Refactored clang-fuzzer and added new (copy) files

[emmettneyman]

Summary

Refactored LLVMFuzzerInitialize function into its own file.
Copied and renamed some files in preparation for new loop-proto-fuzzer.

[emmettneyman]

• Took out a debug print statement

[vitalybuka]

Good practice is to avoid merging changes into a single one.
Here one patch should be "refactoring" and the second for "loop-proto-fuzzer."

tools/clang-fuzzer/ExampleClangProtoFuzzer.cpp

27–28

Please delete commented code.

tools/clang-fuzzer/FuzzerInitialize.h

12

static here means that each module which includes this header is going to have own instance of the variable.
I guess you need only one instance in FuzzerInitialize.cpp which can be achieved with

extern std::vector<const char *> CLArgs;

However I'd recommend getter:

const std::vector<const char *>& GetCLArgs();

with implementation and

static std::vector<const char *> CLArgs;

in FuzzerInitialize.cpp

13

you need only CLArgs here.
code which includes this header is not going to call LLVMFuzzerInitialize

tools/clang-fuzzer/experimental/ExampleClangLoopProtoFuzzer.cpp

30

Please remove deleted code

[vitalybuka]

In D47666#1119821, @vitalybuka wrote:

Good practice is to avoid merging changes into a single one.
Here one patch should be "refactoring" and the second for "loop-proto-fuzzer."

We are doing this for several reasons:

1. smaller patches, faster review
2. easier to investigate regressions caused by smaller patches

[emmettneyman]

Changed CLArgs into getter and deleted commented code

Made changes in response to comments
Removed commented out code
Changed CLArgs to be a getter method
Removed LLVMFuzzerInitialize decl from header file

[vitalybuka]

tools/clang-fuzzer/FuzzerInitialize.cpp

11

Could you please update this description?

tools/clang-fuzzer/experimental/ExampleClangLoopProtoFuzzer.cpp

22

Please move ExampleClangLoopProtoFuzzer into a separate patch

[emmettneyman]

• Updated and added header comments to two new files. Deleted loop fuzzer files.

[emmettneyman]

• Fixed file header comment

[emmettneyman]

• Another edit to the file header comments.

[emmettneyman]

In D47666#1121608, @emmettneyman wrote:

• Updated and added header comments to two new files. Deleted loop fuzzer files.

I will commit the loop fuzzer files in a future patch.

[morehouse]

tools/clang-fuzzer/CMakeLists.txt

48

Rather than compiling FuzzerInitialize.cpp into the binary, can we make it a library like handle-cxx or proto-to-cxx?

tools/clang-fuzzer/FuzzerInitialize.cpp

17–18

Do we need this include?

tools/clang-fuzzer/FuzzerInitialize.h

21

Why do we need these includes in the header? Doesn't look like they're used here.

[emmettneyman]

• Refactored FuzzerInitialize into library

[morehouse]

tools/clang-fuzzer/ExampleClangProtoFuzzer.cpp

24

I think cstring is no longer used after this change. So we can probably remove this include.

tools/clang-fuzzer/fuzzer-initialize/CMakeLists.txt

3 ↗

(On Diff #149867)

Nit: clangFuzzerInitialize would better follow the naming convention of the other libraries.

tools/clang-fuzzer/fuzzer-initialize/fuzzer_initialize.h

15 ↗

(On Diff #149867)

I don't think this include is used in this file either. Can we remove it?

[emmettneyman]

• Removed unecessary includes and renamed library.

[morehouse]

LGTM.

[kcc]

Some feedback on the generated code:

while (1){

let's not have the while loops inside the for loops for now.
If the initial goal is to stress the loop optimizations (e.g. vectorizer),
loops likes this are just a distraction

for (int loop_ctr = 0

too verbose. Use 'i'm 'j', 'k'
also, alternate int, unsigned, size_t, long (later).

a[436863498 % s]=1;

this is good for keeping the code UB-free, but it will render the tests non-vectorizable.
need more tests that won't use % s

void foo(int *a, size_t s) {

ok for a starter, but will need a more rich signature in the future versions.

tools/clang-fuzzer/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS ${LLVM_TARGETS_TO_BUILD} FuzzMutate)
 set(CXX_FLAGS_NOFUZZ ${CMAKE_CXX_FLAGS})
 set(DUMMY_MAIN DummyClangFuzzer.cpp)
 if(LLVM_LIB_FUZZING_ENGINE)
   unset(DUMMY_MAIN)
 elseif(LLVM_USE_SANITIZE_COVERAGE)
   set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fsanitize=fuzzer")
   set(CXX_FLAGS_NOFUZZ "${CXX_FLAGS_NOFUZZ} -fsanitize=fuzzer-no-link")
   unset(DUMMY_MAIN)
 endif()
 
 # Needed by LLVM's CMake checks because this file defines multiple targets.
 set(LLVM_OPTIONAL_SOURCES
   ClangFuzzer.cpp
   DummyClangFuzzer.cpp
   ExampleClangProtoFuzzer.cpp
+  FuzzerInitialize.cpp
   )
 
 if(CLANG_ENABLE_PROTO_FUZZER)
   # Create protobuf .h and .cc files, and put them in a library for use by
   # clang-proto-fuzzer components.
   find_package(Protobuf REQUIRED)
   add_definitions(-DGOOGLE_PROTOBUF_NO_RTTI)
   include_directories(${PROTOBUF_INCLUDE_DIRS})
if(CLANG_ENABLE_PROTO_FUZZER)
 
   # Build the protobuf->C++ translation library and driver.
   add_clang_subdirectory(proto-to-cxx)
 
   # Build the protobuf fuzzer
   add_clang_executable(clang-proto-fuzzer
     ${DUMMY_MAIN}
     ExampleClangProtoFuzzer.cpp
+    FuzzerInitialize.cpp
     )
 
   target_link_libraries(clang-proto-fuzzer
     PRIVATE
     ${ProtobufMutator_LIBRARIES}
     ${PROTOBUF_LIBRARIES}
     ${LLVM_LIB_FUZZING_ENGINE}
     clangCXXProto

tools/clang-fuzzer/ExampleClangProtoFuzzer.cpp

 ///  then linked into the Fuzzer library.
 ///
 //===----------------------------------------------------------------------===//
 
 #include "cxx_proto.pb.h"
 #include "handle-cxx/handle_cxx.h"
 #include "proto-to-cxx/proto_to_cxx.h"
 
+#include "FuzzerInitialize.h"
 #include "src/libfuzzer/libfuzzer_macro.h"
 
 #include <cstring>
 
 using namespace clang_fuzzer;
 
-static std::vector<const char *> CLArgs;
-
-extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) {
-  CLArgs.push_back("-O2");
-  for (int I = 1; I < *argc; I++) {
-    if (strcmp((*argv)[I], "-ignore_remaining_args=1") == 0) {
-      for (I++; I < *argc; I++)
-        CLArgs.push_back((*argv)[I]);
-      break;
-    }
-  }
-  return 0;
-}
-
 DEFINE_BINARY_PROTO_FUZZER(const Function& input) {
   auto S = FunctionToString(input);
-  HandleCXX(S, CLArgs);
+  HandleCXX(S, GetCLArgs());
 }

tools/clang-fuzzer/FuzzerInitialize.h

+#include "handle-cxx/handle_cxx.h"
+#include "proto-to-cxx/proto_to_cxx.h"
+
+#include "src/libfuzzer/libfuzzer_macro.h"
+
+#include <cstring>
+
+namespace clang_fuzzer {
+const std::vector<const char *>& GetCLArgs();
+}
+

tools/clang-fuzzer/FuzzerInitialize.cpp

-//===-- ExampleClangProtoFuzzer.cpp - Fuzz Clang --------------------------===//
+//===-- FuzzerInitialize.cpp - Fuzz Clang ---------------------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 ///
 /// \file
 /// This file implements a function that runs Clang on a single
 ///  input and uses libprotobuf-mutator to find new inputs. This function is
 ///  then linked into the Fuzzer library.
 ///
 //===----------------------------------------------------------------------===//
 
 #include "cxx_proto.pb.h"
-#include "handle-cxx/handle_cxx.h"
-#include "proto-to-cxx/proto_to_cxx.h"
 
-#include "src/libfuzzer/libfuzzer_macro.h"
-
-#include <cstring>
+#include "FuzzerInitialize.h"
 
 using namespace clang_fuzzer;
 
+
+namespace clang_fuzzer {
+
 static std::vector<const char *> CLArgs;
 
+const std::vector<const char *>& GetCLArgs() {
+  return CLArgs;
+}
+
+}
+
 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) {
   CLArgs.push_back("-O2");
   for (int I = 1; I < *argc; I++) {
     if (strcmp((*argv)[I], "-ignore_remaining_args=1") == 0) {
       for (I++; I < *argc; I++)
         CLArgs.push_back((*argv)[I]);
       break;
     }
   }
   return 0;
 }
 
-DEFINE_BINARY_PROTO_FUZZER(const Function& input) {
-  auto S = FunctionToString(input);
-  HandleCXX(S, CLArgs);
-}

tools/clang-fuzzer/experimental/ExampleClangLoopProtoFuzzer.cpp

 //===-- ExampleClangProtoFuzzer.cpp - Fuzz Clang --------------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 ///
 /// \file
 /// This file implements a function that runs Clang on a single
 ///  input and uses libprotobuf-mutator to find new inputs. This function is
 ///  then linked into the Fuzzer library.
 ///
 //===----------------------------------------------------------------------===//
 
-#include "cxx_proto.pb.h"
+// This is a copy and will be updated later to introduce changes
+
+#include "cxx_loop_proto.pb.h"
 #include "handle-cxx/handle_cxx.h"
-#include "proto-to-cxx/proto_to_cxx.h"
+
+#include "FuzzerInitialize.h"
 
 #include "src/libfuzzer/libfuzzer_macro.h"
 
 #include <cstring>
 
 using namespace clang_fuzzer;
 
-static std::vector<const char *> CLArgs;
-
-extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) {
-  CLArgs.push_back("-O2");
-  for (int I = 1; I < *argc; I++) {
-    if (strcmp((*argv)[I], "-ignore_remaining_args=1") == 0) {
-      for (I++; I < *argc; I++)
-        CLArgs.push_back((*argv)[I]);
-      break;
-    }
-  }
-  return 0;
-}
-
 DEFINE_BINARY_PROTO_FUZZER(const Function& input) {
   auto S = FunctionToString(input);
   HandleCXX(S, CLArgs);
 }

tools/clang-fuzzer/experimental/cxx_loop_proto.proto

+//===-- cxx_proto.proto - Protobuf description of C++ ---------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+///
+/// \file
+/// This file describes a subset of C++ as a protobuf.  It is used to
+///  more easily find interesting inputs for fuzzing Clang.
+///
+//===----------------------------------------------------------------------===//
+
+// This is a copy and will be updated later to introduce changes
+
+syntax = "proto2";
+
+message VarRef {
+  required int32 varnum = 1;
+}
+
+message Lvalue {
+  required VarRef varref = 1;
+}
+
+message Const {
+  required int32 val = 1;
+}
+
+message BinaryOp {
+  enum Op {
+    PLUS = 0;
+    MINUS = 1;
+    MUL = 2;
+    DIV = 3;
+    MOD = 4;
+    XOR = 5;
+    AND = 6;
+    OR = 7;
+    EQ = 8;
+    NE = 9;
+    LE = 10;
+    GE = 11;
+    LT = 12;
+    GT = 13;
+  };
+  required Op op = 1;
+  required Rvalue left = 2;
+  required Rvalue right = 3;
+}
+
+message Rvalue {
+  oneof rvalue_oneof {
+    VarRef varref = 1;
+    Const cons = 2;
+    BinaryOp binop = 3;
+  }
+}
+
+message AssignmentStatement {
+  required Lvalue lvalue = 1;
+  required Rvalue rvalue = 2;
+}
+
+
+message IfElse {
+  required Rvalue cond = 1;
+  required StatementSeq if_body = 2;
+  required StatementSeq else_body = 3;
+}
+
+message While {
+  required Rvalue cond = 1;
+  required StatementSeq body = 2;
+}
+
+message Statement {
+  oneof stmt_oneof {
+    AssignmentStatement assignment = 1;
+    IfElse              ifelse     = 2;
+    While               while_loop = 3;
+  }
+}
+
+message StatementSeq {
+  repeated Statement statements = 1;
+}
+
+message Function {
+  required StatementSeq statements = 1;
+}
+
+package clang_fuzzer;

tools/clang-fuzzer/proto-to-cxx/experimental/loop_proto_to_cxx.h

+//==-- proto_to_cxx.h - Protobuf-C++ conversion ----------------------------==//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// Defines functions for converting between protobufs and C++.
+//
+//===----------------------------------------------------------------------===//
+
+// This is a copy and will be updated later to introduce changes
+
+#include <cstdint>
+#include <cstddef>
+#include <string>
+
+namespace clang_fuzzer {
+class Function;
+std::string FunctionToString(const Function &input);
+std::string ProtoToCxx(const uint8_t *data, size_t size);
+}

tools/clang-fuzzer/proto-to-cxx/experimental/loop_proto_to_cxx.cpp

+//==-- proto_to_cxx.cpp - Protobuf-C++ conversion --------------------------==//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// Implements functions for converting between protobufs and C++.
+//
+//===----------------------------------------------------------------------===//
+
+// This is a copy and will be updated later to introduce changes
+
+#include "loop_proto_to_cxx.h"
+#include "cxx_loop_proto.pb.h"
+
+// The following is needed to convert protos in human-readable form
+#include <google/protobuf/text_format.h>
+
+
+#include <ostream>
+#include <sstream>
+
+namespace clang_fuzzer {
+
+// Forward decls.
+std::ostream &operator<<(std::ostream &os, const BinaryOp &x);
+std::ostream &operator<<(std::ostream &os, const StatementSeq &x);
+
+// Proto to C++.
+std::ostream &operator<<(std::ostream &os, const Const &x) {
+  return os << "(" << x.val() << ")";
+}
+std::ostream &operator<<(std::ostream &os, const VarRef &x) {
+  return os << "a[" << (static_cast<uint32_t>(x.varnum()) % 100) << "]";
+}
+std::ostream &operator<<(std::ostream &os, const Lvalue &x) {
+  return os << x.varref();
+}
+std::ostream &operator<<(std::ostream &os, const Rvalue &x) {
+    if (x.has_varref()) return os << x.varref();
+    if (x.has_cons())   return os << x.cons();
+    if (x.has_binop())  return os << x.binop();
+    return os << "1";
+}
+std::ostream &operator<<(std::ostream &os, const BinaryOp &x) {
+  os << "(" << x.left();
+  switch (x.op()) {
+    case BinaryOp::PLUS: os << "+"; break;
+    case BinaryOp::MINUS: os << "-"; break;
+    case BinaryOp::MUL: os << "*"; break;
+    case BinaryOp::DIV: os << "/"; break;
+    case BinaryOp::MOD: os << "%"; break;
+    case BinaryOp::XOR: os << "^"; break;
+    case BinaryOp::AND: os << "&"; break;
+    case BinaryOp::OR: os << "|"; break;
+    case BinaryOp::EQ: os << "=="; break;
+    case BinaryOp::NE: os << "!="; break;
+    case BinaryOp::LE: os << "<="; break;
+    case BinaryOp::GE: os << ">="; break;
+    case BinaryOp::LT: os << "<"; break;
+    case BinaryOp::GT: os << ">"; break;
+  }
+  return os << x.right() << ")";
+}
+std::ostream &operator<<(std::ostream &os, const AssignmentStatement &x) {
+  return os << x.lvalue() << "=" << x.rvalue() << ";\n";
+}
+std::ostream &operator<<(std::ostream &os, const IfElse &x) {
+  return os << "if (" << x.cond() << "){\n"
+            << x.if_body() << "} else { \n"
+            << x.else_body() << "}\n";
+}
+std::ostream &operator<<(std::ostream &os, const While &x) {
+  return os << "while (" << x.cond() << "){\n" << x.body() << "}\n";
+}
+std::ostream &operator<<(std::ostream &os, const Statement &x) {
+  if (x.has_assignment()) return os << x.assignment();
+  if (x.has_ifelse())     return os << x.ifelse();
+  if (x.has_while_loop()) return os << x.while_loop();
+  return os << "(void)0;\n";
+}
+std::ostream &operator<<(std::ostream &os, const StatementSeq &x) {
+  for (auto &st : x.statements()) os << st;
+  return os;
+}
+std::ostream &operator<<(std::ostream &os, const Function &x) {
+  return os << "void foo(int *a) {\n" << x.statements() << "}\n";
+}
+
+// ---------------------------------
+
+std::string FunctionToString(const Function &input) {
+  std::ostringstream os;
+  os << input;
+  return os.str();
+
+}
+std::string ProtoToCxx(const uint8_t *data, size_t size) {
+  Function message;
+  if (!message.ParsePartialFromArray(data, size))
+    return "#error invalid proto, may not be binary encoded\n";
+  return FunctionToString(message);
+}
+/*
+std::string ProtoStringToCxx(const std::string& data) {
+  Function message;
+  if (!google::protobuf::TextFormat::ParseFromString(data, &message))
+    return "#error invalid proto, may not be string encoded\n";
+  return FunctionToString(message);
+}
+*/
+} // namespace clang_fuzzer

tools/clang-fuzzer/proto-to-cxx/experimental/loop_proto_to_cxx_main.cpp

+//==-- proto_to_cxx_main.cpp - Driver for protobuf-C++ conversion ----------==//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// Implements a simple driver to print a C++ program from a protobuf.
+//
+//===----------------------------------------------------------------------===//
+
+// This is a copy and will be updated later to introduce changes
+
+#include <fstream>
+#include <iostream>
+#include <streambuf>
+#include <string>
+
+#include "loop_proto_to_cxx.h"
+
+int main(int argc, char **argv) {
+  for (int i = 1; i < argc; i++) {
+    std::fstream in(argv[i]);
+    std::string str((std::istreambuf_iterator<char>(in)),
+                    std::istreambuf_iterator<char>());
+    std::cout << "// " << argv[i] << std::endl;
+    std::cout << clang_fuzzer::ProtoToCxx(
+        reinterpret_cast<const uint8_t *>(str.data()), str.size());
+    // std::cout << clang_fuzzer::ProtoStringToCxx(str);
+  }
+}
+