I've been testing the changes on net_parse_cookie_line_fuzzer,
which is a fuzz target of average size written in C++.
Improvements step by step:
0) Original configuration, Coverage + ASan:
158 MB 1,000 exec/s
1) Prohibit ASan (and other sanitizers), use only Coverage instrumentation:
132 MB same speed
The following change hasn't been applied, but let's keep it in the description FTR:
- 2) Disable sanitizer coverage (which is different from clang source-based coverage):
- 90 MB 1,088 exec/s (speed +8-10%)
3) Avoid optimize_for_fuzzing config (i.e. use -O3 instead of -O1 for coverage build):
Same size 1,773 exec/s (speed +60-65% on top of the previous change)
4) Disable coverage for libFuzzer source code:
88 MB 3,988 exec/s (speed +125% on top of previous changes)
5) Disable coverage for libc++ and libc++abi sources
(https://chromium-review.googlesource.com/#/c/chromium/buildtools/+/693570):
86 MB 4,110 exec/s (speed +3% on top of previous changes)
In total, for that particular target:
- build size reduced by ~45%
- execution speed increased by ~310%
I've also tested the changes with zlib_uncompress_fuzzer (a tiny fuzz target for C-library):
- build size reduced by ~83%
- execution speed increased by ~120%
I haven't measured impact on the other fuzz targets, so it may vary a lot,
but the result seems to be quite significant anyway.
Bug: 759794
Change-Id: Icf61c979e38d0f7849ab7281bd9e24cf2b7a7d02
Reviewed-on: https://chromium-review.googlesource.com/693564
Reviewed-by: Brett Wilson <brettw@chromium.org>
Reviewed-by: Oliver Chang <ochang@chromium.org>
Commit-Queue: Abhishek Arya <inferno@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#506454}
Cr-Mirrored-From: https://chromium.googlesource.com/chromium/src
Cr-Mirrored-Commit: c8fee977deb6f47aaf602813b00428adfe7baa74
Max Moroz
Yuke Liao
Jonathan Metzman
Abhishek Arya