simdjson 0.3.0 → 0.4.0

data/vendor/simdjson/dependencies/json/test/thirdparty/Fuzzer/FuzzerInternal.h

@@ -1,182 +0,0 @@
-//===- FuzzerInternal.h - Internal header for the Fuzzer --------*- C++ -* ===//
-//
-//                     The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-// Define the main class fuzzer::Fuzzer and most functions.
-//===----------------------------------------------------------------------===//
-
-#ifndef LLVM_FUZZER_INTERNAL_H
-#define LLVM_FUZZER_INTERNAL_H
-
-#include "FuzzerDefs.h"
-#include "FuzzerExtFunctions.h"
-#include "FuzzerInterface.h"
-#include "FuzzerOptions.h"
-#include "FuzzerSHA1.h"
-#include "FuzzerValueBitMap.h"
-#include <algorithm>
-#include <atomic>
-#include <chrono>
-#include <climits>
-#include <cstdlib>
-#include <string.h>
-
-namespace fuzzer {
-
-using namespace std::chrono;
-
-class Fuzzer {
-public:
-
-  // Aggregates all available coverage measurements.
-  struct Coverage {
-    Coverage() { Reset(); }
-
-    void Reset() {
-      BlockCoverage = 0;
-      CallerCalleeCoverage = 0;
-      CounterBitmapBits = 0;
-      CounterBitmap.clear();
-      VPMap.Reset();
-    }
-
-    size_t BlockCoverage;
-    size_t CallerCalleeCoverage;
-    // Precalculated number of bits in CounterBitmap.
-    size_t CounterBitmapBits;
-    std::vector<uint8_t> CounterBitmap;
-    ValueBitMap VPMap;
-  };
-
-  Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD,
-         FuzzingOptions Options);
-  ~Fuzzer();
-  void Loop();
-  void MinimizeCrashLoop(const Unit &U);
-  void ShuffleAndMinimize(UnitVector *V);
-  void InitializeTraceState();
-  void RereadOutputCorpus(size_t MaxSize);
-
-  size_t secondsSinceProcessStartUp() {
-    return duration_cast<seconds>(system_clock::now() - ProcessStartTime)
-        .count();
-  }
-
-  bool TimedOut() {
-    return Options.MaxTotalTimeSec > 0 &&
-           secondsSinceProcessStartUp() >
-               static_cast<size_t>(Options.MaxTotalTimeSec);
-  }
-
-  size_t execPerSec() {
-    size_t Seconds = secondsSinceProcessStartUp();
-    return Seconds ? TotalNumberOfRuns / Seconds : 0;
-  }
-
-  size_t getTotalNumberOfRuns() { return TotalNumberOfRuns; }
-
-  static void StaticAlarmCallback();
-  static void StaticCrashSignalCallback();
-  static void StaticInterruptCallback();
-
-  void ExecuteCallback(const uint8_t *Data, size_t Size);
-  size_t RunOne(const uint8_t *Data, size_t Size);
-
-  // Merge Corpora[1:] into Corpora[0].
-  void Merge(const std::vector<std::string> &Corpora);
-  void CrashResistantMerge(const std::vector<std::string> &Args,
-                           const std::vector<std::string> &Corpora);
-  void CrashResistantMergeInternalStep(const std::string &ControlFilePath);
-  // Returns a subset of 'Extra' that adds coverage to 'Initial'.
-  UnitVector FindExtraUnits(const UnitVector &Initial, const UnitVector &Extra);
-  MutationDispatcher &GetMD() { return MD; }
-  void PrintFinalStats();
-  void SetMaxInputLen(size_t MaxInputLen);
-  void SetMaxMutationLen(size_t MaxMutationLen);
-  void RssLimitCallback();
-
-  // Public for tests.
-  void ResetCoverage();
-
-  bool InFuzzingThread() const { return IsMyThread; }
-  size_t GetCurrentUnitInFuzzingThead(const uint8_t **Data) const;
-  void TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
-                               bool DuringInitialCorpusExecution);
-
-  void HandleMalloc(size_t Size);
-
-private:
-  void AlarmCallback();
-  void CrashCallback();
-  void InterruptCallback();
-  void MutateAndTestOne();
-  void ReportNewCoverage(InputInfo *II, const Unit &U);
-  size_t RunOne(const Unit &U) { return RunOne(U.data(), U.size()); }
-  void WriteToOutputCorpus(const Unit &U);
-  void WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix);
-  void PrintStats(const char *Where, const char *End = "\n", size_t Units = 0);
-  void PrintStatusForNewUnit(const Unit &U);
-  void ShuffleCorpus(UnitVector *V);
-  void AddToCorpus(const Unit &U);
-  void CheckExitOnSrcPosOrItem();
-
-  // Trace-based fuzzing: we run a unit with some kind of tracing
-  // enabled and record potentially useful mutations. Then
-  // We apply these mutations one by one to the unit and run it again.
-
-  // Start tracing; forget all previously proposed mutations.
-  void StartTraceRecording();
-  // Stop tracing.
-  void StopTraceRecording();
-
-  void SetDeathCallback();
-  static void StaticDeathCallback();
-  void DumpCurrentUnit(const char *Prefix);
-  void DeathCallback();
-
-  void ResetEdgeCoverage();
-  void ResetCounters();
-  void PrepareCounters(Fuzzer::Coverage *C);
-  bool RecordMaxCoverage(Fuzzer::Coverage *C);
-
-  void AllocateCurrentUnitData();
-  uint8_t *CurrentUnitData = nullptr;
-  std::atomic<size_t> CurrentUnitSize;
-  uint8_t BaseSha1[kSHA1NumBytes];  // Checksum of the base unit.
-  bool RunningCB = false;
-
-  size_t TotalNumberOfRuns = 0;
-  size_t NumberOfNewUnitsAdded = 0;
-
-  bool HasMoreMallocsThanFrees = false;
-  size_t NumberOfLeakDetectionAttempts = 0;
-
-  UserCallback CB;
-  InputCorpus &Corpus;
-  MutationDispatcher &MD;
-  FuzzingOptions Options;
-
-  system_clock::time_point ProcessStartTime = system_clock::now();
-  system_clock::time_point UnitStartTime, UnitStopTime;
-  long TimeOfLongestUnitInSeconds = 0;
-  long EpochOfLastReadOfOutputCorpus = 0;
-
-  // Maximum recorded coverage.
-  Coverage MaxCoverage;
-
-  size_t MaxInputLen = 0;
-  size_t MaxMutationLen = 0;
-
-  // Need to know our own thread.
-  static thread_local bool IsMyThread;
-
-  bool InMergeMode = false;
-};
-
-}; // namespace fuzzer
-
-#endif // LLVM_FUZZER_INTERNAL_H

data/vendor/simdjson/dependencies/json/test/thirdparty/Fuzzer/FuzzerLoop.cpp

@@ -1,792 +0,0 @@
-//===- FuzzerLoop.cpp - Fuzzer's main loop --------------------------------===//
-//
-//                     The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-// Fuzzer's main loop.
-//===----------------------------------------------------------------------===//
-
-#include "FuzzerCorpus.h"
-#include "FuzzerInternal.h"
-#include "FuzzerIO.h"
-#include "FuzzerMutate.h"
-#include "FuzzerRandom.h"
-#include "FuzzerTracePC.h"
-#include <algorithm>
-#include <cstring>
-#include <memory>
-#include <set>
-
-#if defined(__has_include)
-#if __has_include(<sanitizer / coverage_interface.h>)
-#include <sanitizer/coverage_interface.h>
-#endif
-#if __has_include(<sanitizer / lsan_interface.h>)
-#include <sanitizer/lsan_interface.h>
-#endif
-#endif
-
-#define NO_SANITIZE_MEMORY
-#if defined(__has_feature)
-#if __has_feature(memory_sanitizer)
-#undef NO_SANITIZE_MEMORY
-#define NO_SANITIZE_MEMORY __attribute__((no_sanitize_memory))
-#endif
-#endif
-
-namespace fuzzer {
-static const size_t kMaxUnitSizeToPrint = 256;
-
-thread_local bool Fuzzer::IsMyThread;
-
-static void MissingExternalApiFunction(const char *FnName) {
-  Printf("ERROR: %s is not defined. Exiting.\n"
-         "Did you use -fsanitize-coverage=... to build your code?\n",
-         FnName);
-  exit(1);
-}
-
-#define CHECK_EXTERNAL_FUNCTION(fn)                                            \
-  do {                                                                         \
-    if (!(EF->fn))                                                             \
-      MissingExternalApiFunction(#fn);                                         \
-  } while (false)
-
-// Only one Fuzzer per process.
-static Fuzzer *F;
-
-void Fuzzer::ResetEdgeCoverage() {
-  CHECK_EXTERNAL_FUNCTION(__sanitizer_reset_coverage);
-  EF->__sanitizer_reset_coverage();
-}
-
-void Fuzzer::ResetCounters() {
-  if (Options.UseCounters)
-    EF->__sanitizer_update_counter_bitset_and_clear_counters(0);
-}
-
-void Fuzzer::PrepareCounters(Fuzzer::Coverage *C) {
-  if (Options.UseCounters) {
-    size_t NumCounters = EF->__sanitizer_get_number_of_counters();
-    C->CounterBitmap.resize(NumCounters);
-  }
-}
-
-// Records data to a maximum coverage tracker. Returns true if additional
-// coverage was discovered.
-bool Fuzzer::RecordMaxCoverage(Fuzzer::Coverage *C) {
-  bool Res = false;
-
-  uint64_t NewBlockCoverage = EF->__sanitizer_get_total_unique_coverage();
-  if (NewBlockCoverage > C->BlockCoverage) {
-    Res = true;
-    C->BlockCoverage = NewBlockCoverage;
-  }
-
-  if (Options.UseIndirCalls &&
-      EF->__sanitizer_get_total_unique_caller_callee_pairs) {
-    uint64_t NewCallerCalleeCoverage =
-        EF->__sanitizer_get_total_unique_caller_callee_pairs();
-    if (NewCallerCalleeCoverage > C->CallerCalleeCoverage) {
-      Res = true;
-      C->CallerCalleeCoverage = NewCallerCalleeCoverage;
-    }
-  }
-
-  if (Options.UseCounters) {
-    uint64_t CounterDelta =
-        EF->__sanitizer_update_counter_bitset_and_clear_counters(
-            C->CounterBitmap.data());
-    if (CounterDelta > 0) {
-      Res = true;
-      C->CounterBitmapBits += CounterDelta;
-    }
-  }
-
-  return Res;
-}
-
-// Leak detection is expensive, so we first check if there were more mallocs
-// than frees (using the sanitizer malloc hooks) and only then try to call lsan.
-struct MallocFreeTracer {
-  void Start(int TraceLevel) {
-    this->TraceLevel = TraceLevel;
-    if (TraceLevel)
-      Printf("MallocFreeTracer: START\n");
-    Mallocs = 0;
-    Frees = 0;
-  }
-  // Returns true if there were more mallocs than frees.
-  bool Stop() {
-    if (TraceLevel)
-      Printf("MallocFreeTracer: STOP %zd %zd (%s)\n", Mallocs.load(),
-             Frees.load(), Mallocs == Frees ? "same" : "DIFFERENT");
-    bool Result = Mallocs > Frees;
-    Mallocs = 0;
-    Frees = 0;
-    TraceLevel = 0;
-    return Result;
-  }
-  std::atomic<size_t> Mallocs;
-  std::atomic<size_t> Frees;
-  int TraceLevel = 0;
-};
-
-static MallocFreeTracer AllocTracer;
-
-ATTRIBUTE_NO_SANITIZE_MEMORY
-void MallocHook(const volatile void *ptr, size_t size) {
-  size_t N = AllocTracer.Mallocs++;
-  F->HandleMalloc(size);
-  if (int TraceLevel = AllocTracer.TraceLevel) {
-    Printf("MALLOC[%zd] %p %zd\n", N, ptr, size);
-    if (TraceLevel >= 2 && EF)
-      EF->__sanitizer_print_stack_trace();
-  }
-}
-
-ATTRIBUTE_NO_SANITIZE_MEMORY
-void FreeHook(const volatile void *ptr) {
-  size_t N = AllocTracer.Frees++;
-  if (int TraceLevel = AllocTracer.TraceLevel) {
-    Printf("FREE[%zd]   %p\n", N, ptr);
-    if (TraceLevel >= 2 && EF)
-      EF->__sanitizer_print_stack_trace();
-  }
-}
-
-// Crash on a single malloc that exceeds the rss limit.
-void Fuzzer::HandleMalloc(size_t Size) {
-  if (!Options.RssLimitMb || (Size >> 20) < (size_t)Options.RssLimitMb)
-    return;
-  Printf("==%d== ERROR: libFuzzer: out-of-memory (malloc(%zd))\n", GetPid(),
-         Size);
-  Printf("   To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
-  if (EF->__sanitizer_print_stack_trace)
-    EF->__sanitizer_print_stack_trace();
-  DumpCurrentUnit("oom-");
-  Printf("SUMMARY: libFuzzer: out-of-memory\n");
-  PrintFinalStats();
-  _Exit(Options.ErrorExitCode); // Stop right now.
-}
-
-Fuzzer::Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD,
-               FuzzingOptions Options)
-    : CB(CB), Corpus(Corpus), MD(MD), Options(Options) {
-  SetDeathCallback();
-  InitializeTraceState();
-  assert(!F);
-  F = this;
-  TPC.ResetMaps();
-  ResetCoverage();
-  IsMyThread = true;
-  if (Options.DetectLeaks && EF->__sanitizer_install_malloc_and_free_hooks)
-    EF->__sanitizer_install_malloc_and_free_hooks(MallocHook, FreeHook);
-  TPC.SetUseCounters(Options.UseCounters);
-  TPC.SetUseValueProfile(Options.UseValueProfile);
-  TPC.SetPrintNewPCs(Options.PrintNewCovPcs);
-
-  if (Options.Verbosity)
-    TPC.PrintModuleInfo();
-  if (!Options.OutputCorpus.empty() && Options.ReloadIntervalSec)
-    EpochOfLastReadOfOutputCorpus = GetEpoch(Options.OutputCorpus);
-  MaxInputLen = MaxMutationLen = Options.MaxLen;
-  AllocateCurrentUnitData();
-  CurrentUnitSize = 0;
-  memset(BaseSha1, 0, sizeof(BaseSha1));
-}
-
-Fuzzer::~Fuzzer() { }
-
-void Fuzzer::AllocateCurrentUnitData() {
-  if (CurrentUnitData || MaxInputLen == 0) return;
-  CurrentUnitData = new uint8_t[MaxInputLen];
-}
-
-void Fuzzer::SetDeathCallback() {
-  CHECK_EXTERNAL_FUNCTION(__sanitizer_set_death_callback);
-  EF->__sanitizer_set_death_callback(StaticDeathCallback);
-}
-
-void Fuzzer::StaticDeathCallback() {
-  assert(F);
-  F->DeathCallback();
-}
-
-static void WarnOnUnsuccessfullMerge(bool DoWarn) {
-  if (!DoWarn) return;
-  Printf(
-   "***\n"
-   "***\n"
-   "***\n"
-   "*** NOTE: merge did not succeed due to a failure on one of the inputs.\n"
-   "*** You will need to filter out crashes from the corpus, e.g. like this:\n"
-   "***   for f in WITH_CRASHES/*; do ./fuzzer $f && cp $f NO_CRASHES; done\n"
-   "*** Future versions may have crash-resistant merge, stay tuned.\n"
-   "***\n"
-   "***\n"
-   "***\n");
-}
-
-void Fuzzer::DumpCurrentUnit(const char *Prefix) {
-  WarnOnUnsuccessfullMerge(InMergeMode);
-  if (!CurrentUnitData) return;  // Happens when running individual inputs.
-  MD.PrintMutationSequence();
-  Printf("; base unit: %s\n", Sha1ToString(BaseSha1).c_str());
-  size_t UnitSize = CurrentUnitSize;
-  if (UnitSize <= kMaxUnitSizeToPrint) {
-    PrintHexArray(CurrentUnitData, UnitSize, "\n");
-    PrintASCII(CurrentUnitData, UnitSize, "\n");
-  }
-  WriteUnitToFileWithPrefix({CurrentUnitData, CurrentUnitData + UnitSize},
-                            Prefix);
-}
-
-NO_SANITIZE_MEMORY
-void Fuzzer::DeathCallback() {
-  DumpCurrentUnit("crash-");
-  PrintFinalStats();
-}
-
-void Fuzzer::StaticAlarmCallback() {
-  assert(F);
-  F->AlarmCallback();
-}
-
-void Fuzzer::StaticCrashSignalCallback() {
-  assert(F);
-  F->CrashCallback();
-}
-
-void Fuzzer::StaticInterruptCallback() {
-  assert(F);
-  F->InterruptCallback();
-}
-
-void Fuzzer::CrashCallback() {
-  Printf("==%lu== ERROR: libFuzzer: deadly signal\n", GetPid());
-  if (EF->__sanitizer_print_stack_trace)
-    EF->__sanitizer_print_stack_trace();
-  Printf("NOTE: libFuzzer has rudimentary signal handlers.\n"
-         "      Combine libFuzzer with AddressSanitizer or similar for better "
-         "crash reports.\n");
-  Printf("SUMMARY: libFuzzer: deadly signal\n");
-  DumpCurrentUnit("crash-");
-  PrintFinalStats();
-  exit(Options.ErrorExitCode);
-}
-
-void Fuzzer::InterruptCallback() {
-  Printf("==%lu== libFuzzer: run interrupted; exiting\n", GetPid());
-  PrintFinalStats();
-  _Exit(0);  // Stop right now, don't perform any at-exit actions.
-}
-
-NO_SANITIZE_MEMORY
-void Fuzzer::AlarmCallback() {
-  assert(Options.UnitTimeoutSec > 0);
-  if (!InFuzzingThread()) return;
-  if (!RunningCB)
-    return; // We have not started running units yet.
-  size_t Seconds =
-      duration_cast<seconds>(system_clock::now() - UnitStartTime).count();
-  if (Seconds == 0)
-    return;
-  if (Options.Verbosity >= 2)
-    Printf("AlarmCallback %zd\n", Seconds);
-  if (Seconds >= (size_t)Options.UnitTimeoutSec) {
-    Printf("ALARM: working on the last Unit for %zd seconds\n", Seconds);
-    Printf("       and the timeout value is %d (use -timeout=N to change)\n",
-           Options.UnitTimeoutSec);
-    DumpCurrentUnit("timeout-");
-    Printf("==%lu== ERROR: libFuzzer: timeout after %d seconds\n", GetPid(),
-           Seconds);
-    if (EF->__sanitizer_print_stack_trace)
-      EF->__sanitizer_print_stack_trace();
-    Printf("SUMMARY: libFuzzer: timeout\n");
-    PrintFinalStats();
-    _Exit(Options.TimeoutExitCode); // Stop right now.
-  }
-}
-
-void Fuzzer::RssLimitCallback() {
-  Printf(
-      "==%lu== ERROR: libFuzzer: out-of-memory (used: %zdMb; limit: %zdMb)\n",
-      GetPid(), GetPeakRSSMb(), Options.RssLimitMb);
-  Printf("   To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
-  if (EF->__sanitizer_print_memory_profile)
-    EF->__sanitizer_print_memory_profile(95);
-  DumpCurrentUnit("oom-");
-  Printf("SUMMARY: libFuzzer: out-of-memory\n");
-  PrintFinalStats();
-  _Exit(Options.ErrorExitCode); // Stop right now.
-}
-
-void Fuzzer::PrintStats(const char *Where, const char *End, size_t Units) {
-  size_t ExecPerSec = execPerSec();
-  if (Options.OutputCSV) {
-    static bool csvHeaderPrinted = false;
-    if (!csvHeaderPrinted) {
-      csvHeaderPrinted = true;
-      Printf("runs,block_cov,bits,cc_cov,corpus,execs_per_sec,tbms,reason\n");
-    }
-    Printf("%zd,%zd,%zd,%zd,%zd,%zd,%s\n", TotalNumberOfRuns,
-           MaxCoverage.BlockCoverage, MaxCoverage.CounterBitmapBits,
-           MaxCoverage.CallerCalleeCoverage, Corpus.size(), ExecPerSec, Where);
-  }
-
-  if (!Options.Verbosity)
-    return;
-  Printf("#%zd\t%s", TotalNumberOfRuns, Where);
-  if (MaxCoverage.BlockCoverage)
-    Printf(" cov: %zd", MaxCoverage.BlockCoverage);
-  if (size_t N = MaxCoverage.VPMap.GetNumBitsSinceLastMerge())
-    Printf(" vp: %zd", N);
-  if (size_t N = TPC.GetTotalPCCoverage())
-    Printf(" cov: %zd", N);
-  if (auto TB = MaxCoverage.CounterBitmapBits)
-    Printf(" bits: %zd", TB);
-  if (size_t N = Corpus.NumFeatures())
-    Printf( " ft: %zd", N);
-  if (MaxCoverage.CallerCalleeCoverage)
-    Printf(" indir: %zd", MaxCoverage.CallerCalleeCoverage);
-  if (!Corpus.empty()) {
-    Printf(" corp: %zd", Corpus.NumActiveUnits());
-    if (size_t N = Corpus.SizeInBytes()) {
-      if (N < (1<<14))
-        Printf("/%zdb", N);
-      else if (N < (1 << 24))
-        Printf("/%zdKb", N >> 10);
-      else
-        Printf("/%zdMb", N >> 20);
-    }
-  }
-  if (Units)
-    Printf(" units: %zd", Units);
-
-  Printf(" exec/s: %zd", ExecPerSec);
-  Printf(" rss: %zdMb", GetPeakRSSMb());
-  Printf("%s", End);
-}
-
-void Fuzzer::PrintFinalStats() {
-  if (Options.PrintCoverage)
-    TPC.PrintCoverage();
-  if (Options.DumpCoverage)
-    TPC.DumpCoverage();
-  if (Options.PrintCorpusStats)
-    Corpus.PrintStats();
-  if (!Options.PrintFinalStats) return;
-  size_t ExecPerSec = execPerSec();
-  Printf("stat::number_of_executed_units: %zd\n", TotalNumberOfRuns);
-  Printf("stat::average_exec_per_sec:     %zd\n", ExecPerSec);
-  Printf("stat::new_units_added:          %zd\n", NumberOfNewUnitsAdded);
-  Printf("stat::slowest_unit_time_sec:    %zd\n", TimeOfLongestUnitInSeconds);
-  Printf("stat::peak_rss_mb:              %zd\n", GetPeakRSSMb());
-}
-
-void Fuzzer::SetMaxInputLen(size_t MaxInputLen) {
-  assert(this->MaxInputLen == 0); // Can only reset MaxInputLen from 0 to non-0.
-  assert(MaxInputLen);
-  this->MaxInputLen = MaxInputLen;
-  this->MaxMutationLen = MaxInputLen;
-  AllocateCurrentUnitData();
-  Printf("INFO: -max_len is not provided, using %zd\n", MaxInputLen);
-}
-
-void Fuzzer::SetMaxMutationLen(size_t MaxMutationLen) {
-  assert(MaxMutationLen && MaxMutationLen <= MaxInputLen);
-  this->MaxMutationLen = MaxMutationLen;
-}
-
-void Fuzzer::CheckExitOnSrcPosOrItem() {
-  if (!Options.ExitOnSrcPos.empty()) {
-    static auto *PCsSet = new std::set<uintptr_t>;
-    for (size_t i = 1, N = TPC.GetNumPCs(); i < N; i++) {
-      uintptr_t PC = TPC.GetPC(i);
-      if (!PC) continue;
-      if (!PCsSet->insert(PC).second) continue;
-      std::string Descr = DescribePC("%L", PC);
-      if (Descr.find(Options.ExitOnSrcPos) != std::string::npos) {
-        Printf("INFO: found line matching '%s', exiting.\n",
-               Options.ExitOnSrcPos.c_str());
-        _Exit(0);
-      }
-    }
-  }
-  if (!Options.ExitOnItem.empty()) {
-    if (Corpus.HasUnit(Options.ExitOnItem)) {
-      Printf("INFO: found item with checksum '%s', exiting.\n",
-             Options.ExitOnItem.c_str());
-      _Exit(0);
-    }
-  }
-}
-
-void Fuzzer::RereadOutputCorpus(size_t MaxSize) {
-  if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec) return;
-  std::vector<Unit> AdditionalCorpus;
-  ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus,
-                         &EpochOfLastReadOfOutputCorpus, MaxSize,
-                         /*ExitOnError*/ false);
-  if (Options.Verbosity >= 2)
-    Printf("Reload: read %zd new units.\n", AdditionalCorpus.size());
-  bool Reloaded = false;
-  for (auto &U : AdditionalCorpus) {
-    if (U.size() > MaxSize)
-      U.resize(MaxSize);
-    if (!Corpus.HasUnit(U)) {
-      if (size_t NumFeatures = RunOne(U)) {
-        CheckExitOnSrcPosOrItem();
-        Corpus.AddToCorpus(U, NumFeatures);
-        Reloaded = true;
-      }
-    }
-  }
-  if (Reloaded)
-    PrintStats("RELOAD");
-}
-
-void Fuzzer::ShuffleCorpus(UnitVector *V) {
-  std::random_shuffle(V->begin(), V->end(), MD.GetRand());
-  if (Options.PreferSmall)
-    std::stable_sort(V->begin(), V->end(), [](const Unit &A, const Unit &B) {
-      return A.size() < B.size();
-    });
-}
-
-void Fuzzer::ShuffleAndMinimize(UnitVector *InitialCorpus) {
-  Printf("#0\tREAD units: %zd\n", InitialCorpus->size());
-  if (Options.ShuffleAtStartUp)
-    ShuffleCorpus(InitialCorpus);
-
-  // Test the callback with empty input and never try it again.
-  uint8_t dummy;
-  ExecuteCallback(&dummy, 0);
-
-  for (const auto &U : *InitialCorpus) {
-    if (size_t NumFeatures = RunOne(U)) {
-      CheckExitOnSrcPosOrItem();
-      Corpus.AddToCorpus(U, NumFeatures);
-      if (Options.Verbosity >= 2)
-        Printf("NEW0: %zd L %zd\n", MaxCoverage.BlockCoverage, U.size());
-    }
-    TryDetectingAMemoryLeak(U.data(), U.size(),
-                            /*DuringInitialCorpusExecution*/ true);
-  }
-  PrintStats("INITED");
-  if (Corpus.empty()) {
-    Printf("ERROR: no interesting inputs were found. "
-           "Is the code instrumented for coverage? Exiting.\n");
-    exit(1);
-  }
-}
-
-size_t Fuzzer::RunOne(const uint8_t *Data, size_t Size) {
-  if (!Size) return 0;
-  TotalNumberOfRuns++;
-
-  ExecuteCallback(Data, Size);
-
-  size_t Res = 0;
-  if (size_t NumFeatures = TPC.CollectFeatures([&](size_t Feature) -> bool {
-        return Corpus.AddFeature(Feature, Size, Options.Shrink);
-      }))
-    Res = NumFeatures;
-
-  if (!TPC.UsingTracePcGuard()) {
-    if (TPC.UpdateValueProfileMap(&MaxCoverage.VPMap))
-      Res = 1;
-    if (!Res && RecordMaxCoverage(&MaxCoverage))
-      Res = 1;
-  }
-
-  auto TimeOfUnit =
-      duration_cast<seconds>(UnitStopTime - UnitStartTime).count();
-  if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) &&
-      secondsSinceProcessStartUp() >= 2)
-    PrintStats("pulse ");
-  if (TimeOfUnit > TimeOfLongestUnitInSeconds * 1.1 &&
-      TimeOfUnit >= Options.ReportSlowUnits) {
-    TimeOfLongestUnitInSeconds = TimeOfUnit;
-    Printf("Slowest unit: %zd s:\n", TimeOfLongestUnitInSeconds);
-    WriteUnitToFileWithPrefix({Data, Data + Size}, "slow-unit-");
-  }
-  return Res;
-}
-
-size_t Fuzzer::GetCurrentUnitInFuzzingThead(const uint8_t **Data) const {
-  assert(InFuzzingThread());
-  *Data = CurrentUnitData;
-  return CurrentUnitSize;
-}
-
-void Fuzzer::ExecuteCallback(const uint8_t *Data, size_t Size) {
-  assert(InFuzzingThread());
-  // We copy the contents of Unit into a separate heap buffer
-  // so that we reliably find buffer overflows in it.
-  uint8_t *DataCopy = new uint8_t[Size];
-  memcpy(DataCopy, Data, Size);
-  if (CurrentUnitData && CurrentUnitData != Data)
-    memcpy(CurrentUnitData, Data, Size);
-  CurrentUnitSize = Size;
-  AllocTracer.Start(Options.TraceMalloc);
-  UnitStartTime = system_clock::now();
-  ResetCounters();  // Reset coverage right before the callback.
-  TPC.ResetMaps();
-  RunningCB = true;
-  int Res = CB(DataCopy, Size);
-  RunningCB = false;
-  UnitStopTime = system_clock::now();
-  (void)Res;
-  assert(Res == 0);
-  HasMoreMallocsThanFrees = AllocTracer.Stop();
-  CurrentUnitSize = 0;
-  delete[] DataCopy;
-}
-
-void Fuzzer::WriteToOutputCorpus(const Unit &U) {
-  if (Options.OnlyASCII)
-    assert(IsASCII(U));
-  if (Options.OutputCorpus.empty())
-    return;
-  std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U));
-  WriteToFile(U, Path);
-  if (Options.Verbosity >= 2)
-    Printf("Written to %s\n", Path.c_str());
-}
-
-void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) {
-  if (!Options.SaveArtifacts)
-    return;
-  std::string Path = Options.ArtifactPrefix + Prefix + Hash(U);
-  if (!Options.ExactArtifactPath.empty())
-    Path = Options.ExactArtifactPath; // Overrides ArtifactPrefix.
-  WriteToFile(U, Path);
-  Printf("artifact_prefix='%s'; Test unit written to %s\n",
-         Options.ArtifactPrefix.c_str(), Path.c_str());
-  if (U.size() <= kMaxUnitSizeToPrint)
-    Printf("Base64: %s\n", Base64(U).c_str());
-}
-
-void Fuzzer::PrintStatusForNewUnit(const Unit &U) {
-  if (!Options.PrintNEW)
-    return;
-  PrintStats("NEW   ", "");
-  if (Options.Verbosity) {
-    Printf(" L: %zd ", U.size());
-    MD.PrintMutationSequence();
-    Printf("\n");
-  }
-}
-
-void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) {
-  II->NumSuccessfullMutations++;
-  MD.RecordSuccessfulMutationSequence();
-  PrintStatusForNewUnit(U);
-  WriteToOutputCorpus(U);
-  NumberOfNewUnitsAdded++;
-  TPC.PrintNewPCs();
-}
-
-// Finds minimal number of units in 'Extra' that add coverage to 'Initial'.
-// We do it by actually executing the units, sometimes more than once,
-// because we may be using different coverage-like signals and the only
-// common thing between them is that we can say "this unit found new stuff".
-UnitVector Fuzzer::FindExtraUnits(const UnitVector &Initial,
-                                  const UnitVector &Extra) {
-  UnitVector Res = Extra;
-  UnitVector Tmp;
-  size_t OldSize = Res.size();
-  for (int Iter = 0; Iter < 10; Iter++) {
-    ShuffleCorpus(&Res);
-    TPC.ResetMaps();
-    Corpus.ResetFeatureSet();
-    ResetCoverage();
-
-    for (auto &U : Initial) {
-      TPC.ResetMaps();
-      RunOne(U);
-    }
-
-    Tmp.clear();
-    for (auto &U : Res) {
-      TPC.ResetMaps();
-      if (RunOne(U))
-        Tmp.push_back(U);
-    }
-
-    char Stat[7] = "MIN   ";
-    Stat[3] = '0' + Iter;
-    PrintStats(Stat, "\n", Tmp.size());
-
-    size_t NewSize = Tmp.size();
-    assert(NewSize <= OldSize);
-    Res.swap(Tmp);
-
-    if (NewSize + 5 >= OldSize)
-      break;
-    OldSize = NewSize;
-  }
-  return Res;
-}
-
-void Fuzzer::Merge(const std::vector<std::string> &Corpora) {
-  if (Corpora.size() <= 1) {
-    Printf("Merge requires two or more corpus dirs\n");
-    return;
-  }
-  InMergeMode = true;
-  std::vector<std::string> ExtraCorpora(Corpora.begin() + 1, Corpora.end());
-
-  assert(MaxInputLen > 0);
-  UnitVector Initial, Extra;
-  ReadDirToVectorOfUnits(Corpora[0].c_str(), &Initial, nullptr, MaxInputLen,
-                         true);
-  for (auto &C : ExtraCorpora)
-    ReadDirToVectorOfUnits(C.c_str(), &Extra, nullptr, MaxInputLen, true);
-
-  if (!Initial.empty()) {
-    Printf("=== Minimizing the initial corpus of %zd units\n", Initial.size());
-    Initial = FindExtraUnits({}, Initial);
-  }
-
-  Printf("=== Merging extra %zd units\n", Extra.size());
-  auto Res = FindExtraUnits(Initial, Extra);
-
-  for (auto &U: Res)
-    WriteToOutputCorpus(U);
-
-  Printf("=== Merge: written %zd units\n", Res.size());
-}
-
-// Tries detecting a memory leak on the particular input that we have just
-// executed before calling this function.
-void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
-                                     bool DuringInitialCorpusExecution) {
-  if (!HasMoreMallocsThanFrees) return;  // mallocs==frees, a leak is unlikely.
-  if (!Options.DetectLeaks) return;
-  if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) ||
-      !(EF->__lsan_do_recoverable_leak_check))
-    return;  // No lsan.
-  // Run the target once again, but with lsan disabled so that if there is
-  // a real leak we do not report it twice.
-  EF->__lsan_disable();
-  ExecuteCallback(Data, Size);
-  EF->__lsan_enable();
-  if (!HasMoreMallocsThanFrees) return;  // a leak is unlikely.
-  if (NumberOfLeakDetectionAttempts++ > 1000) {
-    Options.DetectLeaks = false;
-    Printf("INFO: libFuzzer disabled leak detection after every mutation.\n"
-           "      Most likely the target function accumulates allocated\n"
-           "      memory in a global state w/o actually leaking it.\n"
-           "      You may try running this binary with -trace_malloc=[12]"
-           "      to get a trace of mallocs and frees.\n"
-           "      If LeakSanitizer is enabled in this process it will still\n"
-           "      run on the process shutdown.\n");
-    return;
-  }
-  // Now perform the actual lsan pass. This is expensive and we must ensure
-  // we don't call it too often.
-  if (EF->__lsan_do_recoverable_leak_check()) { // Leak is found, report it.
-    if (DuringInitialCorpusExecution)
-      Printf("\nINFO: a leak has been found in the initial corpus.\n\n");
-    Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n");
-    CurrentUnitSize = Size;
-    DumpCurrentUnit("leak-");
-    PrintFinalStats();
-    _Exit(Options.ErrorExitCode);  // not exit() to disable lsan further on.
-  }
-}
-
-void Fuzzer::MutateAndTestOne() {
-  MD.StartMutationSequence();
-
-  auto &II = Corpus.ChooseUnitToMutate(MD.GetRand());
-  const auto &U = II.U;
-  memcpy(BaseSha1, II.Sha1, sizeof(BaseSha1));
-  assert(CurrentUnitData);
-  size_t Size = U.size();
-  assert(Size <= MaxInputLen && "Oversized Unit");
-  memcpy(CurrentUnitData, U.data(), Size);
-
-  assert(MaxMutationLen > 0);
-
-  for (int i = 0; i < Options.MutateDepth; i++) {
-    if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
-      break;
-    size_t NewSize = 0;
-    NewSize = MD.Mutate(CurrentUnitData, Size, MaxMutationLen);
-    assert(NewSize > 0 && "Mutator returned empty unit");
-    assert(NewSize <= MaxMutationLen && "Mutator return overisized unit");
-    Size = NewSize;
-    if (i == 0)
-      StartTraceRecording();
-    II.NumExecutedMutations++;
-    if (size_t NumFeatures = RunOne(CurrentUnitData, Size)) {
-      Corpus.AddToCorpus({CurrentUnitData, CurrentUnitData + Size}, NumFeatures,
-                         /*MayDeleteFile=*/true);
-      ReportNewCoverage(&II, {CurrentUnitData, CurrentUnitData + Size});
-      CheckExitOnSrcPosOrItem();
-    }
-    StopTraceRecording();
-    TryDetectingAMemoryLeak(CurrentUnitData, Size,
-                            /*DuringInitialCorpusExecution*/ false);
-  }
-}
-
-void Fuzzer::ResetCoverage() {
-  ResetEdgeCoverage();
-  MaxCoverage.Reset();
-  PrepareCounters(&MaxCoverage);
-}
-
-void Fuzzer::Loop() {
-  system_clock::time_point LastCorpusReload = system_clock::now();
-  if (Options.DoCrossOver)
-    MD.SetCorpus(&Corpus);
-  while (true) {
-    auto Now = system_clock::now();
-    if (duration_cast<seconds>(Now - LastCorpusReload).count() >=
-        Options.ReloadIntervalSec) {
-      RereadOutputCorpus(MaxInputLen);
-      LastCorpusReload = system_clock::now();
-    }
-    if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
-      break;
-    if (TimedOut()) break;
-    // Perform several mutations and runs.
-    MutateAndTestOne();
-  }
-
-  PrintStats("DONE  ", "\n");
-  MD.PrintRecommendedDictionary();
-}
-
-void Fuzzer::MinimizeCrashLoop(const Unit &U) {
-  if (U.size() <= 2) return;
-  while (!TimedOut() && TotalNumberOfRuns < Options.MaxNumberOfRuns) {
-    MD.StartMutationSequence();
-    memcpy(CurrentUnitData, U.data(), U.size());
-    for (int i = 0; i < Options.MutateDepth; i++) {
-      size_t NewSize = MD.Mutate(CurrentUnitData, U.size(), MaxMutationLen);
-      assert(NewSize > 0 && NewSize <= MaxMutationLen);
-      RunOne(CurrentUnitData, NewSize);
-      TryDetectingAMemoryLeak(CurrentUnitData, NewSize,
-                              /*DuringInitialCorpusExecution*/ false);
-    }
-  }
-}
-
-} // namespace fuzzer
-
-extern "C" {
-
-size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
-  assert(fuzzer::F);
-  return fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize);
-}
-}  // extern "C"