traxys/tree-sitter
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Build fuzzer in 'halt' and 'recover' modes

Browse source 
Build each language fuzzer in two modes (halt_on_error=true and
halt_on_error=false) and use different timeouts for each fuzzer.

Also merge the run-fuzzer and reproduce scripts so they use identical
values of ASAN_OPTIONS/UBSAN_OPTIONS/etc0
This commit is contained in:
Phil Turnbull 2018-03-02 09:10:52 -08:00
parent d3ac345644
commit bc192d95ca
5 changed files with 63 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

6
test/fuzz/README.md
View file

@ -29,15 +29,15 @@ This will generate a separate fuzzer for each grammar defined in `test/fixtures/
The `run-fuzzer` script handles running an individual fuzzer with a sensible default set of arguments:
```
./script/run-fuzzer <grammar-name> <extra libFuzzer arguments...>
./script/run-fuzzer <grammar-name> (halt|recover) <extra libFuzzer arguments...>
```
which will log information to stdout. Failing testcases and a fuzz corpus will be saved to `fuzz-results/<grammar-name>`. The most important extra `libFuzzer` options are `-jobs` and `-workers` which allow parallel fuzzing. This is can done with, e.g.:
```
./script/run-fuzzer <grammer-name> -jobs=32 -workers=32
./script/run-fuzzer <grammer-name> halt -jobs=32 -workers=32
```
The testcase can be used to reproduce the crash by running:
```
./script/reproduce <grammar-name> <path-to-testcase>
./script/reproduce <grammar-name> (halt|recover) <path-to-testcase>
```

6
test/fuzz/fuzzer.cc
View file

@ -7,17 +7,17 @@ TSLogger logger = {
.log = test_log,
};
extern "C" const TSLanguage *TSLANG();
extern "C" const TSLanguage *TS_LANG();
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
const char *str = reinterpret_cast<const char *>(data);
TSDocument *document = ts_document_new();
ts_document_set_language(document, TSLANG());
ts_document_set_language(document, TS_LANG());
ts_document_set_input_string_with_length(document, str, size);
TSParseOptions options = {};
options.halt_on_error = false;
options.halt_on_error = TS_HALT_ON_ERROR;
ts_document_parse_with_options(document, options);
TSNode root_node = ts_document_root_node(document);