diff options
| -rw-r--r-- | llvm/lib/Fuzzer/FuzzerTraceState.cpp | 21 | ||||
| -rw-r--r-- | llvm/lib/Fuzzer/test/CMakeLists.txt | 1 | ||||
| -rw-r--r-- | llvm/lib/Fuzzer/test/ThreadedTest.cpp | 23 | ||||
| -rw-r--r-- | llvm/lib/Fuzzer/test/fuzzer-threaded.test | 7 |
4 files changed, 46 insertions, 6 deletions
diff --git a/llvm/lib/Fuzzer/FuzzerTraceState.cpp b/llvm/lib/Fuzzer/FuzzerTraceState.cpp index 8204a2ddc7c..241c2f0ce59 100644 --- a/llvm/lib/Fuzzer/FuzzerTraceState.cpp +++ b/llvm/lib/Fuzzer/FuzzerTraceState.cpp @@ -77,6 +77,7 @@ #include <algorithm> #include <cstring> +#include <thread> #include <unordered_map> #if !LLVM_FUZZER_SUPPORTS_DFSAN @@ -172,8 +173,13 @@ struct TraceBasedMutation { class TraceState { public: - TraceState(const Fuzzer::FuzzingOptions &Options, const Unit &CurrentUnit) - : Options(Options), CurrentUnit(CurrentUnit) {} + TraceState(const Fuzzer::FuzzingOptions &Options, const Unit &CurrentUnit) + : Options(Options), CurrentUnit(CurrentUnit) { + // Current trace collection is not thread-friendly and it probably + // does not have to be such, but at least we should not crash in presence + // of threads. So, just ignore all traces coming from all threads but one. + IsMyThread = true; + } LabelRange GetLabelRange(dfsan_label L); void DFSanCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, @@ -213,8 +219,11 @@ class TraceState { LabelRange LabelRanges[1 << (sizeof(dfsan_label) * 8)]; const Fuzzer::FuzzingOptions &Options; const Unit &CurrentUnit; + static thread_local bool IsMyThread; }; +thread_local bool TraceState::IsMyThread; + LabelRange TraceState::GetLabelRange(dfsan_label L) { LabelRange &LR = LabelRanges[L]; if (LR.Beg < LR.End || L == 0) @@ -238,7 +247,7 @@ void TraceState::DFSanCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, uint64_t Arg1, uint64_t Arg2, dfsan_label L1, dfsan_label L2) { assert(ReallyHaveDFSan()); - if (!RecordingTraces) return; + if (!RecordingTraces || !IsMyThread) return; if (L1 == 0 && L2 == 0) return; // Not actionable. if (L1 != 0 && L2 != 0) @@ -267,7 +276,7 @@ void TraceState::DFSanSwitchCallback(uint64_t PC, size_t ValSizeInBits, uint64_t Val, size_t NumCases, uint64_t *Cases, dfsan_label L) { assert(ReallyHaveDFSan()); - if (!RecordingTraces) return; + if (!RecordingTraces || !IsMyThread) return; if (!L) return; // Not actionable. LabelRange LR = GetLabelRange(L); size_t ValSize = ValSizeInBits / 8; @@ -312,7 +321,7 @@ int TraceState::TryToAddDesiredData(uint64_t PresentData, uint64_t DesiredData, void TraceState::TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, uint64_t Arg1, uint64_t Arg2) { - if (!RecordingTraces) return; + if (!RecordingTraces || !IsMyThread) return; int Added = 0; if (Options.Verbosity >= 3) Printf("TraceCmp %zd/%zd: %p %zd %zd\n", CmpSize, CmpType, PC, Arg1, Arg2); @@ -327,7 +336,7 @@ void TraceState::TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, void TraceState::TraceSwitchCallback(uintptr_t PC, size_t ValSizeInBits, uint64_t Val, size_t NumCases, uint64_t *Cases) { - if (!RecordingTraces) return; + if (!RecordingTraces || !IsMyThread) return; size_t ValSize = ValSizeInBits / 8; bool TryShort = IsTwoByteData(Val); for (size_t i = 0; i < NumCases; i++) diff --git a/llvm/lib/Fuzzer/test/CMakeLists.txt b/llvm/lib/Fuzzer/test/CMakeLists.txt index 674fcc3c9f8..cd0b167eb38 100644 --- a/llvm/lib/Fuzzer/test/CMakeLists.txt +++ b/llvm/lib/Fuzzer/test/CMakeLists.txt @@ -26,6 +26,7 @@ set(Tests StrcmpTest StrncmpTest SwitchTest + ThreadedTest TimeoutTest ) diff --git a/llvm/lib/Fuzzer/test/ThreadedTest.cpp b/llvm/lib/Fuzzer/test/ThreadedTest.cpp new file mode 100644 index 00000000000..7aa114a41f3 --- /dev/null +++ b/llvm/lib/Fuzzer/test/ThreadedTest.cpp @@ -0,0 +1,23 @@ +// Threaded test for a fuzzer. The fuzzer should not crash. +#include <assert.h> +#include <cstdint> +#include <cstddef> +#include <cstring> +#include <thread> + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + if (Size < 8) return 0; + assert(Data); + auto C = [&] { + size_t Res = 0; + for (size_t i = 0; i < Size / 2; i++) + Res += memcmp(Data, Data + Size / 2, 4); + return Res; + }; + std::thread T[] = {std::thread(C), std::thread(C), std::thread(C), + std::thread(C), std::thread(C), std::thread(C)}; + for (auto &X : T) + X.join(); + return 0; +} + diff --git a/llvm/lib/Fuzzer/test/fuzzer-threaded.test b/llvm/lib/Fuzzer/test/fuzzer-threaded.test new file mode 100644 index 00000000000..c58a33456cc --- /dev/null +++ b/llvm/lib/Fuzzer/test/fuzzer-threaded.test @@ -0,0 +1,7 @@ +CHECK: Done 1000 runs in + +RUN: LLVMFuzzer-ThreadedTest -use_traces=1 -runs=1000 2>&1 | FileCheck %s +RUN: LLVMFuzzer-ThreadedTest -use_traces=1 -runs=1000 2>&1 | FileCheck %s +RUN: LLVMFuzzer-ThreadedTest -use_traces=1 -runs=1000 2>&1 | FileCheck %s +RUN: LLVMFuzzer-ThreadedTest -use_traces=1 -runs=1000 2>&1 | FileCheck %s + |
