Add clang-fuzzer target

[kcc]

Summary

Add clang-fuzzer target.
This is a very naive and slow clang fuzzer, but it has found
one new bug (PR22396) and hit a known bug (PR21954) in just a few minutes,
so I think it deserves to be committed.
I would appreciate further contribution to fuzzer/ClangFuzzer.cpp
to make if faster and more meaningful.

[chandlerc]

CMakeLists.txt

537 ↗

(On Diff #19021)

This should be in tools/

[kcc]

move the fuzzer to tools/fuzzer

[chandlerc]

Er, I believe you already submitted this with Manuel's review. In the future, please have him actually mark the review on the mailing list so its clear to others that it was in fact reviewed.

[kcc]

Manuel wrote this from scratch. :)

tools/CMakeLists.txt

if(CLANG_ENABLE_ARCMT)
   add_subdirectory(arcmt-test)
   add_subdirectory(c-arcmt-test)
 endif()
 
 if(CLANG_ENABLE_STATIC_ANALYZER)
   add_subdirectory(clang-check)
 endif()
 
+if( LLVM_USE_SANITIZE_COVERAGE )
+  add_subdirectory(fuzzer)
+endif()
+
 # We support checking out the clang-tools-extra repository into the 'extra'
 # subdirectory. It contains tools developed as part of the Clang/LLVM project
 # on top of the Clang tooling platform. We keep them in a separate repository
 # to keep the primary Clang repository small and focused.
 # It also may be included by LLVM_EXTERNAL_CLANG_TOOLS_EXTRA_SOURCE_DIR.
 add_llvm_external_project(clang-tools-extra extra)

tools/fuzzer/CMakeLists.txt

+set(LLVM_LINK_COMPONENTS support)
+
+add_clang_executable(clang-fuzzer
+  ClangFuzzer.cpp
+  )
+
+target_link_libraries(clang-fuzzer
+  clangAST
+  clangASTMatchers
+  clangBasic
+  clangFrontend
+  clangLex
+  clangRewrite
+  clangTooling
+  clangToolingCore
+  LLVMFuzzer
+  )

tools/fuzzer/ClangFuzzer.cpp

+//===-- ClangFuzzer.cpp - Fuzz Clang --------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+///
+/// \file
+/// \brief This file implements a function that runs Clang on a single
+///  input. This function is then linked into the Fuzzer library.
+///  See llvm/lib/Fuzzer/README.txt for more instructions.
+///
+//===----------------------------------------------------------------------===//
+
+#include <stdio.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#include "clang/Tooling/Tooling.h"
+#include <string>
+
+// FIXME: The current implementation is very naive an inefficient:
+// - buildASTFromCode does a lot of driver work which slows down things.
+// - Errors are reported to stderr slowing things even further.
+//
+// What we really need here is a function that takes the array of bytes
+// and invokes preprocessor and/or parser on it, sending messages to dev/null.
+
+extern "C" void TestOneInput(uint8_t *data, size_t size) {
+  std::string S((char*)data, size);
+  clang::tooling::buildASTFromCode(S);
+}