commit 1f5638d63a1437a986cb66e40279c904f02500cd
author kcc <kcc> Fri Dec 08 22:21:42 2017 +0000
committer kcc <kcc> Fri Dec 08 22:21:42 2017 +0000
tree c98194b74c6256890a2cf4042e71e06315669d08
parent bfe8410020027520a0760011b26bbb4d1a6b38fb

[libFuzzer] honor -use_counters, sligntly change the meaning of -experimental_len_control, call UpdateFeatureFrequency only if instructed by the flag

git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk/lib/fuzzer@320205 91177308-0d34-0410-b5e6-96231b3b80d8

FuzzerLoop.cpp

diff --git a/FuzzerLoop.cpp b/FuzzerLoop.cpp
index f0de940..6ed48e0 100644
--- a/FuzzerLoop.cpp
+++ b/FuzzerLoop.cpp
@@ -443,7 +443,8 @@
   size_t FoundUniqFeaturesOfII = 0;
   size_t NumUpdatesBefore = Corpus.NumFeatureUpdates();
   TPC.CollectFeatures([&](size_t Feature) {
-    Corpus.UpdateFeatureFrequency(Feature);
+    if (Options.UseFeatureFrequency)
+      Corpus.UpdateFeatureFrequency(Feature);
     if (Corpus.AddFeature(Feature, Size, Options.Shrink))
       UniqFeatureSetTmp.push_back(Feature);
     if (Options.ReduceInputs && II)
@@ -757,7 +758,8 @@
     // Update TmpMaxMutationLen
     if (Options.ExperimentalLenControl) {
       if (TmpMaxMutationLen < MaxMutationLen &&
-          (TotalNumberOfRuns - LastCorpusUpdateRun > 1000 &&
+          (TotalNumberOfRuns - LastCorpusUpdateRun >
+               Options.ExperimentalLenControl &&
            duration_cast<seconds>(Now - LastCorpusUpdateTime).count() >= 1)) {
         LastCorpusUpdateRun = TotalNumberOfRuns;
         LastCorpusUpdateTime = Now;
@@ -765,8 +767,9 @@
             Min(MaxMutationLen,
                 TmpMaxMutationLen + Max(size_t(4), TmpMaxMutationLen / 8));
         if (TmpMaxMutationLen <= MaxMutationLen)
-          Printf("#%zd\tTEMP_MAX_LEN: %zd\n", TotalNumberOfRuns,
-                 TmpMaxMutationLen);
+          Printf("#%zd\tTEMP_MAX_LEN: %zd (%zd %zd)\n", TotalNumberOfRuns,
+                 TmpMaxMutationLen, Options.ExperimentalLenControl,
+                 LastCorpusUpdateRun);
       }
     } else {
       TmpMaxMutationLen = MaxMutationLen;

FuzzerOptions.h

diff --git a/FuzzerOptions.h b/FuzzerOptions.h
index 31e1a4d..15a3780 100644
--- a/FuzzerOptions.h
+++ b/FuzzerOptions.h
@@ -18,7 +18,7 @@
 struct FuzzingOptions {
   int Verbosity = 1;
   size_t MaxLen = 0;
-  bool ExperimentalLenControl = false;
+  size_t ExperimentalLenControl = 0;
   int UnitTimeoutSec = 300;
   int TimeoutExitCode = 77;
   int ErrorExitCode = 77;

FuzzerTracePC.h

diff --git a/FuzzerTracePC.h b/FuzzerTracePC.h
index 9df3d81..f3bb41e 100644
--- a/FuzzerTracePC.h
+++ b/FuzzerTracePC.h
@@ -230,7 +230,10 @@
   size_t N = GetNumPCs();
   auto Handle8bitCounter = [&](size_t FirstFeature,
                                size_t Idx, uint8_t Counter) {
-    HandleFeature(FirstFeature + Idx * 8 + CounterToFeature(Counter));
+    if (UseCounters)
+      HandleFeature(FirstFeature + Idx * 8 + CounterToFeature(Counter));
+    else
+      HandleFeature(FirstFeature + Idx);
   };
 
   size_t FirstFeature = 0;
@@ -251,8 +254,12 @@
   if (size_t NumClangCounters = ClangCountersEnd() - ClangCountersBegin()) {
     auto P = ClangCountersBegin();
     for (size_t Idx = 0; Idx < NumClangCounters; Idx++)
-      if (auto Cnt = P[Idx])
-        HandleFeature(FirstFeature + Idx * 8 + CounterToFeature(Cnt));
+      if (auto Cnt = P[Idx]) {
+        if (UseCounters)
+          HandleFeature(FirstFeature + Idx * 8 + CounterToFeature(Cnt));
+        else
+          HandleFeature(FirstFeature + Idx);
+      }
     FirstFeature += NumClangCounters;
   }