commit e29d7e3d485dcb7fc5aec4fc9edc9efe49b5ffbb
author kcc <kcc> Tue Dec 12 23:11:28 2017 +0000
committer kcc <kcc> Tue Dec 12 23:11:28 2017 +0000
tree a149e3d52fdb6701727b268057650c0d5fafde5b
parent d804ddb0e279800670bf19f64738facd2aa3d1b0

[libFuzzer] change the strategy for -experimental_len_control to grow max_len slower

git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk/lib/fuzzer@320531 91177308-0d34-0410-b5e6-96231b3b80d8

FuzzerInternal.h

diff --git a/FuzzerInternal.h b/FuzzerInternal.h
index 5ae9e2b..2b2638f 100644
--- a/FuzzerInternal.h
+++ b/FuzzerInternal.h
@@ -124,8 +124,6 @@
   size_t NumberOfNewUnitsAdded = 0;
 
   size_t LastCorpusUpdateRun = 0;
-  system_clock::time_point LastCorpusUpdateTime = system_clock::now();
-
 
   bool HasMoreMallocsThanFrees = false;
   size_t NumberOfLeakDetectionAttempts = 0;

FuzzerLoop.cpp

diff --git a/FuzzerLoop.cpp b/FuzzerLoop.cpp
index 6ed48e0..5b451ca 100644
--- a/FuzzerLoop.cpp
+++ b/FuzzerLoop.cpp
@@ -567,7 +567,6 @@
   NumberOfNewUnitsAdded++;
   CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus.
   LastCorpusUpdateRun = TotalNumberOfRuns;
-  LastCorpusUpdateTime = system_clock::now();
 }
 
 // Tries detecting a memory leak on the particular input that we have just
@@ -758,18 +757,15 @@
     // Update TmpMaxMutationLen
     if (Options.ExperimentalLenControl) {
       if (TmpMaxMutationLen < MaxMutationLen &&
-          (TotalNumberOfRuns - LastCorpusUpdateRun >
-               Options.ExperimentalLenControl &&
-           duration_cast<seconds>(Now - LastCorpusUpdateTime).count() >= 1)) {
-        LastCorpusUpdateRun = TotalNumberOfRuns;
-        LastCorpusUpdateTime = Now;
+          TotalNumberOfRuns - LastCorpusUpdateRun >
+              Options.ExperimentalLenControl * Log(TmpMaxMutationLen)) {
         TmpMaxMutationLen =
-            Min(MaxMutationLen,
-                TmpMaxMutationLen + Max(size_t(4), TmpMaxMutationLen / 8));
+            Min(MaxMutationLen, TmpMaxMutationLen + Log(TmpMaxMutationLen));
         if (TmpMaxMutationLen <= MaxMutationLen)
           Printf("#%zd\tTEMP_MAX_LEN: %zd (%zd %zd)\n", TotalNumberOfRuns,
                  TmpMaxMutationLen, Options.ExperimentalLenControl,
                  LastCorpusUpdateRun);
+        LastCorpusUpdateRun = TotalNumberOfRuns;
       }
     } else {
       TmpMaxMutationLen = MaxMutationLen;

FuzzerTracePC.h

diff --git a/FuzzerTracePC.h b/FuzzerTracePC.h
index 300e5db..dc65cd7 100644
--- a/FuzzerTracePC.h
+++ b/FuzzerTracePC.h
@@ -276,7 +276,7 @@
 
   // Step function, grows similar to 8 * Log_2(A).
   auto StackDepthStepFunction = [](uint32_t A) -> uint32_t {
-    uint32_t Log2 = 32 - __builtin_clz(A) - 1;
+    uint32_t Log2 = Log(A);
     if (Log2 < 3) return A;
     Log2 -= 3;
     return (Log2 + 1) * 8 + ((A >> Log2) & 7);

FuzzerUtil.h

diff --git a/FuzzerUtil.h b/FuzzerUtil.h
index 9a6227e..f2ed028 100644
--- a/FuzzerUtil.h
+++ b/FuzzerUtil.h
@@ -80,6 +80,8 @@
 
 size_t SimpleFastHash(const uint8_t *Data, size_t Size);
 
+inline uint32_t Log(uint32_t X) { return 32 - __builtin_clz(X) - 1; }
+
 }  // namespace fuzzer
 
 #endif  // LLVM_FUZZER_UTIL_H