167af9923SKostya Serebryany# Tests the data flow tracer. 2f7212308SJonathan MetzmanREQUIRES: linux, x86_64 367af9923SKostya Serebryany 4*07055623SGeorge Balatsouras# Disabling due to dfs$ prefix to .dfsan suffix change in DFSan. 5*07055623SGeorge Balatsouras# TODO(kcc): re-enable. 6*07055623SGeorge BalatsourasRUN: false 7*07055623SGeorge BalatsourasXFAIL: * 8*07055623SGeorge Balatsouras 967af9923SKostya Serebryany# Build the tracer and the test. 10*07055623SGeorge BalatsourasDISABLED: %no_fuzzer_cpp_compiler -c -fno-sanitize=all -fsanitize=dataflow %S/../../lib/fuzzer/dataflow/DataFlow.cpp -o %t-DataFlow.o 11*07055623SGeorge BalatsourasDISABLED: %no_fuzzer_cpp_compiler -c -fno-sanitize=all -fPIC %S/../../lib/fuzzer/dataflow/DataFlowCallbacks.cpp -o %t-DataFlowCallbacks.o 12*07055623SGeorge BalatsourasDISABLED: %no_fuzzer_cpp_compiler -fno-sanitize=all -fsanitize=dataflow -fsanitize-coverage=trace-pc-guard,pc-table,bb,trace-cmp %S/OnlySomeBytesTest.cpp %t-DataFlow*.o -o %t-DFT 13*07055623SGeorge BalatsourasDISABLED: %cpp_compiler %S/OnlySomeBytesTest.cpp -o %t-Fuzz 1467af9923SKostya Serebryany 1567af9923SKostya Serebryany# Prepare the inputs. 16*07055623SGeorge BalatsourasDISABLED: rm -rf %t/* 17*07055623SGeorge BalatsourasDISABLED: mkdir -p %t/IN 18*07055623SGeorge BalatsourasDISABLED: echo -n 0123456789012345678901234567890123456789012345678901234567891234 > %t/IN/6 19*07055623SGeorge BalatsourasDISABLED: cat %t/IN/6 %t/IN/6 %t/IN/6 %t/IN/6 > %t/IN/8 20*07055623SGeorge BalatsourasDISABLED: cat %t/IN/8 %t/IN/8 %t/IN/8 %t/IN/8 > %t/IN/10 21*07055623SGeorge BalatsourasDISABLED: cat %t/IN/10 %t/IN/10 %t/IN/10 %t/IN/10 > %t/IN/12 2267af9923SKostya Serebryany# %t/IN/12 is 4096 bytes-long. 2367af9923SKostya Serebryany 24*07055623SGeorge BalatsourasDISABLED: %t-Fuzz -focus_function='fB(unsigned char const*)' -runs=0 %t/IN 2>&1 | FileCheck %s --check-prefix=FOCUS_fB 2527cf743bSKostya SerebryanyFOCUS_fB: Focus function is set to 'fB(unsigned char const*)' 2627cf743bSKostya Serebryany 27*07055623SGeorge BalatsourasDISABLED: %t-Fuzz -focus_function=f0 -runs=0 %t/IN 2>&1 | FileCheck %s --check-prefix=NO_FOCUSED_INPUT 2827cf743bSKostya SerebryanyNO_FOCUSED_INPUT: Focus function is set to 'f0' 2967af9923SKostya SerebryanyNO_FOCUSED_INPUT: INFO: 0/2 inputs touch the focus function 3067af9923SKostya Serebryany 31*07055623SGeorge BalatsourasDISABLED: (echo -n ABC; cat %t/IN/12) > %t/IN/ABC 32*07055623SGeorge BalatsourasDISABLED: %t-Fuzz -focus_function=f0 -runs=0 %t/IN 2>&1 | FileCheck %s --check-prefix=ONE_FOCUSED_INPUT 3367af9923SKostya SerebryanyONE_FOCUSED_INPUT: INFO: 1/3 inputs touch the focus function 3467af9923SKostya Serebryany 35*07055623SGeorge BalatsourasDISABLED: rm -rf %t/IN_DFT 36*07055623SGeorge BalatsourasDISABLED: %t-Fuzz -collect_data_flow=%t-DFT %t/IN -data_flow_trace=%t/IN_DFT > /dev/null 2>&1 3767af9923SKostya Serebryany 386b87e0c1SKostya Serebryany# Repeat twice to make sure that the inputs with DFT are not removed from the corpus. 39*07055623SGeorge BalatsourasDISABLED: %t-Fuzz -focus_function=f0 -data_flow_trace=%t/IN_DFT -runs=100 %t/IN 2>&1 | FileCheck %s --check-prefix=HAVE_DFT 40*07055623SGeorge BalatsourasDISABLED: %t-Fuzz -focus_function=f0 -data_flow_trace=%t/IN_DFT -runs=100 %t/IN 2>&1 | FileCheck %s --check-prefix=HAVE_DFT 4167af9923SKostya SerebryanyHAVE_DFT: INFO: 1/{{.*}} inputs have the Data Flow Trace 426b87e0c1SKostya Serebryany 436b87e0c1SKostya Serebryany# Collect DFT, then use it. 44*07055623SGeorge BalatsourasDISABLED: rm -rf %t/C %t/C1 && mkdir %t/C %t/C1 && cp %t/IN/* %t/C 45*07055623SGeorge BalatsourasDISABLED: rm -rf %t/C_DFT && %t-Fuzz -collect_data_flow=%t-DFT %t/C -data_flow_trace=%t/C_DFT > /dev/null 2>&1 46*07055623SGeorge BalatsourasDISABLED: not %t-Fuzz -focus_function=f0 -data_flow_trace=%t/C_DFT -seed=1 -runs=1000000 -use_value_profile=1 %t/C1 %t/C 2> %t/log 47*07055623SGeorge BalatsourasDISABLED: grep BINGO %t/log 48e9aaa558SKostya Serebryany 4927cf743bSKostya Serebryany# Test -focus_function=auto: run 100 times and verify that 5027cf743bSKostya Serebryany# * 'f0' is the most frequent focus function. 5127cf743bSKostya Serebryany# * the second most frequent is one of fA/fB/fC in a de-mangled form. 52*07055623SGeorge BalatsourasDISABLED: %t-Fuzz -focus_function=auto -data_flow_trace=%t/C_DFT -runs=0 %t/C -jobs=100 2>&1 | grep AUTOFOCUS | sort | uniq -c | sort -g -r | head -n 2 | FileCheck %s --check-prefix=AUTOFOCUS 53e9aaa558SKostya SerebryanyAUTOFOCUS: INFO: AUTOFOCUS: {{.*}} f0 5427cf743bSKostya SerebryanyAUTOFOCUS: INFO: AUTOFOCUS: {{.*f[ABC]}}(unsigned char const*) 55e9aaa558SKostya Serebryany 56e9aaa558SKostya Serebryany# Actually execute 50 fuzzing processes with a small number of runs, to test -focus_function=auto for real. 57e9aaa558SKostya Serebryany# We can not test data_flow_trace=auto in just a single run, because it may choose to focus on a wrong function. 58*07055623SGeorge BalatsourasDISABLED: not %t-Fuzz -focus_function=auto -data_flow_trace=%t/C_DFT %t/C -jobs=50 -runs=200000 -use_value_profile=1 2> %t/log 59*07055623SGeorge BalatsourasDISABLED: grep BINGO %t/log 60