trailofbits / deepstate

A unit test-like interface for fuzzing and symbolic execution
Apache License 2.0
814 stars 99 forks source link

Turn off decomposition for libFuzzer builds. #112

Open agroce opened 6 years ago

agroce commented 6 years ago

What the title says. libFuzzer does CMP decomp on its own, and our version will weaken the signal to the value profiler.

agroce commented 6 years ago

Actually, looking at the code:

  static DEEPSTATE_INLINE bool Do(A a, B b, C cmp, tag_int) {
    using T = typename ::deepstate::BestType<A, B>::Type;
    if (cmp(a, b)) {
      return true;
    }
    DEEPSTATE_USED(a);  // These make the compiler forget everything it knew
    DEEPSTATE_USED(b);  // about `a` and `b`.
    return ::deepstate::ExpandedCompareIntegral<T>::Compare(a, b, cmp);
  }

maybe we always do a real comparison, too? If so, then we're just being a little inefficient, not removing signal, right?