2018-01-19 16:13:05 +00:00
|
|
|
# Copyright 2018 the V8 project authors. All rights reserved.
|
|
|
|
# Use of this source code is governed by a BSD-style license that can be
|
|
|
|
# found in the LICENSE file.
|
|
|
|
|
|
|
|
from collections import namedtuple
|
2018-01-19 19:33:21 +00:00
|
|
|
import time
|
2018-01-19 16:13:05 +00:00
|
|
|
|
|
|
|
from . import base
|
|
|
|
|
|
|
|
|
2019-11-08 12:57:47 +00:00
|
|
|
# Extra flags randomly added to all fuzz tests with numfuzz. List of tuples
|
|
|
|
# (probability, flag).
|
|
|
|
EXTRA_FLAGS = [
|
2019-11-11 14:18:18 +00:00
|
|
|
(0.1, '--always-opt'),
|
|
|
|
(0.1, '--assert-types'),
|
|
|
|
(0.1, '--cache=code'),
|
|
|
|
(0.1, '--force-slow-path'),
|
|
|
|
(0.2, '--future'),
|
|
|
|
(0.1, '--jitless'),
|
|
|
|
(0.1, '--liftoff'),
|
|
|
|
(0.1, '--minor-mc'),
|
|
|
|
(0.2, '--no-analyze-environment-liveness'),
|
2019-11-08 12:57:47 +00:00
|
|
|
(0.1, '--no-enable-sse3'),
|
|
|
|
(0.1, '--no-enable-ssse3'),
|
|
|
|
(0.1, '--no-enable-sse4_1'),
|
|
|
|
(0.1, '--no-enable-sse4_2'),
|
|
|
|
(0.1, '--no-enable-sahf'),
|
|
|
|
(0.1, '--no-enable-avx'),
|
|
|
|
(0.1, '--no-enable-fma3'),
|
|
|
|
(0.1, '--no-enable-bmi1'),
|
|
|
|
(0.1, '--no-enable-bmi2'),
|
|
|
|
(0.1, '--no-enable-lzcnt'),
|
|
|
|
(0.1, '--no-enable-popcnt'),
|
2019-11-11 14:18:18 +00:00
|
|
|
(0.1, '--no-liftoff'),
|
|
|
|
(0.1, '--no-opt'),
|
|
|
|
(0.2, '--no-regexp-tier-up'),
|
|
|
|
(0.1, '--no-wasm-tier-up'),
|
|
|
|
(0.1, '--regexp-interpret-all'),
|
|
|
|
(0.1, '--regexp-tier-up-ticks=10'),
|
|
|
|
(0.1, '--regexp-tier-up-ticks=100'),
|
|
|
|
(0.1, '--stress-background-compile'),
|
|
|
|
(0.1, '--turbo-instruction-scheduling'),
|
|
|
|
(0.1, '--turbo-stress-instruction-scheduling'),
|
|
|
|
(0.1, '--turboprop'),
|
2019-11-08 12:57:47 +00:00
|
|
|
]
|
|
|
|
|
|
|
|
def random_extra_flags(rng):
|
|
|
|
"""Returns a random list of flags chosen from the configurations in
|
|
|
|
EXTRA_FLAGS.
|
|
|
|
"""
|
|
|
|
return [flag for prob, flag in EXTRA_FLAGS if rng.random() < prob]
|
|
|
|
|
|
|
|
|
2018-01-19 16:13:05 +00:00
|
|
|
class FuzzerConfig(object):
|
|
|
|
def __init__(self, probability, analyzer, fuzzer):
|
|
|
|
"""
|
|
|
|
Args:
|
|
|
|
probability: of choosing this fuzzer (0; 10]
|
|
|
|
analyzer: instance of Analyzer class, can be None if no analysis is needed
|
|
|
|
fuzzer: instance of Fuzzer class
|
|
|
|
"""
|
|
|
|
assert probability > 0 and probability <= 10
|
|
|
|
|
|
|
|
self.probability = probability
|
|
|
|
self.analyzer = analyzer
|
|
|
|
self.fuzzer = fuzzer
|
|
|
|
|
|
|
|
|
|
|
|
class Analyzer(object):
|
|
|
|
def get_analysis_flags(self):
|
|
|
|
raise NotImplementedError()
|
|
|
|
|
|
|
|
def do_analysis(self, result):
|
|
|
|
raise NotImplementedError()
|
|
|
|
|
|
|
|
|
|
|
|
class Fuzzer(object):
|
2018-01-22 15:33:05 +00:00
|
|
|
def create_flags_generator(self, rng, test, analysis_value):
|
|
|
|
"""
|
|
|
|
Args:
|
|
|
|
rng: random number generator
|
|
|
|
test: test for which to create flags
|
|
|
|
analysis_value: value returned by the analyzer. None if there is no
|
2018-01-23 15:42:37 +00:00
|
|
|
corresponding analyzer to this fuzzer or the analysis phase is disabled
|
2018-01-22 15:33:05 +00:00
|
|
|
"""
|
2018-01-19 16:13:05 +00:00
|
|
|
raise NotImplementedError()
|
|
|
|
|
|
|
|
|
|
|
|
# TODO(majeski): Allow multiple subtests to run at once.
|
|
|
|
class FuzzerProc(base.TestProcProducer):
|
2018-01-25 15:18:29 +00:00
|
|
|
def __init__(self, rng, count, fuzzers, disable_analysis=False):
|
2018-01-19 16:13:05 +00:00
|
|
|
"""
|
|
|
|
Args:
|
|
|
|
rng: random number generator used to select flags and values for them
|
|
|
|
count: number of tests to generate based on each base test
|
|
|
|
fuzzers: list of FuzzerConfig instances
|
2018-01-23 15:42:37 +00:00
|
|
|
disable_analysis: disable analysis phase and filtering base on it. When
|
|
|
|
set, processor passes None as analysis result to fuzzers
|
2018-01-19 16:13:05 +00:00
|
|
|
"""
|
|
|
|
super(FuzzerProc, self).__init__('Fuzzer')
|
|
|
|
|
|
|
|
self._rng = rng
|
|
|
|
self._count = count
|
|
|
|
self._fuzzer_configs = fuzzers
|
2018-01-23 15:42:37 +00:00
|
|
|
self._disable_analysis = disable_analysis
|
2018-01-19 16:13:05 +00:00
|
|
|
self._gens = {}
|
|
|
|
|
|
|
|
def setup(self, requirement=base.DROP_RESULT):
|
|
|
|
# Fuzzer is optimized to not store the results
|
|
|
|
assert requirement == base.DROP_RESULT
|
|
|
|
super(FuzzerProc, self).setup(requirement)
|
|
|
|
|
|
|
|
def _next_test(self, test):
|
2018-01-24 18:25:45 +00:00
|
|
|
if self.is_stopped:
|
2019-01-30 12:20:17 +00:00
|
|
|
return False
|
2018-01-19 19:33:21 +00:00
|
|
|
|
2018-01-23 15:42:37 +00:00
|
|
|
analysis_subtest = self._create_analysis_subtest(test)
|
|
|
|
if analysis_subtest:
|
2019-01-30 12:20:17 +00:00
|
|
|
return self._send_test(analysis_subtest)
|
|
|
|
|
|
|
|
self._gens[test.procid] = self._create_gen(test)
|
|
|
|
return self._try_send_next_test(test)
|
2018-01-23 15:42:37 +00:00
|
|
|
|
|
|
|
def _create_analysis_subtest(self, test):
|
|
|
|
if self._disable_analysis:
|
|
|
|
return None
|
|
|
|
|
2018-01-19 16:13:05 +00:00
|
|
|
analysis_flags = []
|
|
|
|
for fuzzer_config in self._fuzzer_configs:
|
|
|
|
if fuzzer_config.analyzer:
|
|
|
|
analysis_flags += fuzzer_config.analyzer.get_analysis_flags()
|
|
|
|
|
|
|
|
if analysis_flags:
|
|
|
|
analysis_flags = list(set(analysis_flags))
|
2018-01-23 15:42:37 +00:00
|
|
|
return self._create_subtest(test, 'analysis', flags=analysis_flags,
|
|
|
|
keep_output=True)
|
2018-01-19 16:13:05 +00:00
|
|
|
|
|
|
|
def _result_for(self, test, subtest, result):
|
2018-01-23 15:42:37 +00:00
|
|
|
if not self._disable_analysis:
|
|
|
|
if result is not None:
|
|
|
|
# Analysis phase, for fuzzing we drop the result.
|
|
|
|
if result.has_unexpected_output:
|
|
|
|
self._send_result(test, None)
|
|
|
|
return
|
2019-01-30 12:20:17 +00:00
|
|
|
|
2018-01-23 15:42:37 +00:00
|
|
|
self._gens[test.procid] = self._create_gen(test, result)
|
2018-01-19 16:13:05 +00:00
|
|
|
|
|
|
|
self._try_send_next_test(test)
|
|
|
|
|
|
|
|
def _create_gen(self, test, analysis_result=None):
|
|
|
|
# It will be called with analysis_result==None only when there is no
|
|
|
|
# analysis phase at all, so no fuzzer has it's own analyzer.
|
|
|
|
gens = []
|
|
|
|
indexes = []
|
2019-11-08 12:57:47 +00:00
|
|
|
for fuzzer_config in self._fuzzer_configs:
|
2018-01-19 16:13:05 +00:00
|
|
|
analysis_value = None
|
2018-01-23 15:42:37 +00:00
|
|
|
if analysis_result and fuzzer_config.analyzer:
|
2018-01-19 16:13:05 +00:00
|
|
|
analysis_value = fuzzer_config.analyzer.do_analysis(analysis_result)
|
|
|
|
if not analysis_value:
|
|
|
|
# Skip fuzzer for this test since it doesn't have analysis data
|
|
|
|
continue
|
|
|
|
p = fuzzer_config.probability
|
2018-01-22 15:33:05 +00:00
|
|
|
flag_gen = fuzzer_config.fuzzer.create_flags_generator(self._rng, test,
|
2018-01-19 16:13:05 +00:00
|
|
|
analysis_value)
|
|
|
|
indexes += [len(gens)] * p
|
|
|
|
gens.append((p, flag_gen))
|
|
|
|
|
|
|
|
if not gens:
|
|
|
|
# No fuzzers for this test, skip it
|
|
|
|
return
|
|
|
|
|
2018-01-19 19:33:21 +00:00
|
|
|
i = 0
|
2018-01-24 18:25:45 +00:00
|
|
|
while not self._count or i < self._count:
|
2018-01-19 16:13:05 +00:00
|
|
|
main_index = self._rng.choice(indexes)
|
|
|
|
_, main_gen = gens[main_index]
|
|
|
|
|
2019-11-08 12:57:47 +00:00
|
|
|
flags = random_extra_flags(self._rng) + next(main_gen)
|
2018-01-19 16:13:05 +00:00
|
|
|
for index, (p, gen) in enumerate(gens):
|
|
|
|
if index == main_index:
|
|
|
|
continue
|
|
|
|
if self._rng.randint(1, 10) <= p:
|
|
|
|
flags += next(gen)
|
|
|
|
|
|
|
|
flags.append('--fuzzer-random-seed=%s' % self._next_seed())
|
|
|
|
yield self._create_subtest(test, str(i), flags=flags)
|
|
|
|
|
2018-01-19 19:33:21 +00:00
|
|
|
i += 1
|
|
|
|
|
2018-01-19 16:13:05 +00:00
|
|
|
def _try_send_next_test(self, test):
|
2018-01-24 18:25:45 +00:00
|
|
|
if not self.is_stopped:
|
2018-01-19 19:33:21 +00:00
|
|
|
for subtest in self._gens[test.procid]:
|
2019-01-30 12:20:17 +00:00
|
|
|
if self._send_test(subtest):
|
|
|
|
return True
|
2018-01-19 16:13:05 +00:00
|
|
|
|
|
|
|
del self._gens[test.procid]
|
2019-01-30 12:20:17 +00:00
|
|
|
return False
|
2018-01-19 16:13:05 +00:00
|
|
|
|
|
|
|
def _next_seed(self):
|
|
|
|
seed = None
|
|
|
|
while not seed:
|
|
|
|
seed = self._rng.randint(-2147483648, 2147483647)
|
|
|
|
return seed
|
|
|
|
|
|
|
|
|
|
|
|
class ScavengeAnalyzer(Analyzer):
|
|
|
|
def get_analysis_flags(self):
|
|
|
|
return ['--fuzzer-gc-analysis']
|
|
|
|
|
|
|
|
def do_analysis(self, result):
|
|
|
|
for line in reversed(result.output.stdout.splitlines()):
|
|
|
|
if line.startswith('### Maximum new space size reached = '):
|
|
|
|
return int(float(line.split()[7]))
|
|
|
|
|
|
|
|
|
|
|
|
class ScavengeFuzzer(Fuzzer):
|
2018-01-22 15:33:05 +00:00
|
|
|
def create_flags_generator(self, rng, test, analysis_value):
|
2018-01-19 16:13:05 +00:00
|
|
|
while True:
|
2018-01-23 15:42:37 +00:00
|
|
|
yield ['--stress-scavenge=%d' % (analysis_value or 100)]
|
2018-01-19 16:13:05 +00:00
|
|
|
|
|
|
|
|
|
|
|
class MarkingAnalyzer(Analyzer):
|
|
|
|
def get_analysis_flags(self):
|
|
|
|
return ['--fuzzer-gc-analysis']
|
|
|
|
|
|
|
|
def do_analysis(self, result):
|
|
|
|
for line in reversed(result.output.stdout.splitlines()):
|
|
|
|
if line.startswith('### Maximum marking limit reached = '):
|
|
|
|
return int(float(line.split()[6]))
|
|
|
|
|
|
|
|
|
|
|
|
class MarkingFuzzer(Fuzzer):
|
2018-01-22 15:33:05 +00:00
|
|
|
def create_flags_generator(self, rng, test, analysis_value):
|
2018-01-19 16:13:05 +00:00
|
|
|
while True:
|
2018-01-23 15:42:37 +00:00
|
|
|
yield ['--stress-marking=%d' % (analysis_value or 100)]
|
2018-01-19 16:13:05 +00:00
|
|
|
|
|
|
|
|
|
|
|
class GcIntervalAnalyzer(Analyzer):
|
|
|
|
def get_analysis_flags(self):
|
|
|
|
return ['--fuzzer-gc-analysis']
|
|
|
|
|
|
|
|
def do_analysis(self, result):
|
|
|
|
for line in reversed(result.output.stdout.splitlines()):
|
|
|
|
if line.startswith('### Allocations = '):
|
|
|
|
return int(float(line.split()[3][:-1]))
|
|
|
|
|
|
|
|
|
|
|
|
class GcIntervalFuzzer(Fuzzer):
|
2018-01-22 15:33:05 +00:00
|
|
|
def create_flags_generator(self, rng, test, analysis_value):
|
2018-01-23 15:42:37 +00:00
|
|
|
if analysis_value:
|
2019-10-17 14:12:45 +00:00
|
|
|
value = analysis_value // 10
|
2018-01-23 15:42:37 +00:00
|
|
|
else:
|
|
|
|
value = 10000
|
2018-01-19 16:13:05 +00:00
|
|
|
while True:
|
|
|
|
yield ['--random-gc-interval=%d' % value]
|
|
|
|
|
|
|
|
|
|
|
|
class CompactionFuzzer(Fuzzer):
|
2018-01-22 15:33:05 +00:00
|
|
|
def create_flags_generator(self, rng, test, analysis_value):
|
2018-01-19 16:13:05 +00:00
|
|
|
while True:
|
|
|
|
yield ['--stress-compaction-random']
|
2018-01-22 15:33:05 +00:00
|
|
|
|
|
|
|
|
2018-10-10 09:09:14 +00:00
|
|
|
class TaskDelayFuzzer(Fuzzer):
|
|
|
|
def create_flags_generator(self, rng, test, analysis_value):
|
|
|
|
while True:
|
|
|
|
yield ['--stress-delay-tasks']
|
|
|
|
|
|
|
|
|
2018-02-16 19:15:01 +00:00
|
|
|
class ThreadPoolSizeFuzzer(Fuzzer):
|
|
|
|
def create_flags_generator(self, rng, test, analysis_value):
|
|
|
|
while True:
|
|
|
|
yield ['--thread-pool-size=%d' % rng.randint(1, 8)]
|
|
|
|
|
|
|
|
|
2018-01-22 15:33:05 +00:00
|
|
|
class DeoptAnalyzer(Analyzer):
|
|
|
|
MAX_DEOPT=1000000000
|
|
|
|
|
|
|
|
def __init__(self, min_interval):
|
|
|
|
super(DeoptAnalyzer, self).__init__()
|
|
|
|
self._min = min_interval
|
|
|
|
|
|
|
|
def get_analysis_flags(self):
|
|
|
|
return ['--deopt-every-n-times=%d' % self.MAX_DEOPT,
|
|
|
|
'--print-deopt-stress']
|
|
|
|
|
|
|
|
def do_analysis(self, result):
|
|
|
|
for line in reversed(result.output.stdout.splitlines()):
|
|
|
|
if line.startswith('=== Stress deopt counter: '):
|
|
|
|
counter = self.MAX_DEOPT - int(line.split(' ')[-1])
|
|
|
|
if counter < self._min:
|
|
|
|
# Skip this test since we won't generate any meaningful interval with
|
|
|
|
# given minimum.
|
|
|
|
return None
|
|
|
|
return counter
|
|
|
|
|
|
|
|
|
|
|
|
class DeoptFuzzer(Fuzzer):
|
|
|
|
def __init__(self, min_interval):
|
|
|
|
super(DeoptFuzzer, self).__init__()
|
|
|
|
self._min = min_interval
|
|
|
|
|
|
|
|
def create_flags_generator(self, rng, test, analysis_value):
|
|
|
|
while True:
|
2018-01-23 15:42:37 +00:00
|
|
|
if analysis_value:
|
2019-10-17 14:12:45 +00:00
|
|
|
value = analysis_value // 2
|
2018-01-23 15:42:37 +00:00
|
|
|
else:
|
|
|
|
value = 10000
|
2018-01-22 15:33:05 +00:00
|
|
|
interval = rng.randint(self._min, max(value, self._min))
|
|
|
|
yield ['--deopt-every-n-times=%d' % interval]
|
2018-01-23 15:42:37 +00:00
|
|
|
|
|
|
|
|
|
|
|
FUZZERS = {
|
|
|
|
'compaction': (None, CompactionFuzzer),
|
2018-10-10 09:09:14 +00:00
|
|
|
'delay': (None, TaskDelayFuzzer),
|
2018-01-23 15:42:37 +00:00
|
|
|
'deopt': (DeoptAnalyzer, DeoptFuzzer),
|
2018-01-29 15:51:03 +00:00
|
|
|
'gc_interval': (GcIntervalAnalyzer, GcIntervalFuzzer),
|
|
|
|
'marking': (MarkingAnalyzer, MarkingFuzzer),
|
|
|
|
'scavenge': (ScavengeAnalyzer, ScavengeFuzzer),
|
2018-02-16 19:15:01 +00:00
|
|
|
'threads': (None, ThreadPoolSizeFuzzer),
|
2018-01-23 15:42:37 +00:00
|
|
|
}
|
|
|
|
|
2018-01-29 15:51:03 +00:00
|
|
|
|
2018-01-23 15:42:37 +00:00
|
|
|
def create_fuzzer_config(name, probability, *args, **kwargs):
|
|
|
|
analyzer_class, fuzzer_class = FUZZERS[name]
|
|
|
|
return FuzzerConfig(
|
|
|
|
probability,
|
|
|
|
analyzer_class(*args, **kwargs) if analyzer_class else None,
|
|
|
|
fuzzer_class(*args, **kwargs),
|
|
|
|
)
|