Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merge the default one-prompt method into the new agentic workflow (Analysis+Enhancement) #785

Open
wants to merge 46 commits into
base: main
Choose a base branch
from

Conversation

DonggeLiu
Copy link
Collaborator

@DonggeLiu DonggeLiu commented Feb 10, 2025

  • Merge run step of check_targets() into ExecutionStage, to collect runtime stats.
  • Merge triage_crash() + the following steps into AnalysisStage()->Triager
  • Test build-ability with the new container_tool from agentic workflow instead of the old target_experiment.py script.
  • Split build_and_run_cloud into 3 functions:
    • Build and collect results in 'OnePromptPrototyper'
    • Use container_tool in OnePromptPrototyper/OnePromptEnhancer.
    • Build+run and collect results in ExecutionStage.
  • Triage results in the Triager
  • Split _fix_generated_fuzz_target() into 2 functions
    • Fix build failures in Protyper
    • Fix runtime failure in Refiner.
    • Refactor the function.

Next:

  • Ensure GKE uses service account.
  • Remove JCC.
  • Add cycle in results.
  • Use cycle when saying logs.
  • Replace old Run/BuildResults with the new one.
  • Clean up repeated code (e.g., parse_libfuzzer_log)

@DonggeLiu
Copy link
Collaborator Author

/gcbrun exp -n dg

1 similar comment
@DonggeLiu
Copy link
Collaborator Author

/gcbrun exp -n dg

@DonggeLiu DonggeLiu marked this pull request as draft February 10, 2025 10:23
@DonggeLiu
Copy link
Collaborator Author

/gcbrun exp -n dg

@DonggeLiu
Copy link
Collaborator Author

/gcbrun exp -n dg

@DonggeLiu
Copy link
Collaborator Author

/gcbrun exp -n dg

@DonggeLiu
Copy link
Collaborator Author

/gcbrun exp -n dg1

@DonggeLiu
Copy link
Collaborator Author

/gcbrun exp -n dg1

@DonggeLiu
Copy link
Collaborator Author

/gcbrun exp -n dg2

@DonggeLiu
Copy link
Collaborator Author

/gcbrun exp -n dg3

@DonggeLiu
Copy link
Collaborator Author

/gcbrun exp -n dg3

@arthurscchan
Copy link
Collaborator

@DonggeLiu LGTM for the merge.

@DonggeLiu
Copy link
Collaborator Author

/gcbrun exp -n dg4

@DonggeLiu
Copy link
Collaborator Author

/gcbrun exp -n dg5

@DonggeLiu
Copy link
Collaborator Author

@DonggeLiu DonggeLiu marked this pull request as ready for review February 14, 2025 20:36
Copy link
Collaborator

@DavidKorczynski DavidKorczynski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is great -- left a few nits but approved so you can land it when you're ready

@@ -0,0 +1,73 @@
"""An LLM agent to improve a fuzz target's runtime performance.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

missing license?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed, thanks!
I will add a CI check later.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still missing :)


MAX_ROUND = 100
MAX_ROUND = 5
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is it intentional to set it to 5? Seems like a big reduction from 100?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point—it's worth trying a higher value (e.g., 10).

The original one-prompt workflow was capped at 5 rounds because each round built a fuzz target on a new Cloud Build, which was expensive. Now that we're using a cheaper approach, we can afford more rounds. However, since the one-prompt method only gets build error messages, if the LLM can't generate a valid target within a few rounds, additional rounds likely won't help, so 100 would be excessive.

For context, 100 rounds were used in the agentic method where rounds are lightweight and can obtain new information (e.g., bash commands).

generated_project, benchmark_target_name,
self.work_dirs.run_logs_target(benchmark_target_name, iteration))
# run_log_path = self.work_dirs.run_logs_target(benchmark_target_name,
# iteration)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we want to keep these comments?

@@ -538,7 +548,8 @@ def build_and_run_local(
run_result.crashes, run_result.crash_info, \
run_result.semantic_check = \
self._parse_libfuzzer_logs(f, project_name, flag)
run_result.succeeded = not run_result.semantic_check.has_err
# run_result.succeeded = not run_result.semantic_check.has_err
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

intentional to leave this commented out?

generated_project)
# # Overwrite the Dockerfile to be caching friendly
# oss_fuzz_checkout.rewrite_project_to_cached_project_chronos(
# generated_project)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could you leave a comment on why this is being commented out?

# run_result.semantic_check.type,
# run_result.triage,
# compile_error=build_result.log_path,
# compile_log=build_result.log_path))
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could you leave a comment here?

local_file.write(tmp_file.read())

os.remove(tmp_path)
# blob.download_to_filename(local_path)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could you leave a comment/remove/uncomment?

@@ -4,9 +4,13 @@
import json
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

missing a license here as well?

@@ -4,7 +4,7 @@

import logger
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

missing license?

@@ -4,6 +4,7 @@

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

license nit

@@ -0,0 +1,73 @@
"""An LLM agent to improve a fuzz target's runtime performance.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still missing :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants