Skip to content

Commit 4766a86

Browse files
author
Siva Chandra Reddy
committed
[libc] Combine all math differential fuzzers into one target.
Also added diffing of a few more math functions. Combining the diff check for all of these functions helps us meet the OSS fuzz bar of a minimum of 100 program edges. Reviewed By: lntue Differential Revision: https://reviews.llvm.org/D91817
1 parent 6f1c07b commit 4766a86

13 files changed

+328
-240
lines changed

libc/fuzzing/math/CMakeLists.txt

Lines changed: 38 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,65 +1,50 @@
11
add_libc_fuzzer(
2-
ldexp_differential_fuzz
2+
math_differential_fuzz
33
SRCS
4-
ldexp_differential_fuzz.cpp
4+
math_differential_fuzz.cpp
55
HDRS
6-
LdExpDiff.h
6+
Compare.h
7+
RemQuoDiff.h
8+
SingleInputSingleOutputDiff.h
9+
TwoInputSingleOutputDiff.h
710
DEPENDS
11+
libc.src.math.ceil
12+
libc.src.math.ceilf
13+
libc.src.math.ceill
14+
libc.src.math.fdim
15+
libc.src.math.fdimf
16+
libc.src.math.fdiml
17+
libc.src.math.floor
18+
libc.src.math.floorf
19+
libc.src.math.floorl
20+
libc.src.math.frexp
21+
libc.src.math.frexpf
22+
libc.src.math.frexpl
23+
libc.src.math.hypotf
824
libc.src.math.ldexp
9-
libc.utils.FPUtil.fputil
10-
)
11-
12-
add_libc_fuzzer(
13-
ldexpf_differential_fuzz
14-
SRCS
15-
ldexpf_differential_fuzz.cpp
16-
HDRS
17-
LdExpDiff.h
18-
DEPENDS
1925
libc.src.math.ldexpf
20-
libc.utils.FPUtil.fputil
21-
)
22-
23-
add_libc_fuzzer(
24-
ldexpl_differential_fuzz
25-
SRCS
26-
ldexpl_differential_fuzz.cpp
27-
HDRS
28-
LdExpDiff.h
29-
DEPENDS
3026
libc.src.math.ldexpl
31-
libc.utils.FPUtil.fputil
32-
)
33-
34-
add_libc_fuzzer(
35-
remquo_differential_fuzz
36-
SRCS
37-
remquo_differential_fuzz.cpp
38-
HDRS
39-
RemQuoDiff.h
40-
DEPENDS
27+
libc.src.math.logb
28+
libc.src.math.logbf
29+
libc.src.math.logbl
30+
libc.src.math.modf
31+
libc.src.math.modff
32+
libc.src.math.modfl
33+
libc.src.math.sqrt
34+
libc.src.math.sqrtf
35+
libc.src.math.sqrtl
36+
libc.src.math.remainder
37+
libc.src.math.remainderf
38+
libc.src.math.remainderl
4139
libc.src.math.remquo
42-
libc.utils.FPUtil.fputil
43-
)
44-
45-
add_libc_fuzzer(
46-
remquof_differential_fuzz
47-
SRCS
48-
remquof_differential_fuzz.cpp
49-
HDRS
50-
RemQuoDiff.h
51-
DEPENDS
5240
libc.src.math.remquof
53-
libc.utils.FPUtil.fputil
54-
)
55-
56-
add_libc_fuzzer(
57-
remquol_differential_fuzz
58-
SRCS
59-
remquol_differential_fuzz.cpp
60-
HDRS
61-
RemQuoDiff.h
62-
DEPENDS
6341
libc.src.math.remquol
42+
libc.src.math.round
43+
libc.src.math.roundf
44+
libc.src.math.roundl
45+
libc.src.math.trunc
46+
libc.src.math.truncf
47+
libc.src.math.truncl
6448
libc.utils.FPUtil.fputil
49+
libc.utils.CPP.standalone_cpp
6550
)

libc/fuzzing/math/Compare.h

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
//===-- Template functions to compare scalar values -------------*- C++ -*-===//
2+
//
3+
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4+
// See https://llvm.org/LICENSE.txt for license information.
5+
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6+
//
7+
//===----------------------------------------------------------------------===//
8+
9+
#ifndef LLVM_LIBC_FUZZING_MATH_COMPARE_H
10+
#define LLVM_LIBC_FUZZING_MATH_COMPARE_H
11+
12+
#include "utils/CPP/TypeTraits.h"
13+
14+
template <typename T>
15+
__llvm_libc::cpp::EnableIfType<__llvm_libc::cpp::IsFloatingPointType<T>::Value,
16+
bool>
17+
ValuesEqual(T x1, T x2) {
18+
__llvm_libc::fputil::FPBits<T> bits1(x1);
19+
__llvm_libc::fputil::FPBits<T> bits2(x2);
20+
// If either is NaN, we want both to be NaN.
21+
if (bits1.isNaN() || bits2.isNaN())
22+
return bits2.isNaN() && bits2.isNaN();
23+
24+
// For all other values, we want the values to be bitwise equal.
25+
return bits1.bitsAsUInt() == bits2.bitsAsUInt();
26+
}
27+
28+
template <typename T>
29+
__llvm_libc::cpp::EnableIfType<__llvm_libc::cpp::IsIntegral<T>::Value, bool>
30+
ValuesEqual(T x1, T x2) {
31+
return x1 == x1;
32+
}
33+
34+
#endif // LLVM_LIBC_FUZZING_MATH_COMPARE_H

libc/fuzzing/math/LdExpDiff.h

Lines changed: 0 additions & 44 deletions
This file was deleted.

libc/fuzzing/math/RemQuoDiff.h

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,9 @@ void RemQuoDiff(RemQuoFunc<T> func1, RemQuoFunc<T> func2, const uint8_t *data,
3333
__builtin_trap();
3434
return;
3535
}
36-
if (isinf(remainder1)) {
37-
if (isinf(remainder2) != isinf(remainder1))
38-
__builtin_trap();
39-
return;
40-
}
36+
37+
if (isinf(remainder2) != isinf(remainder1))
38+
__builtin_trap();
4139

4240
// Compare only the 3 LS bits of the quotient.
4341
if ((q1 & 0x7) != (q2 & 0x7))
Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
//===-- Template to diff single-input-single-output functions ---*- C++ -*-===//
2+
//
3+
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4+
// See https://llvm.org/LICENSE.txt for license information.
5+
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6+
//
7+
//===----------------------------------------------------------------------===//
8+
9+
#ifndef LLVM_LIBC_FUZZING_MATH_SINGLE_INPUT_SINGLE_OUTPUT_DIFF_H
10+
#define LLVM_LIBC_FUZZING_MATH_SINGLE_INPUT_SINGLE_OUTPUT_DIFF_H
11+
12+
#include "fuzzing/math/Compare.h"
13+
#include "utils/FPUtil/FPBits.h"
14+
15+
#include <math.h>
16+
#include <stddef.h>
17+
#include <stdint.h>
18+
19+
template <typename T> using SingleInputSingleOutputFunc = T (*)(T);
20+
21+
template <typename T>
22+
void SingleInputSingleOutputDiff(SingleInputSingleOutputFunc<T> func1,
23+
SingleInputSingleOutputFunc<T> func2,
24+
const uint8_t *data, size_t size) {
25+
if (size < sizeof(T))
26+
return;
27+
28+
T x = *reinterpret_cast<const T *>(data);
29+
30+
T result1 = func1(x);
31+
T result2 = func2(x);
32+
33+
if (!ValuesEqual(result1, result2))
34+
__builtin_trap();
35+
}
36+
37+
template <typename T1, typename T2>
38+
using SingleInputSingleOutputWithSideEffectFunc = T1 (*)(T1, T2 *);
39+
40+
template <typename T1, typename T2>
41+
void SingleInputSingleOutputWithSideEffectDiff(
42+
SingleInputSingleOutputWithSideEffectFunc<T1, T2> func1,
43+
SingleInputSingleOutputWithSideEffectFunc<T1, T2> func2,
44+
const uint8_t *data, size_t size) {
45+
if (size < sizeof(T1))
46+
return;
47+
48+
T1 x = *reinterpret_cast<const T1 *>(data);
49+
T2 sideEffect1, sideEffect2;
50+
51+
T1 result1 = func1(x, &sideEffect1);
52+
T1 result2 = func2(x, &sideEffect2);
53+
54+
if (!ValuesEqual(result1, result2))
55+
__builtin_trap();
56+
57+
if (!ValuesEqual(sideEffect1, sideEffect2))
58+
__builtin_trap();
59+
}
60+
61+
#endif // LLVM_LIBC_FUZZING_MATH_SINGLE_INPUT_SINGLE_OUTPUT_DIFF_H
Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
//===-- Template to diff two-input-single-output functions ------*- C++ -*-===//
2+
//
3+
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4+
// See https://llvm.org/LICENSE.txt for license information.
5+
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6+
//
7+
//===----------------------------------------------------------------------===//
8+
9+
#ifndef LLVM_LIBC_FUZZING_MATH_TWO_INPUT_SINGLE_OUTPUT_DIFF_H
10+
#define LLVM_LIBC_FUZZING_MATH_TWO_INPUT_SINGLE_OUTPUT_DIFF_H
11+
12+
#include "fuzzing/math/Compare.h"
13+
#include "utils/FPUtil/FPBits.h"
14+
15+
#include <math.h>
16+
#include <stddef.h>
17+
#include <stdint.h>
18+
19+
template <typename T1, typename T2>
20+
using TwoInputSingleOutputFunc = T1 (*)(T1, T2);
21+
22+
template <typename T1, typename T2>
23+
void TwoInputSingleOutputDiff(TwoInputSingleOutputFunc<T1, T2> func1,
24+
TwoInputSingleOutputFunc<T1, T2> func2,
25+
const uint8_t *data, size_t size) {
26+
constexpr size_t t1Size = sizeof(T1);
27+
if (size < t1Size + sizeof(T2))
28+
return;
29+
30+
T1 x = *reinterpret_cast<const T1 *>(data);
31+
T2 y = *reinterpret_cast<const T2 *>(data + t1Size);
32+
33+
T1 result1 = func1(x, y);
34+
T1 result2 = func2(x, y);
35+
36+
if (!ValuesEqual(result1, result2))
37+
__builtin_trap();
38+
}
39+
40+
#endif // LLVM_LIBC_FUZZING_MATH_TWO_INPUT_SINGLE_OUTPUT_DIFF_H

libc/fuzzing/math/ldexp_differential_fuzz.cpp

Lines changed: 0 additions & 23 deletions
This file was deleted.

libc/fuzzing/math/ldexpf_differential_fuzz.cpp

Lines changed: 0 additions & 23 deletions
This file was deleted.

libc/fuzzing/math/ldexpl_differential_fuzz.cpp

Lines changed: 0 additions & 23 deletions
This file was deleted.

0 commit comments

Comments
 (0)