Skip to content

V
V8
Commit 68bcaf9b authored by ahaas's avatar ahaas Committed by Commit bot
Browse files
Options

Revert of [fuzzer] Format README.md (patchset #2 id:20001 of... 

Revert of [fuzzer] Format README.md (patchset #2 id:20001 of https://codereview.chromium.org/2692443002/ )

Reason for revert:
Found another mistake

Original issue's description:
> [fuzzer] Format README.md
>
> NOTRY=true
> R=hablich@chromium.org
>
> Review-Url: https://codereview.chromium.org/2692443002
> Cr-Commit-Position: refs/heads/master@{#43138}
> Committed: https://chromium.googlesource.com/v8/v8/+/a3de4726c3c1ced8c85a221edb66a55a2ed2a04c

TBR=hablich@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2693863002
Cr-Commit-Position: refs/heads/master@{#43139}
parent a3de4726
Hide whitespace changes
Inline Side-by-side
Showing with 20 additions and 76 deletions
test/fuzzer/README.md
View file @ 68bcaf9b
# How to make a libFuzzer fuzzer in V8 # How to make a libFuzzer fuzzer in V8
This document describes how to make a new libFuzzer fuzzer for V8. A general This document describes how to make a new libfuzzer fuzzer for V8. A general introduction to libfuzzer can be found at [here](https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/README.md). In short, libFuzzer is an in-process coverage-driven evolutionary fuzzer. libFuzzer serves you with a sequence of byte arrays that you can use to test your code. libFuzzer tries to generate this sequence of byte arrays in a way that maximizes test coverage.
introduction to libFuzzer can be found
[here](https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/README.md).
In short, libFuzzer is an in-process coverage-driven evolutionary fuzzer.
libFuzzer serves you with a sequence of byte arrays that you can use to test
your code. libFuzzer tries to generate this sequence of byte arrays in a way
that maximizes test coverage.
**Warning**: By itself libFuzzer typically does not generate valid JavaScript code. **Warning**: By itself libFuzzer typically does not generate valid JavaScript code.
## Changes to V8 ## Changes to V8
**tldr:** Do the same as https://codereview.chromium.org/2280623002 to introduce **tldr:** Do the same as https://codereview.chromium.org/2280623002 to introduce a new fuzzer to V8.
a new fuzzer to V8. This is a step by step guide on how to make a new fuzzer in V8. In the example the fuzzer is called `foo`.
1) Copy one of the existing fuzzer implementations in [test/fuzzer/](https://cs.chromium.org/chromium/src/v8/test/fuzzer/), e.g. `cp wasm.cc foo.cc`
This is a step by step guide on how to make a new fuzzer in V8. In the example * Copying an existing fuzzer is a good idea to get all the required setup, e.g. setting up the isolate
the fuzzer is called `foo`. 2) Create a directory called `foo` in [test/fuzzer/](https://cs.chromium.org/chromium/src/v8/test/fuzzer/) which contains at least one file
* The file is used by the trybots to check whether the fuzzer actually compiles and runs
1. Copy one of the existing fuzzer implementations in 3) Copy the build rules of an existing fuzzer in [BUILD.gn](https://cs.chromium.org/chromium/src/v8/BUILD.gn), e.g. the build rules for the [wasm.cc](https://cs.chromium.org/chromium/src/v8/test/fuzzer/wasm.cc) fuzzer are `v8_source_set("wasm_fuzzer")` and `v8_fuzzer("wasm_fuzzer")`. Note that the name has to be the name of the
[test/fuzzer/](https://cs.chromium.org/chromium/src/v8/test/fuzzer/), e.g. `cp wasm.cc foo.cc` directory created in Step 2 + “_fuzzer” so that the scripts on the trybots work
4) Now you can already compile the fuzzer with `ninja -j 1000 -C out/tmp/v8_simple_foo_fuzzer`
* Copying an existing fuzzer is a good idea to get all the required setup, * Use this binary to reproduce issues found by cluster fuzz, e.g. `out/tmp/v8_simple_foo_fuzzer testcase.foo`
e.g. setting up the isolate 5) Copy the build rules of an existing fuzzer in [test/fuzzer/fuzzer.gyp](https://cs.chromium.org/chromium/src/v8/test/fuzzer/fuzzer.gyp), e.g. the build rules for the [wasm.cc](https://cs.chromium.org/chromium/src/v8/test/fuzzer/wasm.cc) fuzzer are `v8_simple_wasm_fuzzer` and `wasm_fuzzer_lib`
2. Create a directory called `foo` in
[test/fuzzer/](https://cs.chromium.org/chromium/src/v8/test/fuzzer/) which
contains at least one file
* The file is used by the trybots to check whether the fuzzer actually
compiles and runs
3. Copy the build rules of an existing fuzzer in
[BUILD.gn](https://cs.chromium.org/chromium/src/v8/BUILD.gn), e.g. the build
rules for the
[wasm.cc](https://cs.chromium.org/chromium/src/v8/test/fuzzer/wasm.cc) fuzzer
are `v8_source_set("wasm_fuzzer")` and `v8_fuzzer("wasm_fuzzer")`. Note that
the name has to be the name of the directory created in Step 2 + `_fuzzer` so
that the scripts on the trybots work
4. Now you can already compile the fuzzer with `ninja -j 1000 -C out/x64.debug/v8_simple_foo_fuzzer`
* Use this binary to reproduce issues found by cluster fuzz, e.g.
`out/tmp/v8_simple_foo_fuzzer testcase.foo`
5. Copy the build rules of an existing fuzzer in
[test/fuzzer/fuzzer.gyp](https://cs.chromium.org/chromium/src/v8/test/fuzzer/fuzzer.gyp),
e.g. the build rules for the
[wasm.cc](https://cs.chromium.org/chromium/src/v8/test/fuzzer/wasm.cc) fuzzer
are `v8_simple_wasm_fuzzer` and `wasm_fuzzer_lib`
* This build rule is needed to compile with gyp * This build rule is needed to compile with gyp
6) Copy the binary name and the test directory name in [test/fuzzer/fuzzer.isolate](https://cs.chromium.org/chromium/src/v8/test/fuzzer/fuzzer.isolate)
6. Copy the binary name and the test directory name in 7) Add the fuzzer to the FuzzerTestSuite in [test/fuzzer/testcfg.py](https://cs.chromium.org/chromium/src/v8/test/fuzzer/testcfg.py)
[test/fuzzer/fuzzer.isolate](https://cs.chromium.org/chromium/src/v8/test/fuzzer/fuzzer.isolate) * This step is needed to run the fuzzer with the files created in Step 2 on the trybots
8) Commit the changes described above to the V8 repository
7. Add the fuzzer to the FuzzerTestSuite in
[test/fuzzer/testcfg.py](https://cs.chromium.org/chromium/src/v8/test/fuzzer/testcfg.py)
* This step is needed to run the fuzzer with the files created in Step 2 on
the trybots
8. Commit the changes described above to the V8 repository
## Changes to Chromium ## Changes to Chromium
**tldr:** Do the same as https://codereview.chromium.org/2344823002 to add the new fuzzer to cluster fuzz.
**tldr:** Do the same as https://codereview.chromium.org/2344823002 to add the 1) Copy the build rules of an existing fuzzer in [testing/libfuzzer/fuzzers/BUILD.gn](https://cs.chromium.org/chromium/src/testing/libfuzzer/fuzzers/BUILD.gn), e.g. the build rule for the [wasm.cc](https://cs.chromium.org/chromium/src/v8/test/fuzzer/wasm.cc) fuzzer is {v8_wasm_fuzzer}. There is no need to set a dictionary , or a seed_corpus. See [chromium-fuzzing-getting-started](https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/getting_started.md) for more information.
new fuzzer to cluster fuzz. 2) Compile the fuzzer in chromium (for different configurations see: https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md):
1. Copy the build rules of an existing fuzzer in
[testing/libfuzzer/fuzzers/BUILD.gn](https://cs.chromium.org/chromium/src/testing/libfuzzer/fuzzers/BUILD.gn),
e.g. the build rule for the
[wasm.cc](https://cs.chromium.org/chromium/src/v8/test/fuzzer/wasm.cc) fuzzer
is `v8_wasm_fuzzer`. There is no need to set a `dictionary` , or a `seed_corpus`.
See
[chromium-fuzzing-getting-started](https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/getting_started.md)
for more information.
2. Compile the fuzzer in chromium (for different configurations see:
https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md):
* `gn gen out/libfuzzer '--args=use_libfuzzer=true is_asan=true is_debug=false enable_nacl=false'` * `gn gen out/libfuzzer '--args=use_libfuzzer=true is_asan=true is_debug=false enable_nacl=false'`
* `ninja -j 1000 -C out/libfuzzer/ v8_foo_fuzzer` * `ninja -j 1000 -C out/libfuzzer/ v8_foo_fuzzer`
3) Run the fuzzer locally
3. Run the fuzzer locally
* `mkdir /tmp/empty_corpus && out/libfuzzer/v8_foo_fuzzer /tmp/empty_corpus` * `mkdir /tmp/empty_corpus && out/libfuzzer/v8_foo_fuzzer /tmp/empty_corpus`
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment