138 lines
5.5 KiB
Bash
138 lines
5.5 KiB
Bash
#!/bin/bash -eux
|
|
#
|
|
# Copyright 2017 Google Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
#
|
|
################################################################################
|
|
|
|
readonly FUZZERS=( \
|
|
clang-fuzzer \
|
|
clang-format-fuzzer \
|
|
clang-objc-fuzzer \
|
|
clangd-fuzzer \
|
|
llvm-itanium-demangle-fuzzer \
|
|
llvm-microsoft-demangle-fuzzer \
|
|
llvm-dwarfdump-fuzzer \
|
|
llvm-isel-fuzzer \
|
|
llvm-special-case-list-fuzzer \
|
|
llvm-opt-fuzzer \
|
|
)
|
|
case $SANITIZER in
|
|
address) LLVM_SANITIZER="Address" ;;
|
|
undefined) LLVM_SANITIZER="Undefined" ;;
|
|
memory) LLVM_SANITIZER="MemoryWithOrigins" ;;
|
|
*) LLVM_SANITIZER="" ;;
|
|
esac
|
|
case "${LIB_FUZZING_ENGINE}" in
|
|
-fsanitize=fuzzer) CMAKE_FUZZING_CONFIG="-DLLVM_USE_SANITIZE_COVERAGE=ON" ;;
|
|
*) CMAKE_FUZZING_CONFIG="-DLLVM_LIB_FUZZING_ENGINE=${LIB_FUZZING_ENGINE}" ;;
|
|
esac
|
|
|
|
LLVM=llvm-project/llvm
|
|
|
|
mkdir build
|
|
cd build
|
|
|
|
cmake -GNinja -DCMAKE_BUILD_TYPE=Release ../$LLVM \
|
|
-DLLVM_ENABLE_PROJECTS="clang;libcxx;libcxxabi;compiler-rt;lld;clang-tools-extra" \
|
|
-DLLVM_ENABLE_ASSERTIONS=ON \
|
|
-DCMAKE_C_COMPILER="${CC}" \
|
|
-DCMAKE_CXX_COMPILER="${CXX}" \
|
|
-DCMAKE_C_FLAGS="${CFLAGS}" \
|
|
-DCMAKE_CXX_FLAGS="${CXXFLAGS}" \
|
|
"${CMAKE_FUZZING_CONFIG}" \
|
|
-DLLVM_NO_DEAD_STRIP=ON \
|
|
-DLLVM_USE_SANITIZER="${LLVM_SANITIZER}" \
|
|
-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly
|
|
for fuzzer in "${FUZZERS[@]}"; do
|
|
ninja $fuzzer
|
|
cp bin/$fuzzer $OUT
|
|
done
|
|
ninja llvm-as
|
|
|
|
# isel-fuzzer encodes its default flags in the name.
|
|
cp $OUT/llvm-isel-fuzzer $OUT/llvm-isel-fuzzer--aarch64-O2
|
|
cp $OUT/llvm-isel-fuzzer $OUT/llvm-isel-fuzzer--x86_64-O2
|
|
cp $OUT/llvm-isel-fuzzer $OUT/llvm-isel-fuzzer--wasm32-O2
|
|
mv $OUT/llvm-isel-fuzzer $OUT/llvm-isel-fuzzer--aarch64-gisel
|
|
|
|
# Same for llvm-opt-fuzzer
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-earlycse
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-simplifycfg
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-gvn
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-sccp
|
|
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-loop_predication
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-guard_widening
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-loop_vectorize
|
|
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-loop_rotate
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-loop_unswitch
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-loop_unroll
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-licm
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-indvars
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-strength_reduce
|
|
|
|
cp $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-irce
|
|
|
|
mv $OUT/llvm-opt-fuzzer $OUT/llvm-opt-fuzzer--x86_64-instcombine
|
|
|
|
# Build corpus for the llvm-opt-fuzzer
|
|
function build_corpus {
|
|
local lit_path="${1}"
|
|
local fuzzer_name="${2}"
|
|
|
|
[[ -e "${WORK}/corpus-tmp" ]] && rm -r "${WORK}/corpus-tmp"
|
|
mkdir "${WORK}/corpus-tmp"
|
|
|
|
cd "${SRC}"
|
|
|
|
# Compile all lit tests into bitcode. Ignore possible llvm-as failures.
|
|
find "${lit_path}" -name "*.ll" -print0 |
|
|
xargs -t -i -0 -n1 sh -c "build/bin/llvm-as "{}" || true"
|
|
|
|
# Move freshly created bitcode into temp directory.
|
|
find "${lit_path}" -name "*.bc" -print0 |
|
|
xargs -t -i -0 -n1 mv "{}" "${WORK}/corpus-tmp"
|
|
|
|
# Archive the corpus.
|
|
zip -j "${OUT}/${fuzzer_name}_seed_corpus.zip" "${WORK}"/corpus-tmp/*
|
|
|
|
rm -r "${WORK}/corpus-tmp"
|
|
|
|
echo -e "[libfuzzer]\nmax_len = 0" > "${OUT}"/"${fuzzer_name}".options
|
|
}
|
|
|
|
build_corpus "$LLVM/test/Transforms/InstCombine/" "llvm-opt-fuzzer--x86_64-instcombine"
|
|
build_corpus "$LLVM/test/Transforms/EarlyCSE/" "llvm-opt-fuzzer--x86_64-earlycse"
|
|
build_corpus "$LLVM/test/Transforms/SimplifyCFG/" "llvm-opt-fuzzer--x86_64-simplifycfg"
|
|
build_corpus "$LLVM/test/Transforms/GVN/" "llvm-opt-fuzzer--x86_64-gvn"
|
|
build_corpus "$LLVM/test/Transforms/SCCP/" "llvm-opt-fuzzer--x86_64-sccp"
|
|
|
|
build_corpus "$LLVM/test/Transforms/LoopPredication/" "llvm-opt-fuzzer--x86_64-loop_predication"
|
|
build_corpus "$LLVM/test/Transforms/GuardWidening/" "llvm-opt-fuzzer--x86_64-guard_widening"
|
|
build_corpus "$LLVM/test/Transforms/LoopVectorize/" "llvm-opt-fuzzer--x86_64-loop_vectorize"
|
|
|
|
build_corpus "$LLVM/test/Transforms/LoopRotate/" "llvm-opt-fuzzer--x86_64-llvm-opt-fuzzer--x86_64-loop_rotate"
|
|
build_corpus "$LLVM/test/Transforms/LoopUnswitch/" "llvm-opt-fuzzer--x86_64-llvm-opt-fuzzer--x86_64-loop_unswitch"
|
|
build_corpus "$LLVM/test/Transforms/LoopUnroll/" "llvm-opt-fuzzer--x86_64-llvm-opt-fuzzer--x86_64-loop_unroll"
|
|
build_corpus "$LLVM/test/Transforms/LICM/" "llvm-opt-fuzzer--x86_64-llvm-opt-fuzzer--x86_64-licm"
|
|
build_corpus "$LLVM/test/Transforms/IndVarSimplify/" "llvm-opt-fuzzer--x86_64-llvm-opt-fuzzer--x86_64-indvars"
|
|
build_corpus "$LLVM/test/Transforms/LoopStrengthReduce/" "llvm-opt-fuzzer--x86_64-llvm-opt-fuzzer--x86_64-strength_reduce"
|
|
|
|
build_corpus "$LLVM/test/Transforms/IRCE/" "llvm-opt-fuzzer--x86_64-llvm-opt-fuzzer--x86_64-irce"
|
|
|
|
zip -j "${OUT}/clang-objc-fuzzer_seed_corpus.zip" $SRC/$LLVM/../clang/tools/clang-fuzzer/corpus_examples/objc/*
|
|
zip -j "${OUT}/clangd-fuzzer_seed_corpus.zip" $SRC/$LLVM/../clang-tools-extra/clangd/test/*
|