[libFuzzer] Add an option to keep initial seed inputs around.

[dokyungs]

Summary

This patch adds an option "keep_seed" to keep all initial seed inputs. Previously, only the initial seed inputs that find new coverage were added to the corpus, and all the other initial inputs were discarded. We observed in some circumstances that useful initial seed inputs are discarded as they find no new coverage, even though they contain useful fragments in them (e.g., SQLITE3 FuzzBench benchmark). This newly added option provides a way to keeping seed inputs for those circumstances. With this patch, and with -keep_seed=1, all initial seed inputs are kept regardless of whether they find new coverage or not. Further, these seed inputs are not replaced with smaller inputs even if -reduce_inputs=1.

[dokyungs]

Add missing code.

[hctim]

Is it possible to fork the cross_over_uniformdist changes into a supplementary patchset easily? Seems like an related but indepentent change (prefer one patchset per feature if possible please -- reviewing is O(n^3) in lines-of-code-per-patch and it's also nice to have different commits for different features).

compiler-rt/lib/fuzzer/FuzzerFlags.def

27

When used with |reduce_inputs==1|, the seed inputs will never be reduced.

compiler-rt/lib/fuzzer/FuzzerFork.cpp

316

nit: spaces not tabs (and throughout)

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

490

Can't this be derived by II->SeedInput (as elsewhere)? It would be much cleaner to not have to maintain this variable in the class just for initialization. If it can't be derived by that, can you please make it a function paramater (you can even default it to false to avoid having to change all the other instances)

793

nit: number of corpus inputs = %d\n (just because it's absolutely 100% clear that it's number-of-units, not number-of-bytes)

compiler-rt/lib/fuzzer/tests/FuzzerUnittest.cpp

1061–1063

std::unique_ptr<InputCorpus> C(new InputCorpus("", Entropic, /* KeepSeed */ false)); (and elsewhere)

[dokyungs]

Addressed comments. Added keep-seed.test to support/test usefulness of the -keep_seed=1 flag.

[dokyungs]

compiler-rt/lib/fuzzer/FuzzerFork.cpp

316

I just checked that these are actually spaces.

[dokyungs]

In D86577#2237648, @hctim wrote:

Is it possible to fork the cross_over_uniformdist changes into a supplementary patchset easily? Seems like an related but indepentent change (prefer one patchset per feature if possible please -- reviewing is O(n^3) in lines-of-code-per-patch and it's also nice to have different commits for different features).

Yes, it is definitely possible. I will do in the next upload though, because I'd like to see if we can have some discussion here about how to make a good use the kept seed inputs.

[hctim]

compiler-rt/lib/fuzzer/FuzzerCorpus.h

284

nit: ChooseUnweightedInputToMutate or something like that. Make it clear that this is a uniform selection, not a bias-weighted selection.

compiler-rt/lib/fuzzer/FuzzerFlags.def

30

nit: cross_over_uniform_dist

compiler-rt/lib/fuzzer/FuzzerFork.cpp

316

Ah - I see, it's just the way that phabricator displays that the indentation level was increased. Interesting...

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

776

nit: please also give these unnamed constants the /* ArgName */ treatment

compiler-rt/lib/fuzzer/tests/FuzzerUnittest.cpp

601

While you're here can you give these the /* ArgName */ treatment as well, thanks

compiler-rt/test/fuzzer/keep-seed.test

8

Hmm - maybe a better test would be to run with and without keep_seed and verify that keep_seed can find it in less iterations? Can you also add a quick comment with the amount of runs required on your machine to trigger this bug with and without this patch? Thanks.

[dokyungs]

Addressed the comments except for the test comment (will follow up on the next upload), and removed uniform dist changes which will be uploaded as a separate patch.

[dokyungs]

compiler-rt/lib/fuzzer/FuzzerCorpus.h

284

Will reflect this comment in a separate patch.

compiler-rt/lib/fuzzer/FuzzerFlags.def

30

Reflect this comment in a separate patch.

[dokyungs]

Addressed the comment on the test.

With -keep_seed=0, it takes 5,150,128 execs to find the crash.
With -keep_seed=1, it takes 1,049,074 execs to find the crash. (because the seed input is not reduced.)

[dokyungs]

compiler-rt/test/fuzzer/keep-seed.test

8

Done.

With -keep_seed=0, it takes 5,150,128 execs to find the crash.
With -keep_seed=1, it takes 1,049,074 execs to find the crash. (because the seed input is not reduced.)

[dokyungs]

Fix comment in KeepSeedTest.cpp

[morehouse]

compiler-rt/lib/fuzzer/FuzzerCorpus.h

186

Feel free to disregard, but I'd like to protest the length of this parameter list.

I would happily review a separate patch that cleaned it up.

compiler-rt/lib/fuzzer/FuzzerFlags.def

28

Please also document the intended use case (i.e. when seeds are not properly formed for the fuzz target but still have useful snippets.

compiler-rt/lib/fuzzer/FuzzerInternal.h

71

Nit: Input params should come before output params

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

481

I think it's cleaner if we avoid checking Options.KeepSeed in this function, and instead check it in the caller. Then we could rename SeedInput to ForceAddToCorpus for clarity.

793

Isn't this information already printed above?

compiler-rt/lib/fuzzer/tests/FuzzerUnittest.cpp

597

Side note, feel free to ignore: Now that LLVM uses C++14, all these unique_ptr patterns can be simplified with std::make_unique:

auto C = std::make_unique<InputCorpus>("", Entropic, false);

(Separate patch is welcome)

compiler-rt/test/fuzzer/KeepSeedTest.cpp

35

Please clang-format this test.

[dokyungs]

Partially addressed comments.

[dokyungs]

compiler-rt/lib/fuzzer/FuzzerCorpus.h

186

Thanks! will send a separate patch!

compiler-rt/lib/fuzzer/FuzzerFlags.def

28

Done!

compiler-rt/lib/fuzzer/FuzzerInternal.h

71

Done.

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

481

I tried to do this, but wasn't sure the scope of change you were thinking of. Do you want the SeedInput member variable of InputInfo to be changed to ForceAddToCorpus too? We need to keep this information in InputInfo to prevent it being reduced to a smaller input here.

793

Removed. Printing wasn't necessary here.

compiler-rt/lib/fuzzer/tests/FuzzerUnittest.cpp

597

Thanks for the suggestion! Will send a separate patch.

compiler-rt/test/fuzzer/KeepSeedTest.cpp

35

Done. compiler-rt/test/.clang-format has ColumnLimit: 0 so I had to temporarily remove it to get 80 chars in each line.

[morehouse]

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

481

I just meant we could simplify slightly in this function by changing the param to ForceAddToCorpus and then unconditionally adding to corpus if its true. We can check the KeepSeed flag in the caller to determine if we want to force add the input or not.

[dokyungs]

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

481

I am not sure if I can simplify this that way, because SeedInput needs to propagate; it's stored in the InputInfos of all seed inputs when InputInfos are created by AddToCorpus. Storing this in a member variable SeedInput of InputInfo is needed to prevent them from being replaced. The above line prevents them from being replaced with new, non-seed inputs that's based on the seed input. It seems to me that, if we change the argument SeedInput to ForceAddToCorpus, SeedInput of InputInfo needs changing too. Please correct me if I am still misled :)

[morehouse]

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

481

Ok, I think I was confused because we have both SeedInput and II->SeedInput used in this function.

Is there any way we can make this simpler? Having to check 3 things that seem similar (Options.KeepSeed, SeedInput, II->SeedInput) in this single function is tricky.

[dokyungs]

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

481

Yes, I share the sense that this is confusing. What do you think of adding a new flag called reduce_seed_inputs, and check !Options.ReduceSeedInputs && II->SeedInput here rather than Options.KeepSeed && II->SeedInput? This is probably not simplifying things since it's more code, but adding a new flag could probably reduce possible confusion because it's more explanatory.

[hctim]

compiler-rt/lib/fuzzer/FuzzerCorpus.h

135

Vestigal - please delete.

compiler-rt/test/fuzzer/keep-seed.test

8

Can you also explicitly check that the number of runs with -keep_seed=1 uses less iterations? You can get the data by providing -print_final_stats=1, you can grep the number by stat::number_of_executed_units

[morehouse]

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

481

One idea:

• Rename II->KeepSeed to II->NeverReduce, and only set it to true if Options.KeepSeed == true.
• Rename the parameter KeepSeed to ForceAddToCorpus.

This seems more understandable to me, and we don't need to check Options.KeepSeed at all in this function.

[dokyungs]

Removed unused var.

compiler-rt/test/fuzzer/keep-seed.test

8

Currently it's implicitly implied that -keep_seed=1 uses less iterations (i) with not and 2 million runs above, and (ii) without not and 4 million runs below.

Do you have any idea how I can explicitly check this in a lit test? Can I use bash's -lt?

[hctim]

compiler-rt/test/fuzzer/keep-seed.test

8

Actually - what you have currently seems reasonable to me - but would you mind adding a comment to clarify? I missed the "works with 2m runs with this flag, doesn't work with 4m runs without it" context at first glance :(.

[dokyungs]

Give more general but descriptive variable names as suggested.

Options.KeepSeed -> ForceAddToCorpus -> InputInfo::NeverReduce

[dokyungs]

Add comment in keep-seed.test

[dokyungs]

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

481

Thanks for the idea. This seems a lot more descriptive, which is now reflected in the code.

compiler-rt/test/fuzzer/keep-seed.test

8

Done.

[dokyungs]

Reflect variable name change in FuzzerInternal.h

[morehouse]

LGTM

compiler-rt/lib/fuzzer/FuzzerCorpus.h

struct InputInfo {
   Unit U;  // The actual input data.
   uint8_t Sha1[kSHA1NumBytes];  // Checksum.
   // Number of features that this input has and no smaller input has.
   size_t NumFeatures = 0;
   size_t Tmp = 0; // Used by ValidateFeatureSet.
   // Stats.
   size_t NumExecutedMutations = 0;
   size_t NumSuccessfullMutations = 0;
+  bool SeedInput = false;
   bool MayDeleteFile = false;
   bool Reduced = false;
   bool HasFocusFunction = false;
   Vector<uint32_t> UniqFeatureSet;
   Vector<uint8_t> DataFlowTraceForFocusFunction;
   // Power schedule.
   bool NeedsEnergyUpdate = false;
   double Energy = 0.0;
class InputCorpus {
   static const uint32_t kFeatureSetSize = 1 << 21;
   static const uint8_t kMaxMutationFactor = 20;
   static const size_t kSparseEnergyUpdates = 100;
 
   size_t NumExecutedMutations = 0;
 
   EntropicOptions Entropic;
 
+  bool KeepSeed = false;
+
 public:
-  InputCorpus(const std::string &OutputCorpus, EntropicOptions Entropic)
-      : Entropic(Entropic), OutputCorpus(OutputCorpus) {
+  InputCorpus(const std::string &OutputCorpus, EntropicOptions Entropic,
+              bool KeepSeed)
+      : Entropic(Entropic), OutputCorpus(OutputCorpus), KeepSeed(KeepSeed) {
     memset(InputSizesPerFeature, 0, sizeof(InputSizesPerFeature));
     memset(SmallestElementPerFeature, 0, sizeof(SmallestElementPerFeature));
   }
   ~InputCorpus() {
     for (auto II : Inputs)
       delete II;
   }
   size_t size() const { return Inputs.size(); }
size_t NumInputsWithDataFlowTrace() {
     return std::count_if(Inputs.begin(), Inputs.end(), [](const InputInfo *II) {
       return !II->DataFlowTraceForFocusFunction.empty();
     });
   }
 
   bool empty() const { return Inputs.empty(); }
   const Unit &operator[] (size_t Idx) const { return Inputs[Idx]->U; }
   InputInfo *AddToCorpus(const Unit &U, size_t NumFeatures, bool MayDeleteFile,
-                         bool HasFocusFunction,
+                         bool HasFocusFunction, bool SeedInput,
                          const Vector<uint32_t> &FeatureSet,
                          const DataFlowTrace &DFT, const InputInfo *BaseII) {
     assert(!U.empty());
     if (FeatureDebug)
       Printf("ADD_TO_CORPUS %zd NF %zd\n", Inputs.size(), NumFeatures);
     Inputs.push_back(new InputInfo());
     InputInfo &II = *Inputs.back();
     II.U = U;
     II.NumFeatures = NumFeatures;
+    II.SeedInput = SeedInput;
     II.MayDeleteFile = MayDeleteFile;
     II.UniqFeatureSet = FeatureSet;
     II.HasFocusFunction = HasFocusFunction;
     // Assign maximal energy to the new seed.
     II.Energy = RareFeatures.empty() ? 1.0 : log(RareFeatures.size());
     II.SumIncidence = RareFeatures.size();
     II.NeedsEnergyUpdate = false;
     std::sort(II.UniqFeatureSet.begin(), II.UniqFeatureSet.end());
public:
   // Returns an index of random unit from the corpus to mutate.
   size_t ChooseUnitIdxToMutate(Random &Rand) {
     UpdateCorpusDistribution(Rand);
     size_t Idx = static_cast<size_t>(CorpusDistribution(Rand));
     assert(Idx < Inputs.size());
     return Idx;
   }
 
+  InputInfo &ChooseUnitToCrossOverWith(Random &Rand) {
+    InputInfo &II = *Inputs[Rand(Inputs.size())];
+    return II;
+  }
+
   void PrintStats() {
     for (size_t i = 0; i < Inputs.size(); i++) {
       const auto &II = *Inputs[i];
       Printf("  [% 3zd %s] sz: % 5zd runs: % 5zd succ: % 5zd focus: %d\n", i,
              Sha1ToString(II.Sha1).c_str(), II.U.size(),
              II.NumExecutedMutations, II.NumSuccessfullMutations, II.HasFocusFunction);
     }
   }

compiler-rt/lib/fuzzer/FuzzerDriver.cpp

int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
 
   if (Flags.workers > 0 && Flags.jobs > 0)
     return RunInMultipleProcesses(Args, Flags.workers, Flags.jobs);
 
   FuzzingOptions Options;
   Options.Verbosity = Flags.verbosity;
   Options.MaxLen = Flags.max_len;
   Options.LenControl = Flags.len_control;
+  Options.KeepSeed = Flags.keep_seed;
   Options.UnitTimeoutSec = Flags.timeout;
   Options.ErrorExitCode = Flags.error_exitcode;
   Options.TimeoutExitCode = Flags.timeout_exitcode;
   Options.IgnoreTimeouts = Flags.ignore_timeouts;
   Options.IgnoreOOMs = Flags.ignore_ooms;
   Options.IgnoreCrashes = Flags.ignore_crashes;
   Options.MaxTotalTimeSec = Flags.max_total_time;
   Options.DoCrossOver = Flags.cross_over;
+  Options.CrossOverUniformDist = Flags.cross_over_uniformdist;
   Options.MutateDepth = Flags.mutate_depth;
   Options.ReduceDepth = Flags.reduce_depth;
   Options.UseCounters = Flags.use_counters;
   Options.UseMemmem = Flags.use_memmem;
   Options.UseCmp = Flags.use_cmp;
   Options.UseValueProfile = Flags.use_value_profile;
   Options.Shrink = Flags.shrink;
   Options.ReduceInputs = Flags.reduce_inputs;
if (RunIndividualFiles)
                         ReadCorpora({}, *Inputs));
     else
       return CollectDataFlow(Flags.collect_data_flow, Flags.data_flow_trace,
                         ReadCorpora(*Inputs, {}));
   }
 
   Random Rand(Seed);
   auto *MD = new MutationDispatcher(Rand, Options);
-  auto *Corpus = new InputCorpus(Options.OutputCorpus, Entropic);
+  auto *Corpus =
+      new InputCorpus(Options.OutputCorpus, Entropic, Options.KeepSeed);
   auto *F = new Fuzzer(Callback, *Corpus, *MD, Options);
 
   for (auto &U: Dictionary)
     if (U.size() <= Word::GetMaxSize())
       MD->AddWordToManualDictionary(Word(U.data(), U.size()));
 
       // Threads are only supported by Chrome. Don't use them with emscripten
       // for now.

compiler-rt/lib/fuzzer/FuzzerFlags.def

FUZZER_FLAG_INT(max_len, 0, "Maximum length of the test input. "
     "and reports it. ")
 FUZZER_FLAG_INT(len_control, 100, "Try generating small inputs first, "
   "then try larger inputs over time.  Specifies the rate at which the length "
   "limit is increased (smaller == faster).  If 0, immediately try inputs with "
   "size up to max_len. Default value is 0, if LLVMFuzzerCustomMutator is used.")
 FUZZER_FLAG_STRING(seed_inputs, "A comma-separated list of input files "
   "to use as an additional seed corpus. Alternatively, an \"@\" followed by "
   "the name of a file containing the comma-separated list.")
+FUZZER_FLAG_INT(keep_seed, 0, "If 1, keep seed inputs for mutation even if "
+  "they do not produce new coverage. When used with |reduce_inputs==1|, the "
+  "seed inputs will never be reduced.")
 FUZZER_FLAG_INT(cross_over, 1, "If 1, cross over inputs.")
+FUZZER_FLAG_INT(cross_over_uniformdist, 0, "Experimental. If 1, use a uniform "
+  "probability distribution when choosing inputs to cross over with.")
 FUZZER_FLAG_INT(mutate_depth, 5,
             "Apply this number of consecutive mutations to each input.")
 FUZZER_FLAG_INT(reduce_depth, 0, "Experimental/internal. "
                 "Reduce depth if mutations lose unique features")
 FUZZER_FLAG_INT(shuffle, 1, "Shuffle inputs at startup")
 FUZZER_FLAG_INT(prefer_small, 1,
     "If 1, always prefer smaller inputs during the corpus shuffle.")
 FUZZER_FLAG_INT(

compiler-rt/lib/fuzzer/FuzzerFork.cpp

void FuzzWithFork(Random &Rand, const FuzzingOptions &Options,
   MkDir(Env.DFTDir);
 
 
   if (CorpusDirs.empty())
     MkDir(Env.MainCorpusDir = DirPlusFile(Env.TempDir, "C"));
   else
     Env.MainCorpusDir = CorpusDirs[0];
 
+  if (Options.KeepSeed) {
+    for (auto &File : SeedFiles)
+      Env.Files.push_back(File.File);
+  } else {
     auto CFPath = DirPlusFile(Env.TempDir, "merge.txt");
     CrashResistantMerge(Env.Args, {}, SeedFiles, &Env.Files, {}, &Env.Features,
-                      {}, &Env.Cov,
-                      CFPath, false);
+                        {}, &Env.Cov, CFPath, false);
     RemoveFile(CFPath);
+  }
   Printf("INFO: -fork=%d: %zd seed inputs, starting to fuzz in %s\n", NumJobs,
          Env.Files.size(), Env.TempDir.c_str());
 
   int ExitCode = 0;
 
   JobQueue FuzzQ, MergeQ;
 
   auto StopJobs = [&]() {

compiler-rt/lib/fuzzer/FuzzerInternal.h

public:
   static void StaticCrashSignalCallback();
   static void StaticExitCallback();
   static void StaticInterruptCallback();
   static void StaticFileSizeExceedCallback();
   static void StaticGracefulExitCallback();
 
   void ExecuteCallback(const uint8_t *Data, size_t Size);
   bool RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile = false,
-              InputInfo *II = nullptr, bool *FoundUniqFeatures = nullptr);
+              InputInfo *II = nullptr, bool *FoundUniqFeatures = nullptr,
+              bool SeedInput = false);
 
   // Merge Corpora[1:] into Corpora[0].
   void Merge(const Vector<std::string> &Corpora);
   void CrashResistantMergeInternalStep(const std::string &ControlFilePath);
   MutationDispatcher &GetMD() { return MD; }
   void PrintFinalStats();
   void SetMaxInputLen(size_t MaxInputLen);
   void SetMaxMutationLen(size_t MaxMutationLen);

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

static void RenameFeatureSetFile(const std::string &FeaturesDir,
                                  const std::string &OldFile,
                                  const std::string &NewFile) {
   if (FeaturesDir.empty()) return;
   RenameFile(DirPlusFile(FeaturesDir, OldFile),
              DirPlusFile(FeaturesDir, NewFile));
 }
 
 bool Fuzzer::RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile,
-                    InputInfo *II, bool *FoundUniqFeatures) {
+                    InputInfo *II, bool *FoundUniqFeatures, bool SeedInput) {
   if (!Size)
     return false;
 
   ExecuteCallback(Data, Size);
 
   UniqFeatureSetTmp.clear();
   size_t FoundUniqFeaturesOfII = 0;
   size_t NumUpdatesBefore = Corpus.NumFeatureUpdates();
   TPC.CollectFeatures([&](size_t Feature) {
     if (Corpus.AddFeature(Feature, Size, Options.Shrink))
       UniqFeatureSetTmp.push_back(Feature);
     if (Options.Entropic)
       Corpus.UpdateFeatureFrequency(II, Feature);
-    if (Options.ReduceInputs && II)
+    if (Options.ReduceInputs && II && !(Options.KeepSeed && II->SeedInput))
       if (std::binary_search(II->UniqFeatureSet.begin(),
                              II->UniqFeatureSet.end(), Feature))
         FoundUniqFeaturesOfII++;
   });
   if (FoundUniqFeatures)
     *FoundUniqFeatures = FoundUniqFeaturesOfII;
   PrintPulseAndReportSlowInput(Data, Size);
   size_t NumNewFeatures = Corpus.NumFeatureUpdates() - NumUpdatesBefore;
-  if (NumNewFeatures) {
+  if (NumNewFeatures || (Options.KeepSeed && SeedInput)) {
     TPC.UpdateObservedPCs();
     auto NewII = Corpus.AddToCorpus({Data, Data + Size}, NumNewFeatures,
                                     MayDeleteFile, TPC.ObservedFocusFunction(),
-                                    UniqFeatureSetTmp, DFT, II);
+                                    SeedInput, UniqFeatureSetTmp, DFT, II);
     WriteFeatureSetToFile(Options.FeaturesDir, Sha1ToString(NewII->Sha1),
                           NewII->UniqFeatureSet);
     return true;
   }
   if (II && FoundUniqFeaturesOfII &&
       II->DataFlowTraceForFocusFunction.empty() &&
       FoundUniqFeaturesOfII == II->UniqFeatureSet.size() &&
       II->U.size() > Size) {
if (EF->__lsan_do_recoverable_leak_check()) { // Leak is found, report it.
     _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on.
   }
 }
 
 void Fuzzer::MutateAndTestOne() {
   MD.StartMutationSequence();
 
   auto &II = Corpus.ChooseUnitToMutate(MD.GetRand());
-  if (Options.DoCrossOver)
+  if (Options.DoCrossOver) {
+    if (Options.CrossOverUniformDist) {
+      MD.SetCrossOverWith(&Corpus.ChooseUnitToCrossOverWith(MD.GetRand()).U);
+    } else {
       MD.SetCrossOverWith(&Corpus.ChooseUnitToMutate(MD.GetRand()).U);
+    }
+  }
   const auto &U = II.U;
   memcpy(BaseSha1, II.Sha1, sizeof(BaseSha1));
   assert(CurrentUnitData);
   size_t Size = U.size();
   assert(Size <= MaxInputLen && "Oversized Unit");
   memcpy(CurrentUnitData, U.data(), Size);
 
   assert(MaxMutationLen > 0);
if (Options.PreferSmall) {
       std::stable_sort(CorporaFiles.begin(), CorporaFiles.end());
       assert(CorporaFiles.front().Size <= CorporaFiles.back().Size);
     }
 
     // Load and execute inputs one by one.
     for (auto &SF : CorporaFiles) {
       auto U = FileToVector(SF.File, MaxInputLen, /*ExitOnError=*/false);
       assert(U.size() <= MaxInputLen);
-      RunOne(U.data(), U.size());
+      RunOne(U.data(), U.size(), false, nullptr, nullptr, /*SeedInput*/ true);
       CheckExitOnSrcPosOrItem();
       TryDetectingAMemoryLeak(U.data(), U.size(),
                               /*DuringInitialCorpusExecution*/ true);
     }
   }
 
   PrintStats("INITED");
   if (!Options.FocusFunction.empty()) {
     Printf("INFO: %zd/%zd inputs touch the focus function\n",
            Corpus.NumInputsThatTouchFocusFunction(), Corpus.size());
     if (!Options.DataFlowTrace.empty())
       Printf("INFO: %zd/%zd inputs have the Data Flow Trace\n",
              Corpus.NumInputsWithDataFlowTrace(),
              Corpus.NumInputsThatTouchFocusFunction());
   }
 
+  Printf("INFO: number of corpus inputs = %d\n", Corpus.size());
+
   if (Corpus.empty() && Options.MaxNumberOfRuns) {
     Printf("ERROR: no interesting inputs were found. "
            "Is the code instrumented for coverage? Exiting.\n");
     exit(1);
   }
 }
 
 void Fuzzer::Loop(Vector<SizedFile> &CorporaFiles) {

compiler-rt/lib/fuzzer/FuzzerOptions.h

 #include "FuzzerDefs.h"
 
 namespace fuzzer {
 
 struct FuzzingOptions {
   int Verbosity = 1;
   size_t MaxLen = 0;
   size_t LenControl = 1000;
+  bool KeepSeed = false;
   int UnitTimeoutSec = 300;
   int TimeoutExitCode = 70;
   int OOMExitCode = 71;
   int InterruptExitCode = 72;
   int ErrorExitCode = 77;
   bool IgnoreTimeouts = true;
   bool IgnoreOOMs = true;
   bool IgnoreCrashes = false;
   int MaxTotalTimeSec = 0;
   int RssLimitMb = 0;
   int MallocLimitMb = 0;
   bool DoCrossOver = true;
+  bool CrossOverUniformDist = false;
   int MutateDepth = 5;
   bool ReduceDepth = false;
   bool UseCounters = false;
   bool UseMemmem = true;
   bool UseCmp = false;
   int UseValueProfile = false;
   bool Shrink = false;
   bool ReduceInputs = false;

compiler-rt/lib/fuzzer/tests/FuzzerUnittest.cpp

 
 #include "FuzzerCorpus.h"
 #include "FuzzerDictionary.h"
 #include "FuzzerInternal.h"
 #include "FuzzerMerge.h"
 #include "FuzzerMutate.h"
 #include "FuzzerRandom.h"
 #include "FuzzerTracePC.h"
 #include "gtest/gtest.h"
 #include <memory>
 #include <set>
 #include <sstream>
 
 using namespace fuzzer;
 
 // For now, have LLVMFuzzerTestOneInput just to make it link.
 // Later we may want to make unittests that actually call LLVMFuzzerTestOneInput.
TEST(FuzzerUtil, Base64) {
   EXPECT_EQ("YWJjeHk=", Base64({'a', 'b', 'c', 'x', 'y'}));
   EXPECT_EQ("YWJjeHl6", Base64({'a', 'b', 'c', 'x', 'y', 'z'}));
 }
 
 TEST(Corpus, Distribution) {
   DataFlowTrace DFT;
   Random Rand(0);
   struct EntropicOptions Entropic = {false, 0xFF, 100};
-  std::unique_ptr<InputCorpus> C(new InputCorpus("", Entropic));
+  std::unique_ptr<InputCorpus> C(
+      new InputCorpus("", Entropic, /* KeepSeed */ false));
   size_t N = 10;
   size_t TriesPerUnit = 1<<16;
   for (size_t i = 0; i < N; i++)
-    C->AddToCorpus(Unit{static_cast<uint8_t>(i)}, 1, false, false, {}, DFT,
-                   nullptr);
+    C->AddToCorpus(Unit{static_cast<uint8_t>(i)}, 1, false, false, false, {},
+                   DFT, nullptr);
 
   Vector<size_t> Hist(N);
   for (size_t i = 0; i < N * TriesPerUnit; i++) {
     Hist[C->ChooseUnitIdxToMutate(Rand)]++;
   }
   for (size_t i = 0; i < N; i++) {
     // A weak sanity check that every unit gets invoked.
     EXPECT_GT(Hist[i], TriesPerUnit / N / 3);

 }
 
 TEST(Entropic, UpdateFrequency) {
   const size_t One = 1, Two = 2;
   const size_t FeatIdx1 = 0, FeatIdx2 = 42, FeatIdx3 = 12, FeatIdx4 = 26;
   size_t Index;
   // Create input corpus with default entropic configuration
   struct EntropicOptions Entropic = {true, 0xFF, 100};
-  std::unique_ptr<InputCorpus> C(new InputCorpus("", Entropic));
+  std::unique_ptr<InputCorpus> C(
+      new InputCorpus("", Entropic, /* KeepSeed */ false));
   std::unique_ptr<InputInfo> II(new InputInfo());
 
   C->AddRareFeature(FeatIdx1);
   C->UpdateFeatureFrequency(II.get(), FeatIdx1);
   EXPECT_EQ(II->FeatureFreqs.size(), One);
   C->AddRareFeature(FeatIdx2);
   C->UpdateFeatureFrequency(II.get(), FeatIdx1);
   C->UpdateFeatureFrequency(II.get(), FeatIdx2);
   EXPECT_EQ(II->FeatureFreqs.size(), Two);
double SubAndSquare(double X, double Y) {
   double R = X - Y;
   R = R * R;
   return R;
 }
 
 TEST(Entropic, ComputeEnergy) {
   const double Precision = 0.01;
   struct EntropicOptions Entropic = {true, 0xFF, 100};
-  std::unique_ptr<InputCorpus> C(new InputCorpus("", Entropic));
+  std::unique_ptr<InputCorpus> C(
+      new InputCorpus("", Entropic, /* KeepSeed */ false));
   std::unique_ptr<InputInfo> II(new InputInfo());
   Vector<std::pair<uint32_t, uint16_t>> FeatureFreqs = {{1, 3}, {2, 3}, {3, 3}};
   II->FeatureFreqs = FeatureFreqs;
   II->NumExecutedMutations = 0;
   II->UpdateEnergy(4);
   EXPECT_LT(SubAndSquare(II->Energy, 1.450805), Precision);
 
   II->NumExecutedMutations = 9;

compiler-rt/test/fuzzer/KeepSeedTest.cpp

+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+// Test whether the fuzzer can find "SELECT FROM TABLE", given a seed input
+// "SELECTxFROMxTABLE". Without -keep_seed=1, it takes longer time to trigger
+// find the desired string, because the seed input is more likely to be reduced
+// to a prefix of the given input first, losing useful fragments towards the end
+// of the seed input.
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+static volatile int Sink = 0;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  if (Size > 17) return 0;
+
+  if (Size >= 6 && Data[0] == 'S' && Data[1] == 'E' && Data[2] == 'L'
+      && Data[3] == 'E' && Data[4] == 'C' && Data[5] == 'T') {
+    if (Size >= 7 && Data[6] == ' ') {
+      if (Size >= 11 && Data[7] == 'F' && Data[8] == 'R' && Data[9] == 'O'
+          && Data[10] == 'M') {
+        if (Size >= 12 && Data[11] == ' ') {
+          if (Size >= 17 && Data[12] == 'T' && Data[13] == 'A' && Data[14] == 'B'
+              && Data[15] == 'L' && Data[16] == 'E') {
+            fprintf(stderr, "BINGO; Found the target, exiting.\n");
+            exit(1);
+          }
+        }
+      }
+    }
+  }
+  return 0;
+}

compiler-rt/test/fuzzer/keep-seed.test

+REQUIRES: linux, x86_64
+RUN: %cpp_compiler %S/KeepSeedTest.cpp -o %t-KeepSeedTest
+
+RUN: rm -rf %t-corpus
+RUN: mkdir %t-corpus
+RUN: echo -n SELECTxFROMxTABLE > %t-corpus/valid-fragments
+
+RUN: not %run %t-KeepSeedTest -keep_seed=1 -seed=1 -runs=10000000 %t-corpus 2>&1 | FileCheck %s
+CHECK: BINGO