Documentation update for a shorter libfuzzer flag in D32193

[george.karpenkov]

Summary

Updates documentation for a syntax sugar libfuzzer flag, as implemented in https://reviews.llvm.org/D32193

[kcc]

Mmm... No. I still want to have documentation that includes building libFuzzer manually.
I'd rather insert a paragraph explaining how to use -fsanitize=fuzzer with a fresh clang install, but leave the rest unchanged.

[george.karpenkov]

Sure. Wouldn't it make more sense to move it down into "Developing libfuzzer"?
A user can only compile libfuzzer using Clang anyway (due to coverage), and Clang has to be new (as coverage flags change from my understanding).
Thus using "-fsanitize=fuzzer" seems a more sensible default instruction, then compiling libfuzzer and adding coverage instructions manually.

[kcc]

you don't need fresh clang to build libFuzzer itself.
besides, there is already *some* support for using libFuzzer with gcc.

How about this: you start this section from "if you have a very recent (> April 20 2017) build of clang, use -fsanitize=fuzzer (example)"

then the rest of the existing text follows

[kcc]

LGTM
Sounds good, but I suggest to wait with this change until we fix all the build failures that were caused by enabling libFuzzer build by default.

[george.karpenkov]

Committed in rL301217

docs/LibFuzzer.rst

 * It must not `exit()` on any input.
 * It may use threads but ideally all threads should be joined at the end of the function.
 * It must be as deterministic as possible. Non-determinism (e.g. random decisions not based on the input bytes) will make fuzzing inefficient.
 * It must be fast. Try avoiding cubic or greater complexity, logging, or excessive memory consumption.
 * Ideally, it should not modify any global state (although that's not strict).
 * Usually, the narrower the target the better. E.g. if your target can parse several data formats, split it into several targets, one per format.
 
 
-Building
---------
+Fuzzer Usage
+------------
+
+Very recent versions of Clang (> April 20 2017) include libFuzzer,
+and no installation is necessary.
+In order to fuzz your binary, use the `-fsanitize=fuzzer` flag during the compilation::
+
+   clang -fsanitize=fuzzer,address mytarget.c
 
-Next, build the libFuzzer library as a static archive, without any sanitizer
+Otherwise, build the libFuzzer library as a static archive, without any sanitizer
 options. Note that the libFuzzer library contains the ``main()`` function:
 
 .. code-block:: console
 
   svn co http://llvm.org/svn/llvm-project/llvm/trunk/lib/Fuzzer  # or git clone https://chromium.googlesource.com/chromium/llvm-project/llvm/lib/Fuzzer
   ./Fuzzer/build.sh  # Produces libFuzzer.a
 
 Then build the fuzzing target function and the library under test using