Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Divide the corpus into n parts according to the size, and each job ex… #303

Closed
wants to merge 1 commit into from
Closed

Divide the corpus into n parts according to the size, and each job ex… #303

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion compiler-rt/lib/fuzzer/FuzzerDriver.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -867,7 +867,7 @@ int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
}

if (Flags.fork)
FuzzWithFork(F->GetMD().GetRand(), Options, Args, *Inputs, Flags.fork);
FuzzWithFork(F->GetMD().GetRand(), Options, Args, *Inputs, Flags.fork, Flags.NumCorpuses);

if (Flags.merge)
Merge(F, Options, Args, *Inputs, Flags.merge_control_file);
Expand Down
1 change: 1 addition & 0 deletions compiler-rt/lib/fuzzer/FuzzerFlags.def
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,7 @@ FUZZER_FLAG_INT(timeout_exitcode, 70, "When libFuzzer reports a timeout "
FUZZER_FLAG_INT(max_total_time, 0, "If positive, indicates the maximal total "
"time in seconds to run the fuzzer.")
FUZZER_FLAG_INT(help, 0, "Print help.")
FUZZER_FLAG_INT(NumCorpuses, 1, "Divide the corpus into N parts according to size.")
FUZZER_FLAG_INT(fork, 0, "Experimental mode where fuzzing happens "
"in a subprocess")
FUZZER_FLAG_INT(ignore_timeouts, 1, "Ignore timeouts in fork mode")
Expand Down
36 changes: 31 additions & 5 deletions compiler-rt/lib/fuzzer/FuzzerFork.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ struct GlobalEnv {
.count();
}

FuzzJob *CreateNewJob(size_t JobId) {
FuzzJob *CreateNewJob(size_t JobId, int NumCorpuses) {
Command Cmd(Args);
Cmd.removeFlag("fork");
Cmd.removeFlag("runs");
Expand All @@ -133,7 +133,7 @@ struct GlobalEnv {
}
auto Job = new FuzzJob;
std::string Seeds;
if (size_t CorpusSubsetSize =
/*if (size_t CorpusSubsetSize =
std::min(Files.size(), (size_t)sqrt(Files.size() + 2))) {
auto Time1 = std::chrono::system_clock::now();
for (size_t i = 0; i < CorpusSubsetSize; i++) {
Expand All @@ -145,6 +145,31 @@ struct GlobalEnv {
auto DftTimeInSeconds = duration_cast<seconds>(Time2 - Time1).count();
assert(DftTimeInSeconds < std::numeric_limits<int>::max());
Job->DftTimeInSeconds = static_cast<int>(DftTimeInSeconds);
}*/
if (size_t CorpusSubsetSize =
std::min(Files.size(), (size_t)sqrt(Files.size() + 2))) {
size_t AverageSize = Files.size()/NumCorpuses +1;
auto Time1 = std::chrono::system_clock::now();
size_t StartIndex = ((JobId-1)%NumCorpuses) * AverageSize;
printf("\n Job %d Choose Corpus %d ",JobId,(JobId)%NumCorpuses);
for (size_t i = 0; i < CorpusSubsetSize; i++) {
size_t j = Rand->SkewTowardsLast(AverageSize);
size_t m = j + StartIndex;
if (m < Files.size()) {
auto &SF = Files[m];
Seeds += (Seeds.empty() ? "" : ",") + SF;
CollectDFT(SF);
}
else {
auto &SF = Files[Rand->SkewTowardsLast(Files.size())];
Seeds += (Seeds.empty() ? "" : ",") + SF;
CollectDFT(SF);
}
}
auto Time2 = std::chrono::system_clock::now();
auto DftTimeInSeconds = duration_cast<seconds>(Time2 - Time1).count();
assert(DftTimeInSeconds < std::numeric_limits<int>::max());
Job->DftTimeInSeconds = static_cast<int>(DftTimeInSeconds);
}
if (!Seeds.empty()) {
Job->SeedListPath =
Expand Down Expand Up @@ -284,7 +309,7 @@ void WorkerThread(JobQueue *FuzzQ, JobQueue *MergeQ) {
// This is just a skeleton of an experimental -fork=1 feature.
void FuzzWithFork(Random &Rand, const FuzzingOptions &Options,
const Vector<std::string> &Args,
const Vector<std::string> &CorpusDirs, int NumJobs) {
const Vector<std::string> &CorpusDirs, int NumJobs, int NumCorpuses) {
Printf("INFO: -fork=%d: fuzzing in separate process(s)\n", NumJobs);

GlobalEnv Env;
Expand Down Expand Up @@ -341,8 +366,9 @@ void FuzzWithFork(Random &Rand, const FuzzingOptions &Options,
Vector<std::thread> Threads;
for (int t = 0; t < NumJobs; t++) {
Threads.push_back(std::thread(WorkerThread, &FuzzQ, &MergeQ));
FuzzQ.Push(Env.CreateNewJob(JobId++));
FuzzQ.Push(Env.CreateNewJob(JobId++, NumCorpuses));
}
//printf("\n 创建%d个jobs\n",NumJobs);

while (true) {
std::unique_ptr<FuzzJob> Job(MergeQ.Pop());
Expand Down Expand Up @@ -399,7 +425,7 @@ void FuzzWithFork(Random &Rand, const FuzzingOptions &Options,
break;
}

FuzzQ.Push(Env.CreateNewJob(JobId++));
FuzzQ.Push(Env.CreateNewJob(JobId++, NumCorpuses));
}

for (auto &T : Threads)
Expand Down
2 changes: 1 addition & 1 deletion compiler-rt/lib/fuzzer/FuzzerFork.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
namespace fuzzer {
void FuzzWithFork(Random &Rand, const FuzzingOptions &Options,
const Vector<std::string> &Args,
const Vector<std::string> &CorpusDirs, int NumJobs);
const Vector<std::string> &CorpusDirs, int NumJobs, int NumCorpuses);
} // namespace fuzzer

#endif // LLVM_FUZZER_FORK_H