[libFuzzer] add a symbolic execution puzzle (difficult for today's libFuzzer).
authorMax Moroz <mmoroz@chromium.org>
Wed, 16 May 2018 18:19:30 +0000 (18:19 +0000)
committerMax Moroz <mmoroz@chromium.org>
Wed, 16 May 2018 18:19:30 +0000 (18:19 +0000)
commitd63396097d57b5d89c3f66b11bd427033a9c5e33
treea540b28ab6ff6985a63ef76f7972252df92fb5fd
parente592104cf05d7f80d0d0ca83f67b36bb029bbb89
[libFuzzer] add a symbolic execution puzzle (difficult for today's libFuzzer).

Summary:
This can be solved just in seconds with KLEE. Current libFuzzer
is able to satistfy 101 constraints out of 410 constraints presented during
the first hour of running with -use_value_profile=1 and -max_len=20.
During the next 3 hours, libFuzzer is able to generate ~50 NEW inputs,
bot none of those solve any new constraint.
During the next 20 hours, it didn't find any NEW inputs.

This test might be interesting for experimenting with the data flow tracing
approach started in https://reviews.llvm.org/D46666.

For the solution with KLEE and other information, see
https://github.com/Dor1s/codegate2017-quals-angrybird

Reviewers: kcc

Reviewed By: kcc

Subscribers: delcypher, llvm-commits, #sanitizers

Differential Revision: https://reviews.llvm.org/D46924

llvm-svn: 332507
compiler-rt/test/fuzzer/MultipleConstraintsOnSmallInputTest.c [new file with mode: 0644]