1fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot#!/bin/sh 2fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot# Copyright 2017 Google Inc. 3fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot# 4fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot# Use of this source code is governed by a BSD-style license that can be 5fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot# found in the LICENSE file. 6fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 7fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotif [ -z "$1" ]; then 8fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot cat <<-EOM 9fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot Usage: 10fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot $0 [afl-out-loc] 11fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 12fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot Run something like this: 13fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot $0 ~/afl-out 14fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot where afl-out is the directory containing all the output of the afl-fuzzers. 15fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot You can typically ssh into skia-fuzzer-be-1 and skia-fuzzer-be-2 and run 16fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot tar -czf afl-out.tar.gz /mnt/ssd0/fuzzes/afl-out/*/fuzzer0/queue 17fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot and extract it locally to get the directories needed to assess coverage. 18fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 19fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot EOM 20fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot exit 1 21fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotfi 22fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 23fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotset -x 24fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotset -e 25fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 26fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotcd "$(dirname "$0")/.." 27fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 28fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team RobotEXECUTABLE="fuzz" 29fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 30fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team RobotDIR="$(mktemp -d "${TMPDIR:-/tmp}/skia_coverage_XXXXXXXXXX")" 31fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team RobotBUILD=out/coverage 32fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 33fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot# Build $EXECUTABLE 34fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotbin/sync 35fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotbin/fetch-gn 36fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 37fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotrm -rf $BUILD 38fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 39fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot#TODO: make this work with Clang. 40fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team RobotARGS='cc="gcc" cxx="g++" extra_cflags=["--coverage"] extra_ldflags=["--coverage"]' 41fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotgn gen --args="$ARGS" "$BUILD" 42fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 43fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotninja -C "$BUILD" "$EXECUTABLE" 44fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 45fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team RobotGCOV="$(realpath tools/gcov_shim)" 46fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 47fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot# Generate a zero-baseline so files not covered by $EXECUTABLE $@ will 48fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot# still show up in the report. This reads the .gcno files that are 49fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot# created at compile time. 50fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotlcov -q --gcov-tool="$GCOV" -c -b "$BUILD" -d "$BUILD" -o "$DIR"/baseline -i 51fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 52fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot# Running the binary generates the real coverage information, the .gcda files. 53fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team RobotQUEUES=("$1/api_parse_path/fuzzer0/queue/*" "$1/color_deserialize/fuzzer0/queue/*" "$1/color_icc/fuzzer0/queue/*" "$1/skcodec_scale/fuzzer0/queue/*" "$1/skcodec_mode/fuzzer0/queue/*" "$1/api_draw_functions/fuzzer0/queue/*" "$1/api_gradient/fuzzer0/queue/*" "$1/api_image_filter/fuzzer0/queue/*" "$1/api_pathop/fuzzer0/queue/*" "$1/sksl2glsl/fuzzer0/queue/*" "$1/null_canvas/fuzzer0/queue/*" "$1/pdf_canvas/fuzzer0/queue/*" "$1/n32_canvas/fuzzer0/queue/*") 54fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 55fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team RobotARGS=("-n ParsePath" "-t color_deserialize" "-t icc" "-t image_scale" "-t image_mode" "-n DrawFunctions" "-n Gradients" "-n SerializedImageFilter" "-n Pathop" "-t sksl2glsl" "-n NullCanvas" "-n PDFCanvas" "-n RasterN32Canvas") 56fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 57fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot# We can't simply pass the directories to the fuzzers because some of the fuzzes will 58fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot# crash or assert, which would kill the call to fuzz prematurely. Instead we run them 59fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot# individually using the loops below. 60fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotfor i in `seq ${#QUEUES[@]}` 61fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotdo 62fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot FILES=${QUEUES[i]} 63fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot for f in $FILES 64fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot do 65fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot # Executing the fuzzes sequentially would take a very long time. So, we run them 66fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot # in the background, making sure we don't go crazy and execute them too fast or 67fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot # that they execute for a long time. 68fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot timeout 10 $BUILD/$EXECUTABLE ${ARGS[i]} -b $f & 69fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot sleep .005s 70fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot done 71fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotdone 72fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 73fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotsleep 10s 74fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 75fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotecho "done running the fuzzes -- generating report" 76fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 77fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotlcov -q --gcov-tool="$GCOV" -c -b "$BUILD" -d "$BUILD" -o "$DIR"/coverage 78fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 79fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotlcov -q -a "$DIR"/baseline -a "$DIR"/coverage -o "$DIR"/merged 80fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 81fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotgenhtml -q "$DIR"/merged --legend -o "$DIR"/coverage_report --ignore-errors source 82fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robot 83fe17456d5e528078ce69b5f15cf7adf1fab963fandroid-build-team Robotxdg-open "$DIR"/coverage_report/index.html 84