Chromium Code Reviews
|
|
Chromium Code Reviews
Issue
2511373002:
[regexp fuzzer] Let the fuzzer input select the regexp flag. (Closed)
Description[regexp fuzzer] Let the fuzzer input select the regexp flag.
With this CL the regexp-parser-fuzzer uses the first byte of the fuzzer
input to select the regexp flag instead of executing each input with all
possible flags. Thereby the fuzzer can explore more inputs and with its
coverage metric will explore all flags only for interesting inputs.
I updated all files in test/fuzzer/regexp and added a random byte at the beginning. This byte is used by the fuzzer to determine the flag.
BUG=chromium:664436
R=yangguo@chromium.org
Committed: https://crrev.com/2ba24a71b6e86b6272f2eccb37694b2b56a1219c
Cr-Commit-Position: refs/heads/master@{#41176}
Patch Set 1 #Patch Set 2 : use hash instead of the first byte to choose the flag #
Total comments: 2
Patch Set 3 : Reintroduce the GC call. #Messages
Total messages: 31 (21 generated)
The CQ bit was checked by ahaas@chromium.org to run a CQ dry run
Dry run: CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...
Description was changed from ========== [regexp fuzzer] Let the fuzzer input select the regexp flag. With this CL the regexp-parser-fuzzer uses the first byte of the fuzzer input to select the regexp flag instead of executing each input with all possible flags. Thereby the fuzzer can explore more inputs and with its coverage metric will explore all flags only for interesting inputs. BUG=chromium:664436 R=yangguo@chromium.org ========== to ========== [regexp fuzzer] Let the fuzzer input select the regexp flag. With this CL the regexp-parser-fuzzer uses the first byte of the fuzzer input to select the regexp flag instead of executing each input with all possible flags. Thereby the fuzzer can explore more inputs and with its coverage metric will explore all flags only for interesting inputs. I updated all files in test/fuzzer/regexp and added a random byte at the beginning. This byte is used by the fuzzer to determine the flag. BUG=chromium:664436 R=yangguo@chromium.org ==========
LGTM. I did not verify though whether the test seeds cover all bits for the flags.
The CQ bit was unchecked by commit-bot@chromium.org
Dry run: This issue passed the CQ dry run.
The CQ bit was checked by ahaas@chromium.org to run a CQ dry run
Dry run: CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...
ahaas@chromium.org changed reviewers: + mmoroz@chromium.org
On 2016/11/18 at 12:35:50, yangguo wrote: > LGTM. I did not verify though whether the test seeds cover all bits for the flags. According to kcc and mmoroz it is better to use a hash instead of the first byte. I also remove the GC call at the end of the test because it causes a 3X slowdown with the new flag selection.
The CQ bit was unchecked by commit-bot@chromium.org
Dry run: This issue passed the CQ dry run.
Description was changed from ========== [regexp fuzzer] Let the fuzzer input select the regexp flag. With this CL the regexp-parser-fuzzer uses the first byte of the fuzzer input to select the regexp flag instead of executing each input with all possible flags. Thereby the fuzzer can explore more inputs and with its coverage metric will explore all flags only for interesting inputs. I updated all files in test/fuzzer/regexp and added a random byte at the beginning. This byte is used by the fuzzer to determine the flag. BUG=chromium:664436 R=yangguo@chromium.org ========== to ========== [regexp fuzzer] Let the fuzzer input select the regexp flag. With this CL the regexp-parser-fuzzer uses the first byte of the fuzzer input to select the regexp flag instead of executing each input with all possible flags. Thereby the fuzzer can explore more inputs and with its coverage metric will explore all flags only for interesting inputs. I updated all files in test/fuzzer/regexp and added a random byte at the beginning. This byte is used by the fuzzer to determine the flag. BUG=chromium:664436 R=yangguo@chromium.org ==========
mmoroz@chromium.org changed reviewers: + kcc@chromium.org
On 2016/11/22 09:58:22, ahaas wrote: > On 2016/11/18 at 12:35:50, yangguo wrote: > > LGTM. I did not verify though whether the test seeds cover all bits for the > flags. > > According to kcc and mmoroz it is better to use a hash instead of the first > byte. I also remove the GC call at the end of the test because it causes a 3X > slowdown with the new flag selection. Thanks Andreas for implementing this, but we need to invoke GC on every run, otherwise we have a "parasitic coverage" caused by some internal GC state which changes for every input. I think Kostya raised that point in the issue comments: https://bugs.chromium.org/p/chromium/issues/detail?id=664436#c5
LGTM after re-storing the GC call. https://codereview.chromium.org/2511373002/diff/20001/test/fuzzer/regexp.cc File test/fuzzer/regexp.cc (left): https://codereview.chromium.org/2511373002/diff/20001/test/fuzzer/regexp.cc#o... test/fuzzer/regexp.cc:77: isolate->RequestGarbageCollectionForTesting( Could you please return this call?
The CQ bit was checked by ahaas@chromium.org to run a CQ dry run
Dry run: CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...
https://codereview.chromium.org/2511373002/diff/20001/test/fuzzer/regexp.cc File test/fuzzer/regexp.cc (left): https://codereview.chromium.org/2511373002/diff/20001/test/fuzzer/regexp.cc#o... test/fuzzer/regexp.cc:77: isolate->RequestGarbageCollectionForTesting( On 2016/11/22 at 10:46:38, mmoroz wrote: > Could you please return this call? Done.
thanks, LGTM!
The CQ bit was unchecked by commit-bot@chromium.org
Dry run: This issue passed the CQ dry run.
The CQ bit was checked by ahaas@chromium.org
The patchset sent to the CQ was uploaded after l-g-t-m from yangguo@chromium.org Link to the patchset: https://codereview.chromium.org/2511373002/#ps40001 (title: "Reintroduce the GC call.")
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...
CQ is committing da patch.
Bot data: {"patchset_id": 40001, "attempt_start_ts": 1479819409340890,
"parent_rev": "b15c4c19a7ca74cfa121fc44bbea924f1540cf51", "commit_rev":
"20a076594938a4bb76211e15914eeff8e7b55f6e"}
Message was sent while issue was closed.
Description was changed from ========== [regexp fuzzer] Let the fuzzer input select the regexp flag. With this CL the regexp-parser-fuzzer uses the first byte of the fuzzer input to select the regexp flag instead of executing each input with all possible flags. Thereby the fuzzer can explore more inputs and with its coverage metric will explore all flags only for interesting inputs. I updated all files in test/fuzzer/regexp and added a random byte at the beginning. This byte is used by the fuzzer to determine the flag. BUG=chromium:664436 R=yangguo@chromium.org ========== to ========== [regexp fuzzer] Let the fuzzer input select the regexp flag. With this CL the regexp-parser-fuzzer uses the first byte of the fuzzer input to select the regexp flag instead of executing each input with all possible flags. Thereby the fuzzer can explore more inputs and with its coverage metric will explore all flags only for interesting inputs. I updated all files in test/fuzzer/regexp and added a random byte at the beginning. This byte is used by the fuzzer to determine the flag. BUG=chromium:664436 R=yangguo@chromium.org ==========
Message was sent while issue was closed.
Committed patchset #3 (id:40001)
Message was sent while issue was closed.
Description was changed from ========== [regexp fuzzer] Let the fuzzer input select the regexp flag. With this CL the regexp-parser-fuzzer uses the first byte of the fuzzer input to select the regexp flag instead of executing each input with all possible flags. Thereby the fuzzer can explore more inputs and with its coverage metric will explore all flags only for interesting inputs. I updated all files in test/fuzzer/regexp and added a random byte at the beginning. This byte is used by the fuzzer to determine the flag. BUG=chromium:664436 R=yangguo@chromium.org ========== to ========== [regexp fuzzer] Let the fuzzer input select the regexp flag. With this CL the regexp-parser-fuzzer uses the first byte of the fuzzer input to select the regexp flag instead of executing each input with all possible flags. Thereby the fuzzer can explore more inputs and with its coverage metric will explore all flags only for interesting inputs. I updated all files in test/fuzzer/regexp and added a random byte at the beginning. This byte is used by the fuzzer to determine the flag. BUG=chromium:664436 R=yangguo@chromium.org Committed: https://crrev.com/2ba24a71b6e86b6272f2eccb37694b2b56a1219c Cr-Commit-Position: refs/heads/master@{#41176} ==========
Message was sent while issue was closed.
Patchset 3 (id:??) landed as https://crrev.com/2ba24a71b6e86b6272f2eccb37694b2b56a1219c Cr-Commit-Position: refs/heads/master@{#41176} |
