Add clang-fuzzer target

[kcc]

Summary

Add clang-fuzzer target.
This is a very naive and slow clang fuzzer, but it has found
one new bug (PR22396) and hit a known bug (PR21954) in just a few minutes,
so I think it deserves to be committed.
I would appreciate further contribution to fuzzer/ClangFuzzer.cpp
to make if faster and more meaningful.

[chandlerc]

CMakeLists.txt

537

This should be in tools/

[kcc]

move the fuzzer to tools/fuzzer

[chandlerc]

Er, I believe you already submitted this with Manuel's review. In the future, please have him actually mark the review on the mailing list so its clear to others that it was in fact reviewed.

[kcc]

Manuel wrote this from scratch. :)

CMakeLists.txt

if (CLANG_BUILT_STANDALONE)
 
   # Also copy ClangConfig.cmake to the build directory so that dependent projects
   # can build against a build directory of Clang more easily.
   configure_file(
     ${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules/ClangConfig.cmake
     ${CLANG_BINARY_DIR}/share/clang/cmake/ClangConfig.cmake
     COPYONLY)
 endif ()
+
+if( LLVM_USE_SANITIZE_COVERAGE )
+  add_subdirectory(fuzzer)
+endif()

fuzzer/CMakeLists.txt

+set(LLVM_LINK_COMPONENTS support)
+
+add_clang_executable(clang-fuzzer
+  ClangFuzzer.cpp
+  )
+
+target_link_libraries(clang-fuzzer
+  clangAST
+  clangASTMatchers
+  clangBasic
+  clangFrontend
+  clangLex
+  clangRewrite
+  clangTooling
+  clangToolingCore
+  LLVMFuzzer
+  )

fuzzer/ClangFuzzer.cpp

+//===-- ClangFuzzer.cpp - Fuzz Clang --------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+///
+/// \file
+/// \brief This file implements a function that runs Clang on a single
+///  input. This function is then linked into the Fuzzer library.
+///  See llvm/lib/Fuzzer/README.txt for more instructions.
+///
+//===----------------------------------------------------------------------===//
+
+#include <stdio.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#include "clang/Tooling/Tooling.h"
+#include <string>
+
+// FIXME: The current implementation is very naive an inefficient:
+// - buildASTFromCode does a lot of driver work which slows down things.
+// - Errors are reported to stderr slowing things even further.
+//
+// What we really need here is a function that takes the array of bytes
+// and invokes preprocessor and/or parser on it, sending messages to dev/null.
+
+extern "C" void TestOneInput(uint8_t *data, size_t size) {
+  std::string S((char*)data, size);
+  clang::tooling::buildASTFromCode(S);
+}