Chromium Code Reviews| Index: testing/libfuzzer/reproducing.md |
| diff --git a/testing/libfuzzer/reproducing.md b/testing/libfuzzer/reproducing.md |
| index beac2bed7e783e51566f91843b8fc38b2def053f..309ba7b6e5f7da57322699d1db4f3bdefccfdad6 100644 |
| --- a/testing/libfuzzer/reproducing.md |
| +++ b/testing/libfuzzer/reproducing.md |
| @@ -43,9 +43,15 @@ additional information/links. |
| `libfuzzer_chrome_ubsan`, indicating which one to use. |
| +*Note*: ClusterFuzz uses release builds by default, so it may be worth adding |
| +`is_debug=false` to your GN args if you are having trouble reproducing a |
| +particular report. For ASan builds both Debug and Release configurations are |
| +supported. Check a job type of the report for presence of `_debug` suffix. |
| + |
| + |
| ### Reproducing AFL + ASan bugs |
| ```bash |
| -$ gn gen out/afl '--args=use_afl=true is_asan=true enable_nacl=false proprietary_codecs=true' |
| +$ gn gen out/afl '--args=use_afl=true is_asan=true enable_nacl=false proprietary_codecs=true ffmpeg_branding="Chrome"' |
|
inferno
2016/08/26 14:45:26
Most devs will be using is_debug=false, so lets ma
mmoroz
2016/08/26 16:35:59
Done.
|
| $ ninja -C out/afl $FUZZER_NAME |
| $ out/afl/$FUZZER_NAME < /path/to/repro |
| ``` |
| @@ -53,7 +59,7 @@ $ out/afl/$FUZZER_NAME < /path/to/repro |
| ### Reproducing LibFuzzer + ASan bugs |
| ```bash |
| -$ gn gen out/libfuzzer '--args=use_libfuzzer=true is_asan=true enable_nacl=false proprietary_codecs=true' |
| +$ gn gen out/libfuzzer '--args=use_libfuzzer=true is_asan=true enable_nacl=false proprietary_codecs=true ffmpeg_branding="Chrome"' |
| $ ninja -C out/libfuzzer $FUZZER_NAME |
| $ out/libfuzzer/$FUZZER_NAME /path/to/repro |
| ``` |
| @@ -63,7 +69,7 @@ $ out/libfuzzer/$FUZZER_NAME /path/to/repro |
| ```bash |
| # The gclient sync is necessary to pull in instrumented libraries. |
| $ GYP_DEFINES='msan=1 use_prebuilt_instrumented_libraries=1' gclient sync |
| -$ gn gen out/libfuzzer '--args=use_libfuzzer=true is_msan=true msan_track_origins=2 use_prebuilt_instrumented_libraries=true enable_nacl=false proprietary_codecs=true' |
| +$ gn gen out/libfuzzer '--args=is_debug=false use_libfuzzer=true is_msan=true msan_track_origins=2 use_prebuilt_instrumented_libraries=true enable_nacl=false proprietary_codecs=true ffmpeg_branding="Chrome"' |
| $ ninja -C out/libfuzzer $FUZZER_NAME |
| $ out/libfuzzer/$FUZZER_NAME /path/to/repro |
| ``` |
| @@ -71,12 +77,9 @@ $ out/libfuzzer/$FUZZER_NAME /path/to/repro |
| ### Reproducing LibFuzzer + UBSan bugs |
| ```bash |
| -$ gn gen out/libfuzzer '--args=use_libfuzzer=true is_ubsan_security=true enable_nacl=false proprietary_codecs=true' |
| +$ gn gen out/libfuzzer '--args=is_debug=false use_libfuzzer=true is_ubsan_security=true enable_nacl=false proprietary_codecs=true ffmpeg_branding="Chrome"' |
| $ ninja -C out/libfuzzer $FUZZER_NAME |
| $ export UBSAN_OPTIONS=halt_on_error=1:print_stacktrace=1 |
| $ out/libfuzzer/$FUZZER_NAME /path/to/repro |
| ``` |
| -*Note*: ClusterFuzz uses release builds by default, so it may be worth adding |
| -"is_debug=false" to your GN args if you are having trouble reproducing a |
| -particular report. |