<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - llvm-prof merge produces invalid output when compiled as 32 bit"
href="https://bugs.llvm.org/show_bug.cgi?id=48694">48694</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>llvm-prof merge produces invalid output when compiled as 32 bit
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>11.0
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Support Libraries
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>cfsteefel@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=24364" name="attach_24364" title="The hexdump -d output of the malformed merged profile data">attachment 24364</a> <a href="attachment.cgi?id=24364&action=edit" title="The hexdump -d output of the malformed merged profile data">[details]</a></span>
The hexdump -d output of the malformed merged profile data
While attempting to test fuzzing, it was discovered that llvm-profdata was
producing bad output, which was unreadable by llvm-cov.
The following is a minimal example:
fuzz.c:
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
int test_func( const uint8_t * data, size_t size ) {
uint8_t ret = 0;
// Do some arbitrary operations
if (size > 100 && size < 200) {
uint8_t d = data[ size ];
uint8_t e = d*256/13;
ret = d | e;
} else {
ret = size;
}
return ret;
}
int LLVMFuzzerInitialize() {
return 0;
}
int LLVMFuzzerTestOneInput( const uint8_t * data, size_t size ) {
if ( size < 1 )
return 0;
test_func( data, size );
return 0;
}
Then, compiled with:
clang -fprofile-instr-generate -fcoverage-mapping -fsanitize=fuzzer fuzz.c
Then, run as ./a.out -runs=100
Then, running llvm-profdata merge -sparse default.profraw -o default.profdata
&& llvm-cov show a.out -instr-profile=default.profdata presents the failure
"Failed to load coverage: Malformed coverage data".
The bug was not reproducible when using a 64 bit clang to compile the above
program in 32 bit with `-m32` and running 64 bit llvm-profdata and llvm-cov on
a stock fedora docker container.
The output contained in the default.profdata file appears to be different from
that of a 64 bit version, such that the value of the HashOffset in the header
is different (740 instead of 744), and the file appears to be 4 bytes shorter
in total. (the hexdump of the output is attached.
The versions of clang, llvm-prof, and llvm-cov are all version 11, and compiled
fully in 32 bit mode in the failing case.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>