Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Experimental integration with binaryen #219

Merged
merged 14 commits into from
Dec 29, 2018

Conversation

nth10sd
Copy link
Contributor

@nth10sd nth10sd commented Dec 28, 2018

Here's a first take on the integration with binaryen for experimental deployment.

It uses stdout output from jsfunfuzz, e.g. from w1-out.txt to act as the seed for binaryen. If an issue (e.g. a crash) is found, the wrapper and wasm files are zipped up to be submitted to FuzzManager.

I ran some crashing testcases in another branch to see that this experimentally seems to work.

Caveats:

  • Due to a bug in binaryen, the version is restricted to binaryen v52 for now
  • Note that after a bug involving a wasm testcase is found, pinpoint and hence autobisectjs auto-integration do not understand multiple testcase input, e.g. ./js wrapper.js wasm.file, so all of such reports to FuzzManager will have quality 10 for now.

I would like to get this in quickly to see if:

  • wasm bugs can be reported via the harness
  • see if this tweaks our coverage story.

@jschwartzentruber just asking for a cursory glance here, how does this sound?

@nth10sd nth10sd self-assigned this Dec 28, 2018
@codecov-io
Copy link

codecov-io commented Dec 28, 2018

Codecov Report

Merging #219 into master will increase coverage by 1.93%.
The diff coverage is 55.25%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #219      +/-   ##
==========================================
+ Coverage   44.51%   46.45%   +1.93%     
==========================================
  Files          39       43       +4     
  Lines        2736     2878     +142     
==========================================
+ Hits         1218     1337     +119     
- Misses       1518     1541      +23
Impacted Files Coverage Δ
src/funfuzz/js/js_interesting.py 17.85% <0%> (+0.38%) ⬆️
tests/js/test_with_binaryen.py 100% <100%> (ø)
src/funfuzz/util/file_system_helpers.py 100% <100%> (ø)
tests/util/test_file_system_helpers.py 100% <100%> (ø)
src/funfuzz/js/compare_jit.py 15.84% <14.28%> (+0.46%) ⬆️
src/funfuzz/js/loop.py 15.78% <6.59%> (-0.04%) ⬇️
src/funfuzz/js/with_binaryen.py 82.75% <82.75%> (ø)
... and 1 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 240a346...29244f7. Read the comment docs.

@nth10sd
Copy link
Contributor Author

nth10sd commented Dec 28, 2018

==> forkjoin-10-out.txt <==
/tmp/tmp8lwivi5iloop10/w1-cj-initial-r4 |   0.2s | 0 | fine
/tmp/tmp8lwivi5iloop10/w1-cj-initial-r5 |   0.2s | 0 | fine
/tmp/tmp8lwivi5iloop10/w1-cj-initial-r6 |   0.2s | 0 | fine
/tmp/tmp8lwivi5iloop10/w1-cj-initial-r7 |   0.2s | 0 | fine
/tmp/tmp8lwivi5iloop10/w1-cj-initial-r8 |   0.2s | 0 | fine
/tmp/tmp8lwivi5iloop10/w1-cj-initial-r9 |   0.2s | 0 | fine
/tmp/tmp8lwivi5iloop10/w2 |  17.8s | 0 | fine
/tmp/tmp8lwivi5iloop10/w2-wasm |   0.3s | 0 | fine
/tmp/tmp8lwivi5iloop10/w2-cj-initial-r0 |   0.4s | 0 | fine
/tmp/tmp8lwivi5iloop10/w2-cj-initial-r1 |   0.6s | 0 | fine

==> forkjoin-11-out.txt <==
/tmp/tmpmuxmvk7jloop11/w1-cj-initial-r4 |   0.2s | 0 | fine
/tmp/tmpmuxmvk7jloop11/w1-cj-initial-r5 |   0.2s | 0 | fine
/tmp/tmpmuxmvk7jloop11/w1-cj-initial-r6 |   0.2s | 0 | fine
/tmp/tmpmuxmvk7jloop11/w1-cj-initial-r7 |   0.2s | 0 | fine
/tmp/tmpmuxmvk7jloop11/w1-cj-initial-r8 |   0.6s | 0 | fine
/tmp/tmpmuxmvk7jloop11/w1-cj-initial-r9 |   0.6s | 0 | fine
/tmp/tmpmuxmvk7jloop11/w2 |  13.5s | 0 | fine
/tmp/tmpmuxmvk7jloop11/w2-wasm |   0.3s | 0 | fine
/tmp/tmpmuxmvk7jloop11/w2-cj-initial-r0 |   0.3s | 0 | fine
/tmp/tmpmuxmvk7jloop11/w2-cj-initial-r1 |   3.7s | 0 | fine

Sample running logs.

I'll just land this as it is merely an if statement that activates the integration once tests pass.

@nth10sd nth10sd removed the request for review from jschwartzentruber December 28, 2018 22:53
@nth10sd
Copy link
Contributor Author

nth10sd commented Dec 29, 2018

I'll land this first. The experiment has already proved a success with the discovery of bug 1516720.

@nth10sd nth10sd merged commit 1223f38 into MozillaSecurity:master Dec 29, 2018
@nth10sd nth10sd deleted the binaryen-take-1 branch December 29, 2018 00:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants