428bebaf10
The behavior of the CrossOver mutator has changed with bb54bcf84970c04c9748004f3a4cf59b0c1832a7. This seems to affect the value-profile-load test on Darwin. This patch provides a wider margin for determining success of the value-profile-load test, by testing the targeted functionality (i.e., GEP index value profile) more directly and faster. To this end, LoadTest.cpp now uses a narrower condition (Size != 8) for initial pruning of inputs, effectively preventing libFuzzer from generating inputs longer than necessary and spending time on mutating such long inputs in the corpus - a functionality not meant to be tested by this specific test. Previously, on x86/Linux, it required 6,597,751 execs with -use_value_profile=1 and 19,605,575 execs with -use_value_profile=0 to hit the crash. With this patch, the test passes with 174,493 execs, providing a wider margin from the given trials of 10,000,000. Note that, without the value profile (i.e., -use_value_profile=0), the test wouldn't pass as it still requires 19,605,575 execs to hit the crash. Differential Revision: https://reviews.llvm.org/D86247
24 lines
648 B
C++
24 lines
648 B
C++
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
|
|
// Simple test for a fuzzer: find interesting value of array index.
|
|
#include <assert.h>
|
|
#include <cstddef>
|
|
#include <cstdint>
|
|
#include <cstring>
|
|
#include <iostream>
|
|
|
|
static volatile int Sink;
|
|
const int kArraySize = 1234567;
|
|
int array[kArraySize];
|
|
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
|
if (Size != 8)
|
|
return 0;
|
|
uint64_t a = 0;
|
|
memcpy(&a, Data, 8);
|
|
Sink = array[a % (kArraySize + 1)];
|
|
return 0;
|
|
}
|