[PATCH] D70738: [libFuzzer] Add custom output function

Max Moroz via Phabricator via llvm-commits llvm-commits at lists.llvm.org
Fri Dec 6 13:49:34 PST 2019


Dor1s added a comment.

In Chromium we recommend fuzz target authors do something like this (https://cs.chromium.org/chromium/src/testing/libfuzzer/fuzzers/javascript_parser_proto_fuzzer.cc?l=63&rcl=f88381726e8673b289d79dde6af1b6b7f1ab063a):

  if (getenv("LPM_DUMP_NATIVE_INPUT")) {
    std::cout << source_string << std::endl;
    std::cout << "module: " << source_protobuf.is_module() << std::endl;
  }

It may look less clean that a separate function, but OTOH this gives more flexibility as you can inject code like this in various places or even have different env vars for different behaviors.

`getenv` doesn't invoke any syscalls and works fast, so I don't think this approach puts any considerable performance penalty.

As for this patch, from a user perspective I see the convenience of having a specific interface function, but as Kostya said maintaining those is pricey. We had issues in Chrome with `LLVMFuzzerInitialize`, for instance, observing different behaviors of the compiler on different platforms, and those issues were:

- hard to debug;
- made us spend quite some time on discussions whether we fix should things in the compiler or in the libFuzzer or in the Chromium code;
- ended up with a bunch of manual code changes and updates to the user documentation (which did not make it easier to follow -- sigh).

TL;DR as a person who has to ensure that thousands of fuzz targets are building and running well across a variety of projects and platforms, I would avoid extending the interface as long as there are reasonable alternatives (see the beginning of my comment).


Repository:
  rCRT Compiler Runtime

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D70738/new/

https://reviews.llvm.org/D70738





More information about the llvm-commits mailing list