Update README and Dockerfile to include llvm-proto-fuzzer

[emmettneyman]

Summary

Added commands to Dockerfile to build llvm-proto-fuzzer and the other related tools. Also added a section to the bottom of the README describing what llvm-proto-fuzzer does and how to run it.

[emmettneyman]

Is there anything I should add to the documentation? Anything I should remove?

[morehouse]

clang/tools/clang-fuzzer/README.txt

104 ↗

(On Diff #160959)

bin/clang-loop-proto-to-llvm CORPUS_OUTPUT_FILE

106 ↗

(On Diff #160959)

bin/clang-loop-proto-to-cxx CORPUS_OUTPUT_FILE

111 ↗

(On Diff #160959)

Maybe add a sample cmake invocation?

[emmettneyman]

Added to README

[emmettneyman]

Rebased and ready to land

cfe/trunk/tools/clang-fuzzer/Dockerfile

RUN mkdir build1 && cd build1 && cmake -GNinja -DCMAKE_BUILD_TYPE=Release ../llvm \
     -DCMAKE_C_COMPILER=`pwd`/../build0/bin/clang \
     -DCMAKE_CXX_COMPILER=`pwd`/../build0/bin/clang++ \
     -DLLVM_USE_SANITIZE_COVERAGE=YES \
     -DLLVM_USE_SANITIZER=Address -DCLANG_ENABLE_PROTO_FUZZER=ON
 # Build the fuzzers
 RUN cd build1 && ninja clang-fuzzer
 RUN cd build1 && ninja clang-proto-fuzzer
 RUN cd build1 && ninja clang-proto-to-cxx
+RUN cd build1 && ninja clang-loop-proto-to-cxx
+RUN cd build1 && ninja clang-loop-proto-to-llvm
+RUN cd build1 && ninja clang-loop-proto-fuzzer
+RUN cd build1 && ninja clang-llvm-proto-fuzzer

cfe/trunk/tools/clang-fuzzer/README.txt

 Arguments can be specified after -ignore_remaining_args=1 to modify the compiler
 invocation.  For example, the following command line will fuzz LLVM with a
 custom optimization level and target triple:
   bin/clang-proto-fuzzer CORPUS_DIR -ignore_remaining_args=1 -O3 -triple \
       arm64apple-ios9
 
 To translate a clang-proto-fuzzer corpus output to C++:
   bin/clang-proto-to-cxx CORPUS_OUTPUT_FILE
+
+===================
+ llvm-proto-fuzzer
+===================
+Like, clang-proto-fuzzer, llvm-proto-fuzzer is also a protobuf-mutator based
+fuzzer. It receives as input a cxx_loop_proto which it then converts into a
+string of valid LLVM IR: a function with either a single loop or two nested
+loops. It then creates a new string of IR by running optimization passes over
+the original IR. Currently, it only runs a loop-vectorize pass but more passes
+can easily be added to the fuzzer. Once there are two versions of the input
+function (optimized and not), llvm-proto-fuzzer uses LLVM's JIT Engine to
+compile both functions. Lastly, it runs both functions on a suite of inputs and
+checks that both functions behave the same on all inputs. In this way,
+llvm-proto-fuzzer can find not only compiler crashes, but also miscompiles
+originating from LLVM's optimization passes.
+
+llvm-proto-fuzzer is built very similarly to clang-proto-fuzzer. You can run the
+fuzzer with the following command:
+  bin/clang-llvm-proto-fuzzer CORPUS_DIR
+
+To translate a cxx_loop_proto file into LLVM IR do:
+  bin/clang-loop-proto-to-llvm CORPUS_OUTPUT_FILE
+To translate a cxx_loop_proto file into C++ do:
+  bin/clang-loop-proto-to-cxx CORPUS_OUTPUT_FILE
+
+Note: To get a higher number of executions per second with llvm-proto-fuzzer it
+helps to build it without ASan instrumentation and with the -O2 flag. Because
+the fuzzer is not only compiling code, but also running it, as the inputs get
+large, the time necessary to fuzz one input can get very high.
+Example:
+  cmake .. -GNinja -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ \
+    -DCLANG_ENABLE_PROTO_FUZZER=ON -DLLVM_USE_SANITIZE_COVERAGE=YES \
+    -DCMAKE_CXX_FLAGS="-O2"
+  ninja clang-llvm-proto-fuzzer clang-loop-proto-to-llvm