We should create a sil-opt driver for libfuzzer. The way that it would work is that sil-opt would load a module into memory and then use the libfuzzer input as a state machine to determine what passes to run. E.g., consider a world where sil-opt had 4 passes only. In such a case, one would continually read 2 bits from the libfuzzer provided data stream and map the 2 bit values to a pass that is then added to a pass manager. Once we run out of bits to use we would then run the pass manager on an input module.
One thing to be aware of: As far as I can remember no one has done the work today to make it really easy to clone an entire module at a time (or at least I haven't seen it done without serializing/deserializing). So as a first version I think one would read the sil/sib file into memory and then continually reparse it it in memory. Then one would see if the SILCloner is able to be used to copy an entire SILModule into a new SILModule. But to me that would be a different piece of work.
Additional Detail from JIRA
| | | |------------------|-----------------| |Votes | 0 | |Component/s | Compiler | |Labels | New Feature | |Assignee | None | |Priority | Medium | md5: 83f66ba9a3d3c2ca53afd381f03f06adIssue Description:
We should create a sil-opt driver for libfuzzer. The way that it would work is that sil-opt would load a module into memory and then use the libfuzzer input as a state machine to determine what passes to run. E.g., consider a world where sil-opt had 4 passes only. In such a case, one would continually read 2 bits from the libfuzzer provided data stream and map the 2 bit values to a pass that is then added to a pass manager. Once we run out of bits to use we would then run the pass manager on an input module.
One thing to be aware of: As far as I can remember no one has done the work today to make it really easy to clone an entire module at a time (or at least I haven't seen it done without serializing/deserializing). So as a first version I think one would read the sil/sib file into memory and then continually reparse it it in memory. Then one would see if the SILCloner is able to be used to copy an entire SILModule into a new SILModule. But to me that would be a different piece of work.