[LibFuzzer] Do not write crash unit file for single input

[aizatsky]

Summary

When -test_single_input crashes the test it is not necessary to write crash-file because input is already known to the user.

[kcc]

The logic is a bit complicated
Also, will this handle slow-unit and timeout-? Please test for those too.

Maybe test_single_unit simply disables the deatch callbacks and alarm?

Also, what happens when -test_single_unit=FILE_THAT_DOES_NOT_EXIST ?

[aizatsky]

• wip
• moving option down the stack

[aizatsky]

• handling bad file

[aizatsky]

Reworked the logic and checking for bad file. PTAL

[kcc]

LGTM, except for the variable name.
Let me commit this.

lib/Fuzzer/FuzzerDriver.cpp

280

SaveArtifacts

[kcc]

r250564.

lib/Fuzzer/FuzzerDriver.cpp

int FuzzerDriver(const std::vector<std::string> &Args,
   Options.ReportSlowUnits = Flags.report_slow_units;
   if (Flags.artifact_prefix)
     Options.ArtifactPrefix = Flags.artifact_prefix;
   if (Flags.dict)
     if (!ParseDictionaryFile(FileToString(Flags.dict), &Options.Dictionary))
       return 1;
   if (Flags.verbosity > 0 && !Options.Dictionary.empty())
     Printf("Dictionary: %zd entries\n", Options.Dictionary.size());
+  Options.SaveUnits = !Flags.test_single_input;
 
   Fuzzer F(USF, Options);
 
   if (Flags.apply_tokens)
     return ApplyTokens(F, Flags.apply_tokens);
 
+  // Timer
+  if (Flags.timeout > 0)
+    SetTimer(Flags.timeout / 2 + 1);
+
   if (Flags.test_single_input)
     return RunOneTest(&F, Flags.test_single_input);
 
   unsigned Seed = Flags.seed;
   // Initialize Seed.
   if (Seed == 0)
     Seed = time(0) * 10000 + getpid();
   if (Flags.verbosity)
     Printf("Seed: %u\n", Seed);
   USF.GetRand().ResetSeed(Seed);
 
-  // Timer
-  if (Flags.timeout > 0)
-    SetTimer(Flags.timeout / 2 + 1);
-
   if (Flags.verbosity >= 2) {
     Printf("Tokens: {");
     for (auto &T : Options.Tokens)
       Printf("%s,", T.c_str());
     Printf("}\n");
   }
 
   F.RereadOutputCorpus();

lib/Fuzzer/FuzzerIO.cpp

if (E->d_type == DT_REG || E->d_type == DT_LNK)
       V.push_back(E->d_name);
   }
   closedir(D);
   return V;
 }
 
 Unit FileToVector(const std::string &Path) {
   std::ifstream T(Path);
+  if (!T) {
+    Printf("No such directory: %s; exiting\n", Path.c_str());
+    exit(1);
+  }
   return Unit((std::istreambuf_iterator<char>(T)),
               std::istreambuf_iterator<char>());
 }
 
 std::string FileToString(const std::string &Path) {
   std::ifstream T(Path);
   return std::string((std::istreambuf_iterator<char>(T)),
                      std::istreambuf_iterator<char>());

lib/Fuzzer/FuzzerInternal.h

struct FuzzingOptions {
     bool OnlyASCII = false;
     int TBMDepth = 10;
     int TBMWidth = 10;
     std::string OutputCorpus;
     std::string SyncCommand;
     std::string ArtifactPrefix = "./";
     std::vector<std::string> Tokens;
     std::vector<Unit> Dictionary;
+    bool SaveUnits = true;
   };
   Fuzzer(UserSuppliedFuzzer &USF, FuzzingOptions Options);
   void AddToCorpus(const Unit &U) { Corpus.push_back(U); }
   void Loop();
   void ShuffleAndMinimize();
   void InitializeTraceState();
   size_t CorpusSize() const { return Corpus.size(); }
   void ReadDir(const std::string &Path, long *Epoch) {

lib/Fuzzer/FuzzerLoop.cpp

void Fuzzer::WriteToOutputCorpus(const Unit &U) {
   std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U));
   WriteToFile(U, Path);
   if (Options.Verbosity >= 2)
     Printf("Written to %s\n", Path.c_str());
   assert(!Options.OnlyASCII || IsASCII(U));
 }
 
 void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) {
+  if (!Options.SaveUnits)
+    return;
   std::string Path = Options.ArtifactPrefix + Prefix + Hash(U);
   WriteToFile(U, Path);
   Printf("artifact_prefix='%s'; Test unit written to %s\n",
          Options.ArtifactPrefix.c_str(), Path.c_str());
   if (U.size() <= kMaxUnitSizeToPrint) {
     Printf("Base64: ");
     PrintFileAsBase64(Path);
   }

lib/Fuzzer/test/fuzzer.test

 CHECK: BINGO
 
 RUN: LLVMFuzzer-SimpleTest 2>&1 | FileCheck %s
-RUN: LLVMFuzzer-SimpleTest -test_single_input=%S/hi.txt 2>&1 | FileCheck %s 
+RUN: not LLVMFuzzer-NullDerefTest -test_single_input=%S/hi.txt 2>&1 | FileCheck %s --check-prefix=SingleInput
+SingleInput-NOT: Test unit written to ./crash-
 
 RUN: not LLVMFuzzer-InfiniteTest -timeout=2 2>&1 | FileCheck %s --check-prefix=InfiniteTest
 InfiniteTest: ALARM: working on the last Unit for
 InfiniteTest: Test unit written to ./timeout-
 
 RUN: LLVMFuzzer-SimpleCmpTest -max_total_time=1 2>&1 | FileCheck %s --check-prefix=MaxTotalTime
 MaxTotalTime: Done {{.*}} runs in {{.}} second(s)
 
 RUN: not LLVMFuzzer-TimeoutTest -timeout=5 2>&1 | FileCheck %s --check-prefix=TimeoutTest
 TimeoutTest: ALARM: working on the last Unit for
 TimeoutTest: Test unit written to ./timeout-
 
+RUN: not LLVMFuzzer-TimeoutTest -timeout=5 -test_single_input=%S/hi.txt 2>&1 | FileCheck %s --check-prefix=SingleInputTimeoutTest
+SingleInputTimeoutTest: ALARM: working on the last Unit for
+SingleInputTimeoutTest-NOT: Test unit written to ./timeout-
+
 RUN: not LLVMFuzzer-NullDerefTest 2>&1 | FileCheck %s --check-prefix=NullDerefTest
 NullDerefTest: Test unit written to ./crash-
 RUN: not LLVMFuzzer-NullDerefTest  -artifact_prefix=ZZZ 2>&1 | FileCheck %s --check-prefix=NullDerefTestPrefix
 NullDerefTestPrefix: Test unit written to ZZZcrash-
 
 #not LLVMFuzzer-FullCoverageSetTest -timeout=15 -seed=1 -mutate_depth=2 -use_full_coverage_set=1 2>&1 | FileCheck %s
 
 #not LLVMFuzzer-FourIndependentBranchesTest -timeout=15 -seed=1 -use_traces=1 2>&1 | FileCheck %s