Revert "[libFuzzer] Mutation tracking and logging implemented"
This reverts r336597 due to bot breakage.
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk/lib/fuzzer@336616 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/FuzzerDriver.cpp b/FuzzerDriver.cpp
index 6c785eb..c2f8583 100644
--- a/FuzzerDriver.cpp
+++ b/FuzzerDriver.cpp
@@ -613,7 +613,6 @@
Options.PrintNewCovPcs = Flags.print_pcs;
Options.PrintNewCovFuncs = Flags.print_funcs;
Options.PrintFinalStats = Flags.print_final_stats;
- Options.PrintMutationStats = Flags.print_mutation_stats;
Options.PrintCorpusStats = Flags.print_corpus_stats;
Options.PrintCoverage = Flags.print_coverage;
Options.DumpCoverage = Flags.dump_coverage;
diff --git a/FuzzerFlags.def b/FuzzerFlags.def
index b77a1ff..aaa1727 100644
--- a/FuzzerFlags.def
+++ b/FuzzerFlags.def
@@ -153,4 +153,3 @@
FUZZER_FLAG_INT(analyze_dict, 0, "Experimental")
FUZZER_DEPRECATED_FLAG(use_clang_coverage)
FUZZER_FLAG_STRING(data_flow_trace, "Experimental: use the data flow trace")
-FUZZER_FLAG_INT(print_mutation_stats, 0, "Experimental")
diff --git a/FuzzerLoop.cpp b/FuzzerLoop.cpp
index 1a2276f..d412b58 100644
--- a/FuzzerLoop.cpp
+++ b/FuzzerLoop.cpp
@@ -355,8 +355,6 @@
TPC.DumpCoverage();
if (Options.PrintCorpusStats)
Corpus.PrintStats();
- if (Options.PrintMutationStats)
- MD.PrintMutationStats();
if (!Options.PrintFinalStats)
return;
size_t ExecPerSec = execPerSec();
diff --git a/FuzzerMutate.cpp b/FuzzerMutate.cpp
index ef059fc..865e598 100644
--- a/FuzzerMutate.cpp
+++ b/FuzzerMutate.cpp
@@ -58,10 +58,6 @@
if (EF->LLVMFuzzerCustomCrossOver)
Mutators.push_back(
{&MutationDispatcher::Mutate_CustomCrossOver, "CustomCrossOver"});
-
- // Initialize mutation statistic counters.
- TotalMutations.resize(Mutators.size(), 0);
- UsefulMutations.resize(Mutators.size(), 0);
}
static char RandCh(Random &Rand) {
@@ -265,9 +261,9 @@
DE = MakeDictionaryEntryFromCMP(X.A, X.B, Data, Size);
} break;
case 3: if (Options.UseMemmem) {
- auto X = TPC.MMT.Get(Rand.Rand());
- DE = DictionaryEntry(X);
- } break;
+ auto X = TPC.MMT.Get(Rand.Rand());
+ DE = DictionaryEntry(X);
+ } break;
default:
assert(0);
}
@@ -435,18 +431,18 @@
auto &U = MutateInPlaceHere;
size_t NewSize = 0;
switch(Rand(3)) {
- case 0:
- NewSize = CrossOver(Data, Size, O.data(), O.size(), U.data(), U.size());
- break;
- case 1:
- NewSize = InsertPartOf(O.data(), O.size(), U.data(), U.size(), MaxSize);
- if (!NewSize)
+ case 0:
+ NewSize = CrossOver(Data, Size, O.data(), O.size(), U.data(), U.size());
+ break;
+ case 1:
+ NewSize = InsertPartOf(O.data(), O.size(), U.data(), U.size(), MaxSize);
+ if (!NewSize)
+ NewSize = CopyPartOf(O.data(), O.size(), U.data(), U.size());
+ break;
+ case 2:
NewSize = CopyPartOf(O.data(), O.size(), U.data(), U.size());
- break;
- case 2:
- NewSize = CopyPartOf(O.data(), O.size(), U.data(), U.size());
- break;
- default: assert(0);
+ break;
+ default: assert(0);
}
assert(NewSize > 0 && "CrossOver returned empty unit");
assert(NewSize <= MaxSize && "CrossOver returned overisized unit");
@@ -455,7 +451,7 @@
}
void MutationDispatcher::StartMutationSequence() {
- CurrentMutatorIdxSequence.clear();
+ CurrentMutatorSequence.clear();
CurrentDictionaryEntrySequence.clear();
}
@@ -469,7 +465,6 @@
if (!PersistentAutoDictionary.ContainsWord(DE->GetW()))
PersistentAutoDictionary.push_back({DE->GetW(), 1});
}
- RecordUsefulMutations();
}
void MutationDispatcher::PrintRecommendedDictionary() {
@@ -489,9 +484,9 @@
}
void MutationDispatcher::PrintMutationSequence() {
- Printf("MS: %zd ", CurrentMutatorIdxSequence.size());
- for (auto M : CurrentMutatorIdxSequence)
- Printf("%s-", Mutators[M].Name);
+ Printf("MS: %zd ", CurrentMutatorSequence.size());
+ for (auto M : CurrentMutatorSequence)
+ Printf("%s-", M.Name);
if (!CurrentDictionaryEntrySequence.empty()) {
Printf(" DE: ");
for (auto DE : CurrentDictionaryEntrySequence) {
@@ -519,14 +514,12 @@
// in which case they will return 0.
// Try several times before returning un-mutated data.
for (int Iter = 0; Iter < 100; Iter++) {
- size_t MutatorIdx = Rand(Mutators.size());
- auto M = Mutators[MutatorIdx];
+ auto M = Mutators[Rand(Mutators.size())];
size_t NewSize = (this->*(M.Fn))(Data, Size, MaxSize);
if (NewSize && NewSize <= MaxSize) {
if (Options.OnlyASCII)
ToASCII(Data, NewSize);
- CurrentMutatorIdxSequence.push_back(MutatorIdx);
- TotalMutations[MutatorIdx]++;
+ CurrentMutatorSequence.push_back(M);
return NewSize;
}
}
@@ -539,23 +532,4 @@
{W, std::numeric_limits<size_t>::max()});
}
-void MutationDispatcher::RecordUsefulMutations() {
- for (const size_t M : CurrentMutatorIdxSequence)
- UsefulMutations[M]++;
-}
-
-void MutationDispatcher::PrintMutationStats() {
- Printf("\nstat::mutation_usefulness: ");
- for (size_t i = 0; i < Mutators.size(); i++) {
- double UsefulPercentage =
- TotalMutations[i]
- ? (100.0 * UsefulMutations[i]) / TotalMutations[i]
- : 0;
- Printf("%.3f", UsefulPercentage);
- if (i < Mutators.size() - 1)
- Printf(",");
- }
- Printf("\n");
-}
-
} // namespace fuzzer
diff --git a/FuzzerMutate.h b/FuzzerMutate.h
index 3216522..996d756 100644
--- a/FuzzerMutate.h
+++ b/FuzzerMutate.h
@@ -86,11 +86,8 @@
Random &GetRand() { return Rand; }
- void PrintMutationStats();
-
- void RecordUsefulMutations();
-
private:
+
struct Mutator {
size_t (MutationDispatcher::*Fn)(uint8_t *Data, size_t Size, size_t Max);
const char *Name;
@@ -131,8 +128,8 @@
// entries that led to successful discoveries in the past mutations.
Dictionary PersistentAutoDictionary;
+ Vector<Mutator> CurrentMutatorSequence;
Vector<DictionaryEntry *> CurrentDictionaryEntrySequence;
- Vector<size_t> CurrentMutatorIdxSequence;
static const size_t kCmpDictionaryEntriesDequeSize = 16;
DictionaryEntry CmpDictionaryEntriesDeque[kCmpDictionaryEntriesDequeSize];
@@ -146,11 +143,6 @@
Vector<Mutator> Mutators;
Vector<Mutator> DefaultMutators;
-
- // A total count of each mutation used in the fuzzing process.
- Vector<uint64_t> TotalMutations;
- // The number of each mutation that resulted in new coverage.
- Vector<uint64_t> UsefulMutations;
};
} // namespace fuzzer
diff --git a/FuzzerOptions.h b/FuzzerOptions.h
index 019dc6f..ab90df8 100644
--- a/FuzzerOptions.h
+++ b/FuzzerOptions.h
@@ -52,7 +52,6 @@
bool PrintNewCovPcs = false;
int PrintNewCovFuncs = 0;
bool PrintFinalStats = false;
- bool PrintMutationStats = false;
bool PrintCorpusStats = false;
bool PrintCoverage = false;
bool DumpCoverage = false;