@ TEST(DFT, FunctionWeights) {
   Weights = Cov.FunctionWeights(2);
   EXPECT_GT(Weights[0], Weights[1]);
 
-  // A function with more uncovered bclocks gets more weight.
+  // A function with more uncovered blocks gets more weight.
   Cov.clear();
   EXPECT_TRUE(Cov.AppendCoverage("C0 1 2 3 5\nC1 2 4\n"));
   Weights = Cov.FunctionWeights(2);
   EXPECT_GT(Weights[1], Weights[0]);
+
+  // A function with DFT gets more weight than the function w/o DFT.
+  Cov.clear();
+  EXPECT_TRUE(Cov.AppendCoverage("F1 111\nC0 3\nC1 1 2 3\n"));
+  Weights = Cov.FunctionWeights(2);
+  EXPECT_GT(Weights[1], Weights[0]);
 }