WebRTC currently uses libfuzzer for fuzz testing however FuzzTest is a new approach which we have not yet looked into but we will in the future.
Before continuing, read the libfuzzer and FuzzTest getting started docs to get familar. You will also need to download libfuzzer specific libraries, which are not downloaded by default. The easiest way to do this is to set the checkout_fuzzer custom variable in your .gclient file then run gclient runhooks.
"custom_vars": {
"checkout_fuzzer": True,
},
To build the fuzzers residing in the test/fuzzers directory, use
$ gn gen out/fuzzers --args='use_libfuzzer=true optimize_for_fuzzing=true'
Depending on the fuzzer additional arguments like is_asan, is_msan or is_ubsan_security might be required.
See the GN documentation for all available options. There are also more platform specific tips on the Android and iOS instructions.
Create a new .cc file in the test/fuzzers directory, use existing files as a guide.
Add a new webrtc_fuzzers_test build rule in the test/fuzzers/BUILD.gn, use existing rules as a guide.
Ensure it compiles and executes locally then add it to a gerrit CL and upload it for review, e.g.
$ autoninja -C out/fuzzers test/fuzzers:h264_depacketizer_fuzzer
It can then be executed like so:
$ out/fuzzers/bin/run_h264_depacketizer_fuzzer
All fuzzer tests in the test/fuzzers/BUILD.gn file are compiled per CL on the libfuzzer bot. This is only to verify that it compiles, this bot does not do any fuzz testing.
When WebRTC is rolled into to Chromium, the libfuzz bots in the chromium.fuzz will compile it, zip it and then upload to https://clusterfuzz.com for execution.
You can verify that the fuzz test is being executed by:
build# link.//third_party/webrtc/test/fuzzers in the raw_io.output_text_refs_ file in the calculate_all_fuzzers step.webrtc_fuzzers_test build rule) is present.no_clusterfuzz file in the calculate_no_clusterfuzz step. If it is, file a bug at https://bugs.webrtc.org.Bugs are filed automatically in https://crbug.com in the blink > WebRTC component and assigned based on test/fuzzers/OWNERS file or the commit history.
If you are a non-googler, you can only view data from https://clusterfuzz.com if your account is CC'ed on the reported bug.