Page MenuHomePhabricator

[libFuzzer] Evenly select inputs to cross over with from the corpus regardless of the input's coverage.
ClosedPublic

Authored by dokyungs on Sep 1 2020, 9:29 AM.

Details

Summary

This patch adds an option "cross_over_uniform_dist", which, if 1, utilizes all
inputs in the corpus for the crossover mutation. More specifically, this patch
uses a uniform distribution of all inputs in the corpus for the CrossOver input
selection. Note that input selection for mutation is still fully determined by
the scheduling policy (i.e., vanilla or Entropic); the uniform distribution only
applies to the secondary input selection, only for the crossover mutation of the
base input chosen by the scheduling policy. This way the corpus inputs that have
useful fragments in them, even though they are deprioritized by the scheduling
policy, have chances of getting mixed with other inputs that are prioritized and
selected as base input for mutation.

Diff Detail

Event Timeline

dokyungs created this revision.Sep 1 2020, 9:29 AM
Herald added a project: Restricted Project. · View Herald TranscriptSep 1 2020, 9:29 AM
Herald added a subscriber: Restricted Project. · View Herald Transcript
dokyungs requested review of this revision.Sep 1 2020, 9:29 AM
dokyungs added inline comments.Sep 1 2020, 9:30 AM
compiler-rt/test/fuzzer/cross_over_uniform_dist.test
3

Will revisit this test after getting the keep seed patch upstreamed.

morehouse added inline comments.Sep 1 2020, 10:48 AM
compiler-rt/lib/fuzzer/FuzzerFlags.def
32

Please also document when this is useful.

hctim added inline comments.Sep 1 2020, 11:15 AM
compiler-rt/lib/fuzzer/FuzzerCorpus.h
274–279

nit: short branch first:

if (!UniformDist)
  return ChooseUnitToMutate(Rand);
...
dokyungs updated this revision to Diff 289494.Sep 2 2020, 9:28 AM

Addressed comments.

dokyungs marked 2 inline comments as done.Sep 2 2020, 9:29 AM
hctim accepted this revision.Sep 2 2020, 12:39 PM

LGTM (after the keep_seed patch lands)

This revision is now accepted and ready to land.Sep 2 2020, 12:39 PM
morehouse accepted this revision.Sep 2 2020, 5:28 PM

Please make sure the harbormaster test passes before landing.

dokyungs updated this revision to Diff 289749.Sep 3 2020, 9:38 AM

Fix cross_over_uniform_dist.test. If -cross_over_uniform_dist=1, it takes 766,756 execs to find the crash; if 0, it takes more than 2,000,000 execs to find the crash.

dokyungs updated this revision to Diff 289754.Sep 3 2020, 10:19 AM

Try adding double-quotes around seed input string being echoed.

dokyungs updated this revision to Diff 289782.Sep 3 2020, 12:04 PM

Adjust the test - make sure corpus/B input does not discover any more coverage than corpus/A, so that it's not scheduled for mutation even with -keep_seed=1. Only with uniform distribution. corpus/B has chances of getting crossed over with.

This revision was landed with ongoing or failed builds.Sep 3 2020, 1:01 PM
This revision was automatically updated to reflect the committed changes.