|
| 1 | +// Copyright 2020 Google LLC |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// https://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +import Foundation |
| 16 | + |
| 17 | +public class RuntimeHybridEngine: FuzzEngine { |
| 18 | + // The number of mutations to perform to a single sample per round |
| 19 | + private let numConsecutiveMutations: Int |
| 20 | + |
| 21 | + // The different outcomes of one fuzzing iterations. |
| 22 | + private enum CodeGenerationOutcome: String, CaseIterable { |
| 23 | + case success = "Success" |
| 24 | + case generatedCodeFailed = "Generated code failed" |
| 25 | + case generatedCodeTimedOut = "Generated code timed out" |
| 26 | + case generatedCodeCrashed = "Generated code crashed" |
| 27 | + } |
| 28 | + private var outcomeCounts = [CodeGenerationOutcome: Int]() |
| 29 | + |
| 30 | + // Additional statistics about the generated programs. |
| 31 | + private var totalInstructionsGenerated = 0 |
| 32 | + private var programsGenerated = 0 |
| 33 | + private var percentageOfGuardedOperationsAfterCodeGeneration = MovingAverage(n: 1000) |
| 34 | + private var percentageOfGuardedOperationsAfterCodeRefining = MovingAverage(n: 1000) |
| 35 | + |
| 36 | + // We use the FixupMutator to "fix" the generated programs based on runtime information (e.g. remove unneeded try-catch). |
| 37 | + private var fixupMutator = FixupMutator(name: "HybridEngineFixupMutator") |
| 38 | + |
| 39 | + public init(numConsecutiveMutations: Int) { |
| 40 | + self.numConsecutiveMutations = numConsecutiveMutations |
| 41 | + super.init(name: "HybridEngine") |
| 42 | + |
| 43 | + for outcome in CodeGenerationOutcome.allCases { |
| 44 | + outcomeCounts[outcome] = 0 |
| 45 | + } |
| 46 | + } |
| 47 | + |
| 48 | + override func initialize() { |
| 49 | + if fuzzer.config.logLevel.isAtLeast(.verbose) { |
| 50 | + fuzzer.timers.scheduleTask(every: 30 * Minutes) { |
| 51 | + guard self.programsGenerated > 0 else { return } |
| 52 | + |
| 53 | + // TODO move into Statistics? |
| 54 | + self.logger.verbose("Program Template Statistics:") |
| 55 | + let nameMaxLength = self.fuzzer.programTemplates.map({ $0.name.count }).max()! |
| 56 | + for template in self.fuzzer.programTemplates { |
| 57 | + let name = template.name.rightPadded(toLength: nameMaxLength) |
| 58 | + let correctnessRate = Statistics.percentageOrNa(template.correctnessRate, 7) |
| 59 | + let interestingSamplesRate = Statistics.percentageOrNa(template.interestingSamplesRate, 7) |
| 60 | + let timeoutRate = Statistics.percentageOrNa(template.timeoutRate, 6) |
| 61 | + let avgInstructionsAdded = String(format: "%.2f", template.avgNumberOfInstructionsGenerated).leftPadded(toLength: 5) |
| 62 | + let samplesGenerated = template.totalSamples |
| 63 | + self.logger.verbose(" \(name) : Correctness rate: \(correctnessRate), Interesting sample rate: \(interestingSamplesRate), Timeout rate: \(timeoutRate), Avg. # of instructions generated: \(avgInstructionsAdded), Total # of generated samples: \(samplesGenerated)") |
| 64 | + } |
| 65 | + |
| 66 | + let totalOutcomes = self.outcomeCounts.values.reduce(0, +) |
| 67 | + self.logger.verbose("Frequencies of code generation outcomes:") |
| 68 | + for outcome in CodeGenerationOutcome.allCases { |
| 69 | + let count = self.outcomeCounts[outcome]! |
| 70 | + let frequency = (Double(count) / Double(totalOutcomes)) * 100.0 |
| 71 | + self.logger.verbose(" \(outcome.rawValue.rightPadded(toLength: 25)): \(String(format: "%.2f%%", frequency))") |
| 72 | + } |
| 73 | + |
| 74 | + self.logger.verbose("Number of generated programs: \(self.programsGenerated)") |
| 75 | + self.logger.verbose("Average programs size: \(self.totalInstructionsGenerated / self.programsGenerated)") |
| 76 | + self.logger.verbose("Average percentage of guarded operations after code generation: \(String(format: "%.2f%", self.percentageOfGuardedOperationsAfterCodeGeneration.currentValue))%") |
| 77 | + self.logger.verbose("Average percentage of guarded operations after code refining: \(String(format: "%.2f%", self.percentageOfGuardedOperationsAfterCodeRefining.currentValue))%") |
| 78 | + } |
| 79 | + } |
| 80 | + } |
| 81 | + |
| 82 | + private func generateTemplateProgram(template: ProgramTemplate) -> Program { |
| 83 | + let b = fuzzer.makeBuilder() |
| 84 | + b.traceHeader("Generating program based on \(template.name) template") |
| 85 | + template.generate(in: b) |
| 86 | + let program = b.finalize() |
| 87 | + |
| 88 | + program.contributors.insert(template) |
| 89 | + template.addedInstructions(program.size) |
| 90 | + return program |
| 91 | + } |
| 92 | + |
| 93 | + public override func fuzzOne(_ group: DispatchGroup) { |
| 94 | + let template = fuzzer.programTemplates.randomElement() |
| 95 | + |
| 96 | + let generatedProgram = generateTemplateProgram(template: template) |
| 97 | + |
| 98 | + // Update basic codegen statistics. |
| 99 | + totalInstructionsGenerated += generatedProgram.size |
| 100 | + programsGenerated += 1 |
| 101 | + percentageOfGuardedOperationsAfterCodeGeneration.add(computePercentageOfGuardedOperations(in: generatedProgram)) |
| 102 | + |
| 103 | + // We use a higher timeout for the initial execution as pure code generation should only rarely lead to infinite loops/recursion. |
| 104 | + // On the other hand, the generated program may contain slow operations (e.g. try-catch guards) that the subsequent fixup may remove. |
| 105 | + let outcome = execute(generatedProgram, withTimeout: fuzzer.config.timeout * 2) |
| 106 | + switch outcome { |
| 107 | + case .succeeded: |
| 108 | + recordOutcome(.success) |
| 109 | + case .failed: |
| 110 | + return recordOutcome(.generatedCodeFailed) |
| 111 | + case .timedOut: |
| 112 | + return recordOutcome(.generatedCodeTimedOut) |
| 113 | + case .crashed: |
| 114 | + return recordOutcome(.generatedCodeCrashed) |
| 115 | + } |
| 116 | + |
| 117 | + // Now perform one round of fixup to improve the generated program based on runtime information and in particular remove all try-catch guards that are not needed. |
| 118 | + // For example, at runtime we'll know the exact type of variables, including object methods and properties, which we do not necessarily know statically during code generation. |
| 119 | + // As such, it is much easier to select a "good" method/property to access at runtime than it is during static code generation. Further, it is trivial to determine which |
| 120 | + // operations raise an exception at runtime, but hard to determine that statically at code generation time. So we can be overly conservative and wrap many operations in |
| 121 | + // try-catch (i.e. "guard" them), then remove the unnecessary guards after code generation based on runtime information. This is what fixup achieves. |
| 122 | + let refinedProgram: Program |
| 123 | + if let result = fixupMutator.mutate(generatedProgram, for: fuzzer) { |
| 124 | + refinedProgram = result |
| 125 | + percentageOfGuardedOperationsAfterCodeRefining.add(computePercentageOfGuardedOperations(in: refinedProgram)) |
| 126 | + } else { |
| 127 | + // Fixup is expected to fail sometimes, for example if there is nothing to fix. |
| 128 | + refinedProgram = generatedProgram |
| 129 | + } |
| 130 | + |
| 131 | + // Now mutate the program a number of times. |
| 132 | + // We do this for example because pure code generation will often not generate "weird" code (e.g. weird inputs to operations, infinite loops, very large arrays, odd-looking object/class literals, etc.), but mutators are pretty good at that. |
| 133 | + // Further, some mutators have access to runtime information (e.g. Probe and Explore mutator) which the static code generation lacks. |
| 134 | + var parent = refinedProgram |
| 135 | + for _ in 0..<numConsecutiveMutations { |
| 136 | + // TODO: factor out code shared with the MutationEngine? |
| 137 | + var mutator = fuzzer.runtimeWeightedMutators.weightedElement() |
| 138 | + let maxAttempts = 10 |
| 139 | + var mutatedProgram: Program? = nil |
| 140 | + for _ in 0..<maxAttempts { |
| 141 | + if let result = mutator.mutate(parent, for: fuzzer) { |
| 142 | + // Success! |
| 143 | + result.contributors.formUnion(parent.contributors) |
| 144 | + mutator.addedInstructions(result.size - parent.size) |
| 145 | + mutatedProgram = result |
| 146 | + break |
| 147 | + } else { |
| 148 | + // Try a different mutator. |
| 149 | + mutator.failedToGenerate() |
| 150 | + fuzzer.runtimeWeightedMutators.popLastElement() |
| 151 | + mutator = fuzzer.runtimeWeightedMutators.weightedElement() |
| 152 | + } |
| 153 | + } |
| 154 | + |
| 155 | + guard let program = mutatedProgram else { |
| 156 | + logger.warning("Could not mutate sample, giving up. Sample:\n\(FuzzILLifter().lift(parent))") |
| 157 | + continue |
| 158 | + } |
| 159 | + |
| 160 | + assert(program !== parent) |
| 161 | + let outcome = execute(program) |
| 162 | + |
| 163 | + // Mutate the program further if it succeeded. |
| 164 | + if .succeeded == outcome { |
| 165 | + parent = program |
| 166 | + } |
| 167 | + } |
| 168 | + } |
| 169 | + |
| 170 | + private func recordOutcome(_ outcome: CodeGenerationOutcome) { |
| 171 | + outcomeCounts[outcome]! += 1 |
| 172 | + } |
| 173 | + |
| 174 | + private func computePercentageOfGuardedOperations(in program: Program) -> Double { |
| 175 | + let numGuardedOperations = Double(program.code.filter({ $0.isGuarded }).count) |
| 176 | + // We also count try-catch blocks as guards for the purpose of these statistics, and we count them as 3 instructions |
| 177 | + // as they at least need the BeginTry and EndTryCatchFinally, plus either a BeginCatch or BeginFinally. |
| 178 | + let numTryCatchBlocks = Double(program.code.filter({ $0.op is BeginTry }).count) |
| 179 | + return ((numGuardedOperations + numTryCatchBlocks * 3) / Double(program.size)) * 100.0 |
| 180 | + } |
| 181 | +} |
0 commit comments