68bcaf9be3
Reason for revert:
Found another mistake
Original issue's description:
> [fuzzer] Format README.md
>
> NOTRY=true
> R=hablich@chromium.org
>
> Review-Url: https://codereview.chromium.org/2692443002
> Cr-Commit-Position: refs/heads/master@{#43138}
> Committed:
|
||
|---|---|---|
| .. | ||
| json | ||
| parser | ||
| regexp | ||
| wasm_call | ||
| wasm_code | ||
| wasm_data_section | ||
| wasm_function_sigs_section | ||
| wasm_globals_section | ||
| wasm_imports_section | ||
| wasm_memory_section | ||
| wasm_names_section | ||
| wasm_types_section | ||
| DEPS | ||
| fuzzer-support.cc | ||
| fuzzer-support.h | ||
| fuzzer.cc | ||
| fuzzer.gyp | ||
| fuzzer.isolate | ||
| fuzzer.status | ||
| json.cc | ||
| parser.cc | ||
| README.md | ||
| regexp.cc | ||
| testcfg.py | ||
| wasm_asmjs.tar.gz.sha1 | ||
| wasm-asmjs.cc | ||
| wasm-call.cc | ||
| wasm-code.cc | ||
| wasm-data-section.cc | ||
| wasm-function-sigs-section.cc | ||
| wasm-globals-section.cc | ||
| wasm-imports-section.cc | ||
| wasm-memory-section.cc | ||
| wasm-names-section.cc | ||
| wasm-section-fuzzers.cc | ||
| wasm-section-fuzzers.h | ||
| wasm-types-section.cc | ||
| wasm.cc | ||
| wasm.tar.gz.sha1 | ||
How to make a libFuzzer fuzzer in V8
This document describes how to make a new libfuzzer fuzzer for V8. A general introduction to libfuzzer can be found at here. In short, libFuzzer is an in-process coverage-driven evolutionary fuzzer. libFuzzer serves you with a sequence of byte arrays that you can use to test your code. libFuzzer tries to generate this sequence of byte arrays in a way that maximizes test coverage.
Warning: By itself libFuzzer typically does not generate valid JavaScript code.
Changes to V8
tldr: Do the same as https://codereview.chromium.org/2280623002 to introduce a new fuzzer to V8.
This is a step by step guide on how to make a new fuzzer in V8. In the example the fuzzer is called foo.
- Copy one of the existing fuzzer implementations in test/fuzzer/, e.g.
cp wasm.cc foo.cc- Copying an existing fuzzer is a good idea to get all the required setup, e.g. setting up the isolate
- Create a directory called
fooin test/fuzzer/ which contains at least one file- The file is used by the trybots to check whether the fuzzer actually compiles and runs
- Copy the build rules of an existing fuzzer in BUILD.gn, e.g. the build rules for the wasm.cc fuzzer are
v8_source_set("wasm_fuzzer")andv8_fuzzer("wasm_fuzzer"). Note that the name has to be the name of the directory created in Step 2 + “_fuzzer” so that the scripts on the trybots work - Now you can already compile the fuzzer with
ninja -j 1000 -C out/tmp/v8_simple_foo_fuzzer- Use this binary to reproduce issues found by cluster fuzz, e.g.
out/tmp/v8_simple_foo_fuzzer testcase.foo
- Use this binary to reproduce issues found by cluster fuzz, e.g.
- Copy the build rules of an existing fuzzer in test/fuzzer/fuzzer.gyp, e.g. the build rules for the wasm.cc fuzzer are
v8_simple_wasm_fuzzerandwasm_fuzzer_lib- This build rule is needed to compile with gyp
- Copy the binary name and the test directory name in test/fuzzer/fuzzer.isolate
- Add the fuzzer to the FuzzerTestSuite in test/fuzzer/testcfg.py
- This step is needed to run the fuzzer with the files created in Step 2 on the trybots
- Commit the changes described above to the V8 repository
Changes to Chromium
tldr: Do the same as https://codereview.chromium.org/2344823002 to add the new fuzzer to cluster fuzz.
- Copy the build rules of an existing fuzzer in testing/libfuzzer/fuzzers/BUILD.gn, e.g. the build rule for the wasm.cc fuzzer is {v8_wasm_fuzzer}. There is no need to set a dictionary , or a seed_corpus. See chromium-fuzzing-getting-started for more information.
- Compile the fuzzer in chromium (for different configurations see: https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md):
gn gen out/libfuzzer '--args=use_libfuzzer=true is_asan=true is_debug=false enable_nacl=false'ninja -j 1000 -C out/libfuzzer/ v8_foo_fuzzer
- Run the fuzzer locally
mkdir /tmp/empty_corpus && out/libfuzzer/v8_foo_fuzzer /tmp/empty_corpus