[PATCH] D36982: [libFuzzer] Add deep recursion test.

[Matt Morehouse via Phabricator via llvm-commits]

morehouse created this revision.
Herald added a subscriber: hiraditya.

- Test that libFuzzer uses -fsanitize-coverage=stack-depth instrumentation when present.
- Fix a bug that caused InitialStack to change every time ExecuteCallback was called.
- Make stack-depth-guided fuzzing work without compiling libFuzzer with -fsanitize-coverage=stack-depth.


https://reviews.llvm.org/D36982

Files:
  llvm/lib/Fuzzer/FuzzerTracePC.cpp
  llvm/lib/Fuzzer/FuzzerTracePC.h
  llvm/lib/Fuzzer/test/deep-recursion.test


Index: llvm/lib/Fuzzer/test/deep-recursion.test
===================================================================
--- /dev/null
+++ llvm/lib/Fuzzer/test/deep-recursion.test
@@ -0,0 +1,4 @@
+RUN: %cpp_compiler -fsanitize-coverage=stack-depth %S/DeepRecursionTest.cpp \
+RUN:     -o %t
+RUN: not %t -seed=1 -runs=100000000 2>&1 | FileCheck %s
+CHECK: ERROR: libFuzzer: deadly signal
Index: llvm/lib/Fuzzer/FuzzerTracePC.h
===================================================================
--- llvm/lib/Fuzzer/FuzzerTracePC.h
+++ llvm/lib/Fuzzer/FuzzerTracePC.h
@@ -156,7 +156,7 @@
   std::set<uintptr_t> ObservedPCs;
 
   ValueBitMap ValueProfileMap;
-  uintptr_t InitialStack;
+  uintptr_t InitialStack = 0;
 };
 
 template <class Callback>
Index: llvm/lib/Fuzzer/FuzzerTracePC.cpp
===================================================================
--- llvm/lib/Fuzzer/FuzzerTracePC.cpp
+++ llvm/lib/Fuzzer/FuzzerTracePC.cpp
@@ -32,7 +32,7 @@
 uintptr_t __sancov_trace_pc_pcs[fuzzer::TracePC::kNumPCs];
 
 // Used by -fsanitize-coverage=stack-depth to track stack depth
-ATTRIBUTE_INTERFACE thread_local uintptr_t __sancov_lowest_stack;
+ATTRIBUTE_INTERFACE thread_local uintptr_t __sancov_lowest_stack = UINTPTR_MAX;
 
 namespace fuzzer {
 
@@ -344,7 +344,8 @@
 }
 
 void TracePC::RecordInitialStack() {
-  InitialStack = __sancov_lowest_stack;
+  if (InitialStack == 0)
+    InitialStack = __sancov_lowest_stack;
 }
 
 uintptr_t TracePC::GetMaxStackOffset() const {


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D36982.112066.patch
Type: text/x-patch
Size: 1471 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20170821/9b073b55/attachment-0001.bin>