1e954f78d1
Summary:
Created unstable_handle flag that takes 1 or 2, depending on the handling type.
Modified RunOne to accommodate the following heuristic:
Use the first CollectFeatures to count how many features there are.
If no new features, CollectFeatures like before.
If there is new feature, we run CB 2 more times,
Check which edges are unstable per input and we store the least amount of hit counts for each edge.
Apply these hit counts back to inline8bitcounters so that CollectFeatures can work as intended.
Modified UnstableCounters to 8int_t and created a bitset UnstableSet to tell which edges are unstable.
Patch by Kyungtak Woo (@kevinwkt).
Reviewers: Dor1s, metzman, morehouse
Reviewed By: Dor1s, morehouse
Subscribers: delcypher, #sanitizers, llvm-commits, kcc
Differential Revision: https://reviews.llvm.org/D49525
llvm-svn: 337696
79 lines
2.1 KiB
C++
79 lines
2.1 KiB
C++
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
// fuzzer::FuzzingOptions
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#ifndef LLVM_FUZZER_OPTIONS_H
|
|
#define LLVM_FUZZER_OPTIONS_H
|
|
|
|
#include "FuzzerDefs.h"
|
|
|
|
namespace fuzzer {
|
|
|
|
struct FuzzingOptions {
|
|
int Verbosity = 1;
|
|
size_t MaxLen = 0;
|
|
size_t LenControl = 1000;
|
|
int UnitTimeoutSec = 300;
|
|
int TimeoutExitCode = 77;
|
|
int ErrorExitCode = 77;
|
|
int MaxTotalTimeSec = 0;
|
|
int RssLimitMb = 0;
|
|
int MallocLimitMb = 0;
|
|
bool DoCrossOver = true;
|
|
int MutateDepth = 5;
|
|
bool ReduceDepth = false;
|
|
bool UseCounters = false;
|
|
bool UseMemmem = true;
|
|
bool UseCmp = false;
|
|
int UseValueProfile = false;
|
|
bool Shrink = false;
|
|
bool ReduceInputs = false;
|
|
int ReloadIntervalSec = 1;
|
|
bool ShuffleAtStartUp = true;
|
|
bool PreferSmall = true;
|
|
size_t MaxNumberOfRuns = -1L;
|
|
int ReportSlowUnits = 10;
|
|
bool OnlyASCII = false;
|
|
std::string OutputCorpus;
|
|
std::string ArtifactPrefix = "./";
|
|
std::string ExactArtifactPath;
|
|
std::string ExitOnSrcPos;
|
|
std::string ExitOnItem;
|
|
std::string FocusFunction;
|
|
std::string DataFlowTrace;
|
|
bool SaveArtifacts = true;
|
|
bool PrintNEW = true; // Print a status line when new units are found;
|
|
bool PrintNewCovPcs = false;
|
|
int PrintNewCovFuncs = 0;
|
|
bool PrintFinalStats = false;
|
|
bool PrintMutationStats = false;
|
|
bool PrintCorpusStats = false;
|
|
bool PrintCoverage = false;
|
|
bool PrintUnstableStats = false;
|
|
int HandleUnstable = 0;
|
|
bool DumpCoverage = false;
|
|
bool DetectLeaks = true;
|
|
int PurgeAllocatorIntervalSec = 1;
|
|
int TraceMalloc = 0;
|
|
bool HandleAbrt = false;
|
|
bool HandleBus = false;
|
|
bool HandleFpe = false;
|
|
bool HandleIll = false;
|
|
bool HandleInt = false;
|
|
bool HandleSegv = false;
|
|
bool HandleTerm = false;
|
|
bool HandleXfsz = false;
|
|
bool HandleUsr1 = false;
|
|
bool HandleUsr2 = false;
|
|
};
|
|
|
|
} // namespace fuzzer
|
|
|
|
#endif // LLVM_FUZZER_OPTIONS_H
|