From dec7e45f7c7e61a3778767bbc7f8e1e9a33b01fa Mon Sep 17 00:00:00 2001 From: Andrew Kelley Date: Sun, 4 Aug 2024 15:27:13 -0700 Subject: [PATCH] fuzzer web UI: receive coverage information * libfuzzer: track unique runs instead of deduplicated runs - easier for consumers to notice when to recheck the covered bits. * move common definitions to `std.Build.Fuzz.abi`. build runner sends all the information needed to fuzzer web interface client needed in order to display inline coverage information along with source code. --- lib/fuzzer.zig | 15 +- lib/fuzzer/index.html | 1 + lib/fuzzer/main.js | 203 +++++++---- lib/fuzzer/wasm/main.zig | 83 ++++- lib/std/Build/Fuzz.zig | 563 +--------------------------- lib/std/Build/Fuzz/WebServer.zig | 605 +++++++++++++++++++++++++++++++ lib/std/Build/Fuzz/abi.zig | 55 +++ 7 files changed, 877 insertions(+), 648 deletions(-) create mode 100644 lib/std/Build/Fuzz/WebServer.zig create mode 100644 lib/std/Build/Fuzz/abi.zig diff --git a/lib/fuzzer.zig b/lib/fuzzer.zig index 0d968cd60d..a3446f9823 100644 --- a/lib/fuzzer.zig +++ b/lib/fuzzer.zig @@ -3,6 +3,7 @@ const std = @import("std"); const Allocator = std.mem.Allocator; const assert = std.debug.assert; const fatal = std.process.fatal; +const SeenPcsHeader = std.Build.Fuzz.abi.SeenPcsHeader; pub const std_options = .{ .logFn = logOverride, @@ -120,13 +121,6 @@ const Fuzzer = struct { /// information, available to other processes. coverage_id: u64, - const SeenPcsHeader = extern struct { - n_runs: usize, - deduplicated_runs: usize, - pcs_len: usize, - lowest_stack: usize, - }; - const RunMap = std.ArrayHashMapUnmanaged(Run, void, Run.HashContext, false); const Coverage = struct { @@ -247,7 +241,7 @@ const Fuzzer = struct { } else { const header: SeenPcsHeader = .{ .n_runs = 0, - .deduplicated_runs = 0, + .unique_runs = 0, .pcs_len = flagged_pcs.len, .lowest_stack = std.math.maxInt(usize), }; @@ -292,8 +286,6 @@ const Fuzzer = struct { }); if (gop.found_existing) { //std.log.info("duplicate analysis: score={d} id={d}", .{ analysis.score, analysis.id }); - const header: *volatile SeenPcsHeader = @ptrCast(f.seen_pcs.items[0..@sizeOf(SeenPcsHeader)]); - _ = @atomicRmw(usize, &header.deduplicated_runs, .Add, 1, .monotonic); if (f.input.items.len < gop.key_ptr.input.len or gop.key_ptr.score == 0) { gpa.free(gop.key_ptr.input); gop.key_ptr.input = try gpa.dupe(u8, f.input.items); @@ -325,6 +317,9 @@ const Fuzzer = struct { _ = @atomicRmw(u8, elem, .Or, mask, .monotonic); } } + + const header: *volatile SeenPcsHeader = @ptrCast(f.seen_pcs.items[0..@sizeOf(SeenPcsHeader)]); + _ = @atomicRmw(usize, &header.unique_runs, .Add, 1, .monotonic); } if (f.recent_cases.entries.len >= 100) { diff --git a/lib/fuzzer/index.html b/lib/fuzzer/index.html index dadc2f91d3..0753bcae67 100644 --- a/lib/fuzzer/index.html +++ b/lib/fuzzer/index.html @@ -124,6 +124,7 @@ +

Loading JavaScript...