Lines Matching refs:fuzzer

1 This directory contains three utilities for fuzzing Clang: clang-fuzzer,
2 clang-objc-fuzzer, and clang-proto-fuzzer. All use libFuzzer to generate inputs
6 clang-fuzzer makes no attempt to generate valid C++ programs and is therefore
9 clang-objc-fuzzer is similar but for Objective-C: it makes no attempt to
12 clang-proto-fuzzer uses a protobuf class to describe a subset of the C++
15 clang-proto-fuzzer is better at stressing deeper layers of Clang and LLVM.
20  Building clang-fuzzer
29 Then build the clang-fuzzer target.
36   ninja clang-fuzzer
39  Running clang-fuzzer
41   bin/clang-fuzzer CORPUS_DIR
45  Building clang-objc-fuzzer
54 Then build the clang-objc-fuzzer target.
61   ninja clang-objc-fuzzer
64  Running clang-objc-fuzzer
66   bin/clang-objc-fuzzer CORPUS_DIR
70 …bin/clang-objc-fuzzer <path to corpus_examples/objc> <path to new directory to store  corpus findi…
74  Building clang-proto-fuzzer (Linux-only instructions)
91 Then build the clang-proto-fuzzer and clang-proto-to-cxx targets.  Optionally,
92 you may also build clang-fuzzer with this setup.
100   ninja clang-proto-fuzzer clang-proto-to-cxx
106  Running clang-proto-fuzzer
108   bin/clang-proto-fuzzer CORPUS_DIR
113   bin/clang-proto-fuzzer CORPUS_DIR -ignore_remaining_args=1 -O3 -triple \
116 To translate a clang-proto-fuzzer corpus output to C++:
120  llvm-proto-fuzzer
122 Like, clang-proto-fuzzer, llvm-proto-fuzzer is also a protobuf-mutator based
123 fuzzer. It receives as input a cxx_loop_proto which it then converts into a
127 can easily be added to the fuzzer. Once there are two versions of the input
128 function (optimized and not), llvm-proto-fuzzer uses LLVM's JIT Engine to
131 llvm-proto-fuzzer can find not only compiler crashes, but also miscompiles
134 llvm-proto-fuzzer is built very similarly to clang-proto-fuzzer. You can run the
135 fuzzer with the following command:
136   bin/clang-llvm-proto-fuzzer CORPUS_DIR
143 Note: To get a higher number of executions per second with llvm-proto-fuzzer it
145 the fuzzer is not only compiling code, but also running it, as the inputs get
151   ninja clang-llvm-proto-fuzzer clang-loop-proto-to-llvm