Google Git
Sign in
llvm / libfuzzer / 0c0d79ec194e505899b8ebab08ae8056f1228ea8
commit0c0d79ec194e505899b8ebab08ae8056f1228ea8[log] [tgz]
authorArseny Kapoulkine <arseny.kapoulkine@gmail.com>Thu Sep 07 16:51:05 2023 -0700
committerCopybara-Service <copybara-worker@google.com>Thu Sep 07 16:52:35 2023 -0700
treeac72151d611d5c9ef81a73a0c867c5f6ad88440a
parent5d1e681018603f2d646f535fee8ed9dca7ebc965 [diff]
[Fuzzer] Optimize UpdateFeatureFrequency (#65288)

Instead of a linear scan, use a bitset to track rarity of features. This
improves fuzzer throughput rather dramatically (close to 2x) in early
exploratory phases; in steady state this seems to improve fuzzing
throughput by ~15% according to perf.

The benchmarks are done on an executable with ~100k features, so the
results may change based on the executable that's being fuzzed.

kFeatureSetSize is 2M so the bitset is adding 256 KB to
sizeof(InputCorpus), but this should be fine since there's already three
arrays indexed by feature index for a total of 200 MB.

GitOrigin-RevId: bede46f57eec7e9b4665a2b0f1df59a2fb1cc74d
1 file changed
tree: ac72151d611d5c9ef81a73a0c867c5f6ad88440a
  1. afl/
  2. dataflow/
  3. scripts/
  4. standalone/
  5. tests/
  6. build.sh
  7. FuzzedDataProvider.h
  8. FuzzerBuiltins.h
  9. FuzzerBuiltinsMsvc.h
  10. FuzzerCommand.h
  11. FuzzerCorpus.h
  12. FuzzerCrossOver.cpp
  13. FuzzerDataFlowTrace.cpp
  14. FuzzerDataFlowTrace.h
  15. FuzzerDefs.h
  16. FuzzerDictionary.h
  17. FuzzerDriver.cpp
  18. FuzzerExtFunctions.def
  19. FuzzerExtFunctions.h
  20. FuzzerExtFunctionsDlsym.cpp
  21. FuzzerExtFunctionsWeak.cpp
  22. FuzzerExtFunctionsWindows.cpp
  23. FuzzerExtraCounters.cpp
  24. FuzzerExtraCountersDarwin.cpp
  25. FuzzerExtraCountersWindows.cpp
  26. FuzzerFlags.def
  27. FuzzerFork.cpp
  28. FuzzerFork.h
  29. FuzzerInterceptors.cpp
  30. FuzzerInterface.h
  31. FuzzerInternal.h
  32. FuzzerIO.cpp
  33. FuzzerIO.h
  34. FuzzerIOPosix.cpp
  35. FuzzerIOWindows.cpp
  36. FuzzerLoop.cpp
  37. FuzzerMain.cpp
  38. FuzzerMerge.cpp
  39. FuzzerMerge.h
  40. FuzzerMutate.cpp
  41. FuzzerMutate.h
  42. FuzzerOptions.h
  43. FuzzerPlatform.h
  44. FuzzerRandom.h
  45. FuzzerSHA1.cpp
  46. FuzzerSHA1.h
  47. FuzzerTracePC.cpp
  48. FuzzerTracePC.h
  49. FuzzerUtil.cpp
  50. FuzzerUtil.h
  51. FuzzerUtilDarwin.cpp
  52. FuzzerUtilFuchsia.cpp
  53. FuzzerUtilLinux.cpp
  54. FuzzerUtilPosix.cpp
  55. FuzzerUtilWindows.cpp
  56. FuzzerValueBitMap.h
  57. LICENSE.TXT
  58. README.txt