Per https://groups.google.com/a/chromium.org/forum/#!topic/chromium-dev/irLAQ8f8uGk
Initial migration of wiki content over to src/docs
There will be a follow-up CL to ensure docs are following chromium’s style guide, links are fixed, etc. The file auditing was becoming too much for a single change and per Nico’s suggestion, it seems to be better to do
+ Bulk import with initial prune.
+ Follow-up CLs to clean up the documentation.
So that each CL has its own purpose.
BUG=none
Review URL: https://codereview.chromium.org/1309473002
Cr-Commit-Position: refs/heads/master@{#345186}
diff --git a/docs/ipc_fuzzer.md b/docs/ipc_fuzzer.md
new file mode 100644
index 0000000..17a80c6
--- /dev/null
+++ b/docs/ipc_fuzzer.md
@@ -0,0 +1,52 @@
+# Introduction
+
+A chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives under `src/tools/ipc_fuzzer/` and is running on ClusterFuzz. A previous version of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new version is doing smarter mutations and generational fuzzing. To do so, each `ParamTraits<Type>` needs a corresponding `FuzzTraits<Type>`. Feel free to contribute.
+
+
+---
+
+# Working with the fuzzer
+
+## Build instructions
+ * add `enable_ipc_fuzzer=1` to `GYP_DEFINES`
+ * build `ipc_fuzzer_all` target
+ * component builds are currently broken, sorry
+ * Debug builds are broken; only Release mode works.
+
+## Replaying ipcdumps
+ * `tools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump`
+ * more help: `tools/ipc_fuzzer/scripts/play_testcase.py -h`
+
+## Listing messages in ipcdump
+ * `out/`_Build_`/ipc_message_util --dump path/to/testcase.ipcdump`
+
+## Updating fuzzers in ClusterFuzz
+ * `tools/ipc_fuzzer/scripts/cf_package_builder.py`
+ * upload `ipc_fuzzer_mut.zip` and `ipc_fuzzer_gen.zip` under build directory to ClusterFuzz
+
+## Contributing FuzzTraits
+ * add them to tools/ipc\_fuzzer/fuzzer/fuzzer.cc
+ * thanks!
+
+
+---
+
+# Components
+
+## ipcdump logger
+ * add `enable_ipc_fuzzer=1` to `GYP_DEFINES`
+ * build `chrome` and `ipc_message_dump` targets
+ * run chrome with `--no-sandbox --ipc-dump-directory=/path/to/ipcdump/directory`
+ * ipcdumps will be created in this directory for each renderer using the format _pid_.ipcdump
+
+## ipcdump replay
+Lives under `ipc_fuzzer/replay`. The renderer is replaced with `ipc_fuzzer_replay` using `--renderer-cmd-prefix`. This is done automatically with the `ipc_fuzzer/play_testcase.py` convenience script.
+
+## ipcdump mutator / generator
+Lives under `ipc_fuzzer/fuzzer`. This is the code that runs on ClusterFuzz. It uses `FuzzTraits<Type>` to mutate ipcdumps or generate them out of thin air.
+
+
+---
+
+# Problems, questions, suggestions
+Send them to [email protected].
\ No newline at end of file
