Skip to content

Commit da7805e

Browse files
chfastIcohedron
authored andcommitted
[libfuzzer][docs] Update and clarify Output section (llvm#125075)
In the documentation page for the libfuzzer update the example snippets of outputs. They are now slightly different than what is documented. Improve the documentation of the output section `L:`. It now shows two numbers. Closes llvm#42571.
1 parent ef1c1c9 commit da7805e

File tree

1 file changed

+32
-22
lines changed

1 file changed

+32
-22
lines changed

llvm/docs/LibFuzzer.rst

Lines changed: 32 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -354,16 +354,18 @@ Output
354354

355355
During operation the fuzzer prints information to ``stderr``, for example::
356356

357-
INFO: Seed: 1523017872
358-
INFO: Loaded 1 modules (16 guards): [0x744e60, 0x744ea0),
359-
INFO: -max_len is not provided, using 64
357+
INFO: Running with entropic power schedule (0xFF, 100).
358+
INFO: Seed: 1434179311
359+
INFO: Loaded 1 modules (8 inline 8-bit counters): 8 [0x5f03d189be90, 0x5f03d189be98),
360+
INFO: Loaded 1 PC tables (8 PCs): 8 [0x5f03d189be98,0x5f03d189bf18),
361+
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
360362
INFO: A corpus is not provided, starting from an empty corpus
361-
#0 READ units: 1
362-
#1 INITED cov: 3 ft: 2 corp: 1/1b exec/s: 0 rss: 24Mb
363-
#3811 NEW cov: 4 ft: 3 corp: 2/2b exec/s: 0 rss: 25Mb L: 1 MS: 5 ChangeBit-ChangeByte-ChangeBit-ShuffleBytes-ChangeByte-
364-
#3827 NEW cov: 5 ft: 4 corp: 3/4b exec/s: 0 rss: 25Mb L: 2 MS: 1 CopyPart-
365-
#3963 NEW cov: 6 ft: 5 corp: 4/6b exec/s: 0 rss: 25Mb L: 2 MS: 2 ShuffleBytes-ChangeBit-
366-
#4167 NEW cov: 7 ft: 6 corp: 5/9b exec/s: 0 rss: 25Mb L: 3 MS: 1 InsertByte-
363+
#2 INITED cov: 2 ft: 2 corp: 1/1b exec/s: 0 rss: 31Mb
364+
#144 NEW cov: 3 ft: 3 corp: 2/2b lim: 4 exec/s: 0 rss: 31Mb L: 1/1 MS: 2 ChangeByte-ChangeByte-
365+
#157 NEW cov: 4 ft: 4 corp: 3/4b lim: 4 exec/s: 0 rss: 31Mb L: 2/2 MS: 3 CrossOver-ChangeBit-CrossOver-
366+
#1345 NEW cov: 5 ft: 5 corp: 4/8b lim: 14 exec/s: 0 rss: 32Mb L: 4/4 MS: 3 InsertByte-ChangeBit-CrossOver-
367+
#1696 NEW cov: 6 ft: 6 corp: 5/10b lim: 17 exec/s: 0 rss: 32Mb L: 2/4 MS: 1 EraseBytes-
368+
#1832 REDUCE cov: 6 ft: 6 corp: 5/9b lim: 17 exec/s: 0 rss: 32Mb L: 3/3 MS: 1 EraseBytes-
367369
...
368370

369371
The early parts of the output include information about the fuzzer options and
@@ -407,7 +409,7 @@ Each output line also reports the following statistics (when non-zero):
407409
``corp:``
408410
Number of entries in the current in-memory test corpus and its size in bytes.
409411
``lim:``
410-
Current limit on the length of new entries in the corpus. Increases over time
412+
Current limit on the length of new entries in the corpus. Increases over time
411413
until the max length (``-max_len``) is reached.
412414
``exec/s:``
413415
Number of fuzzer iterations per second.
@@ -418,7 +420,8 @@ For ``NEW`` and ``REDUCE`` events, the output line also includes information
418420
about the mutation operation that produced the new input:
419421

420422
``L:``
421-
Size of the new input in bytes.
423+
Size of the new/reduced input in bytes and the size of the largest input
424+
in current in-memory test corpus.
422425
``MS: <n> <operations>``
423426
Count and list of the mutation operations used to generate the input.
424427

@@ -453,19 +456,26 @@ A simple function that does something interesting if it receives the input
453456

454457
You should get an error pretty quickly::
455458

456-
INFO: Seed: 1523017872
457-
INFO: Loaded 1 modules (16 guards): [0x744e60, 0x744ea0),
458-
INFO: -max_len is not provided, using 64
459+
INFO: Running with entropic power schedule (0xFF, 100).
460+
INFO: Seed: 1434179311
461+
INFO: Loaded 1 modules (8 inline 8-bit counters): 8 [0x5f03d189be90, 0x5f03d189be98),
462+
INFO: Loaded 1 PC tables (8 PCs): 8 [0x5f03d189be98,0x5f03d189bf18),
463+
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
459464
INFO: A corpus is not provided, starting from an empty corpus
460-
#0 READ units: 1
461-
#1 INITED cov: 3 ft: 2 corp: 1/1b exec/s: 0 rss: 24Mb
462-
#3811 NEW cov: 4 ft: 3 corp: 2/2b exec/s: 0 rss: 25Mb L: 1 MS: 5 ChangeBit-ChangeByte-ChangeBit-ShuffleBytes-ChangeByte-
463-
#3827 NEW cov: 5 ft: 4 corp: 3/4b exec/s: 0 rss: 25Mb L: 2 MS: 1 CopyPart-
464-
#3963 NEW cov: 6 ft: 5 corp: 4/6b exec/s: 0 rss: 25Mb L: 2 MS: 2 ShuffleBytes-ChangeBit-
465-
#4167 NEW cov: 7 ft: 6 corp: 5/9b exec/s: 0 rss: 25Mb L: 3 MS: 1 InsertByte-
466-
==31511== ERROR: libFuzzer: deadly signal
465+
#2 INITED cov: 2 ft: 2 corp: 1/1b exec/s: 0 rss: 31Mb
466+
#144 NEW cov: 3 ft: 3 corp: 2/2b lim: 4 exec/s: 0 rss: 31Mb L: 1/1 MS: 2 ChangeByte-ChangeByte-
467+
#157 NEW cov: 4 ft: 4 corp: 3/4b lim: 4 exec/s: 0 rss: 31Mb L: 2/2 MS: 3 CrossOver-ChangeBit-CrossOver-
468+
#1345 NEW cov: 5 ft: 5 corp: 4/8b lim: 14 exec/s: 0 rss: 32Mb L: 4/4 MS: 3 InsertByte-ChangeBit-CrossOver-
469+
#1696 NEW cov: 6 ft: 6 corp: 5/10b lim: 17 exec/s: 0 rss: 32Mb L: 2/4 MS: 1 EraseBytes-
470+
#1832 REDUCE cov: 6 ft: 6 corp: 5/9b lim: 17 exec/s: 0 rss: 32Mb L: 3/3 MS: 1 EraseBytes-
471+
==840148== ERROR: libFuzzer: deadly signal
467472
...
468-
artifact_prefix='./'; Test unit written to ./crash-b13e8756b13a00cf168300179061fb4b91fefbed
473+
SUMMARY: libFuzzer: deadly signal
474+
MS: 2 CopyPart-ChangeByte-; base unit: dbee5f8c7a5da845446e75b4a5708e74428b520a
475+
0x48,0x49,0x21,
476+
HI!
477+
artifact_prefix='./'; Test unit written to ./crash-7a8dc3985d2a90fb6e62e94910fc11d31949c348
478+
Base64: SEkh
469479

470480

471481
More examples

0 commit comments

Comments
 (0)