| Index: testing/libfuzzer/reproducing.md
|
| diff --git a/testing/libfuzzer/reproducing.md b/testing/libfuzzer/reproducing.md
|
| index beac2bed7e783e51566f91843b8fc38b2def053f..8072cec5363871ab4a8c97d4a596d7280b6bd42c 100644
|
| --- a/testing/libfuzzer/reproducing.md
|
| +++ b/testing/libfuzzer/reproducing.md
|
| @@ -43,9 +43,18 @@ additional information/links.
|
| `libfuzzer_chrome_ubsan`, indicating which one to use.
|
|
|
|
|
| +*Notes*:
|
| +
|
| +* `is_debug`: ClusterFuzz uses release builds by default (`is_debug=false`).
|
| +For ASan builds, both Debug and Release configurations are supported.
|
| +Check a job type of the report for presence of `_debug` suffix.
|
| +
|
| +* `ffmpeg_branding`: For Linux `ffmpeg_branding` should be set to `ChromeOS`.
|
| +For other platforms, use `ffmpeg_branding=Chrome`.
|
| +
|
| ### Reproducing AFL + ASan bugs
|
| ```bash
|
| -$ gn gen out/afl '--args=use_afl=true is_asan=true enable_nacl=false proprietary_codecs=true'
|
| +$ gn gen out/afl '--args=is_debug=false use_afl=true is_asan=true enable_nacl=false proprietary_codecs=true ffmpeg_branding="ChromeOS"'
|
| $ ninja -C out/afl $FUZZER_NAME
|
| $ out/afl/$FUZZER_NAME < /path/to/repro
|
| ```
|
| @@ -53,7 +62,7 @@ $ out/afl/$FUZZER_NAME < /path/to/repro
|
| ### Reproducing LibFuzzer + ASan bugs
|
|
|
| ```bash
|
| -$ gn gen out/libfuzzer '--args=use_libfuzzer=true is_asan=true enable_nacl=false proprietary_codecs=true'
|
| +$ gn gen out/libfuzzer '--args=is_debug=false use_libfuzzer=true is_asan=true enable_nacl=false proprietary_codecs=true ffmpeg_branding="ChromeOS"'
|
| $ ninja -C out/libfuzzer $FUZZER_NAME
|
| $ out/libfuzzer/$FUZZER_NAME /path/to/repro
|
| ```
|
| @@ -63,7 +72,7 @@ $ out/libfuzzer/$FUZZER_NAME /path/to/repro
|
| ```bash
|
| # The gclient sync is necessary to pull in instrumented libraries.
|
| $ GYP_DEFINES='msan=1 use_prebuilt_instrumented_libraries=1' gclient sync
|
| -$ gn gen out/libfuzzer '--args=use_libfuzzer=true is_msan=true msan_track_origins=2 use_prebuilt_instrumented_libraries=true enable_nacl=false proprietary_codecs=true'
|
| +$ gn gen out/libfuzzer '--args=is_debug=false use_libfuzzer=true is_msan=true msan_track_origins=2 use_prebuilt_instrumented_libraries=true enable_nacl=false proprietary_codecs=true ffmpeg_branding="ChromeOS"'
|
| $ ninja -C out/libfuzzer $FUZZER_NAME
|
| $ out/libfuzzer/$FUZZER_NAME /path/to/repro
|
| ```
|
| @@ -71,12 +80,9 @@ $ out/libfuzzer/$FUZZER_NAME /path/to/repro
|
| ### Reproducing LibFuzzer + UBSan bugs
|
|
|
| ```bash
|
| -$ gn gen out/libfuzzer '--args=use_libfuzzer=true is_ubsan_security=true enable_nacl=false proprietary_codecs=true'
|
| +$ gn gen out/libfuzzer '--args=is_debug=false use_libfuzzer=true is_ubsan_security=true enable_nacl=false proprietary_codecs=true ffmpeg_branding="ChromeOS"'
|
| $ ninja -C out/libfuzzer $FUZZER_NAME
|
| $ export UBSAN_OPTIONS=halt_on_error=1:print_stacktrace=1
|
| $ out/libfuzzer/$FUZZER_NAME /path/to/repro
|
| ```
|
|
|
| -*Note*: ClusterFuzz uses release builds by default, so it may be worth adding
|
| -"is_debug=false" to your GN args if you are having trouble reproducing a
|
| -particular report.
|
|
|