Google Git
Sign in
llvm / libfuzzer / a9a2333f1566af8b0bba20a20b29d2fb543fb868
commita9a2333f1566af8b0bba20a20b29d2fb543fb868[log] [tgz]
authorMax Moroz <mmoroz@chromium.org>Wed Aug 29 21:53:15 2018 +0000
committerCopybara-Service <copybara-worker@google.com>Thu Mar 25 23:18:03 2021 -0700
tree2939e0b5d6538491a540d4cab89de21cffd9402c
parenta4df1432e4872ef1fe3d76ed51ec0f71ab885651 [diff]
[libFuzzer] Remove mutation stats and weighted mutation selection.

Summary:
This was an experimental feature. After evaluating it with:

1) https://github.com/google/fuzzer-test-suite/tree/master/engine-comparison

2) enabling on real world fuzz targets running at ClusterFuzz and OSS-Fuzz

The following conclusions were made:

1) With fuzz targets that have reached a code coverage plateau, the feature does
   not improve libFuzzer's ability to discover new coverage and may actually
   negatively impact it.

2) With fuzz targets that have not yet reached a code coverage plateau, the
   feature might speed up new units discovery in some cases, but it is quite
   rare and hard to confirm with a high level on confidence.

Revert of https://reviews.llvm.org/D48054 and https://reviews.llvm.org/D49621.

Reviewers: metzman, morehouse

Reviewed By: metzman, morehouse

Subscribers: delcypher, #sanitizers, llvm-commits, kcc

Differential Revision: https://reviews.llvm.org/D51455

llvm-svn: 340976
GitOrigin-RevId: 8c95b48ba273b28e22912191bfc25e8a2144377f
6 files changed
tree: 2939e0b5d6538491a540d4cab89de21cffd9402c
  1. afl/
  2. dataflow/
  3. scripts/
  4. standalone/
  5. tests/
  6. build.sh
  7. FuzzerCommand.h
  8. FuzzerCorpus.h
  9. FuzzerCrossOver.cpp
  10. FuzzerDataFlowTrace.cpp
  11. FuzzerDataFlowTrace.h
  12. FuzzerDefs.h
  13. FuzzerDictionary.h
  14. FuzzerDriver.cpp
  15. FuzzerExtFunctions.def
  16. FuzzerExtFunctions.h
  17. FuzzerExtFunctionsDlsym.cpp
  18. FuzzerExtFunctionsDlsymWin.cpp
  19. FuzzerExtFunctionsWeak.cpp
  20. FuzzerExtFunctionsWeakAlias.cpp
  21. FuzzerExtraCounters.cpp
  22. FuzzerFlags.def
  23. FuzzerInterface.h
  24. FuzzerInternal.h
  25. FuzzerIO.cpp
  26. FuzzerIO.h
  27. FuzzerIOPosix.cpp
  28. FuzzerIOWindows.cpp
  29. FuzzerLoop.cpp
  30. FuzzerMain.cpp
  31. FuzzerMerge.cpp
  32. FuzzerMerge.h
  33. FuzzerMutate.cpp
  34. FuzzerMutate.h
  35. FuzzerOptions.h
  36. FuzzerRandom.h
  37. FuzzerSHA1.cpp
  38. FuzzerSHA1.h
  39. FuzzerShmem.h
  40. FuzzerShmemFuchsia.cpp
  41. FuzzerShmemPosix.cpp
  42. FuzzerShmemWindows.cpp
  43. FuzzerTracePC.cpp
  44. FuzzerTracePC.h
  45. FuzzerUtil.cpp
  46. FuzzerUtil.h
  47. FuzzerUtilDarwin.cpp
  48. FuzzerUtilFuchsia.cpp
  49. FuzzerUtilLinux.cpp
  50. FuzzerUtilPosix.cpp
  51. FuzzerUtilWindows.cpp
  52. FuzzerValueBitMap.h
  53. LICENSE.TXT
  54. README.txt