9 Commits

Author SHA1 Message Date
Andrew Kelley
ffc050e055 fuzzer: log errors and move deduplicated runs to shared mem 2024-08-07 00:48:32 -07:00
Andrew Kelley
97643c1ecc fuzzer: track code coverage from all runs
When a unique run is encountered, track it in a bit set memory-mapped
into the fuzz directory so it can be observed by other processes, even
while the fuzzer is running.
2024-08-07 00:48:32 -07:00
Andrew Kelley
688c2df646 fuzzer: use the cmp values
seems to provide better scoring
2024-07-25 18:52:21 -07:00
Andrew Kelley
6a63372053 fuzzer: basic implementation
just some experimentation. I didn't expect this to be effective so
quickly but it already can find a comparison made with mem.eql
2024-07-25 18:52:21 -07:00
Andrew Kelley
a3c74aca99 add --debug-rt CLI arg to the compiler + bonus edits
The flag makes compiler_rt and libfuzzer be in debug mode.

Also:
* fuzzer: override debug logs and disable debug logs for frequently
  called functions
* std.Build.Fuzz: fix bug of rerunning the old unit test binary
* report errors from rebuilding the unit tests better
* link.Elf: additionally add tsan lib and fuzzer lib to the hash
2024-07-25 18:52:21 -07:00
Andrew Kelley
6f3767862d implement std.testing.fuzzInput
For now this returns a dummy fuzz input.
2024-07-25 18:52:20 -07:00
Andrew Kelley
dbbe2f1094 libfuzzer: log all the libcalls to stderr 2024-07-22 14:26:17 -07:00
Andrew Kelley
7930efc60b libfuzzer: implement enough symbols for hello world 2024-07-22 13:07:02 -07:00
Andrew Kelley
54b7e144b1 initial support for integrated fuzzing
* Add the `-ffuzz` and `-fno-fuzz` CLI arguments.
* Detect fuzz testing flags from zig cc.
* Set the correct clang flags when fuzz testing is requested. It can be
  combined with TSAN and UBSAN.
* Compilation: build fuzzer library when needed which is currently an
  empty zig file.
* Add optforfuzzing to every function in the llvm backend for modules
  that have requested fuzzing.
* In ZigLLVMTargetMachineEmitToFile, add the optimization passes for
  sanitizer coverage.
* std.mem.eql uses a naive implementation optimized for fuzzing when
  builtin.fuzz is true.

Tracked by #20702
2024-07-22 13:07:02 -07:00