[LibFuzzer] Declare and use sanitizer functions in `fuzzer::ExternalFunctions`

[delcypher]

Summary

[LibFuzzer] Declare and use sanitizer functions in fuzzer::ExternalFunctions

This fixes linking problems on OSX.

Unfortunately it turns out we need to use an instance of the
fuzzer::ExternalFunctions object in several places so this
commit also replaces all instances with a single global instance.

It also turns out initializing a global fuzzer::ExternalFunctions
before main is entered (i.e. letting the object be initialised by the
global initializers) is not safe (on OSX the call to Printf() in the
CTOR crashes if it is called from a global initializer) so we instead
have a global fuzzer::ExternalFunctions* and initialize it inside
FuzzerDriver().

Multiple unit tests depend also depend on the
fuzzer::ExternalFunctions* global so each unit test that needs
it initializes it for itself.

[delcypher]

@kcc: There are a bunch of problems here that need resolving

• I've hacked the CHECK_WEAK_API_FUNCTION macro so that the tests pass on Linux but this is really bad. I'm thinking that it would be better to change the last argument `EXT_FUNC to be an enum value (enum { OK, WARN, ERROR};) to indicate how a missing function should be handled and then change the implementations of ExternalFunction::ExternalFunction` to abort as appropriate. That way we could get rid of the CHECK_WEAK_API_FUNCTION macro.

• I'm not 100% sure which external functions are required and which are just nice to have. I've just made educated guesses about what to warn about but I'm not sure If I have this right.

• There's still a linking issue on OSX. The LLVMFuzzer-FourIndependentBranchesTest-TracePC test (and probably other tests) fail to link due to having undefined reference to _sanitizer_cov_trace_pc_indir. I'm guessing LibFuzzer ought to provide an implementation but I'm surprised we don't hit this on Linux.

Thoughts?

[delcypher]

• There's still a linking issue on OSX. The LLVMFuzzer-FourIndependentBranchesTest-TracePC test (and probably other tests) fail to link due to having undefined reference to _sanitizer_cov_trace_pc_indir. I'm guessing LibFuzzer ought to provide an implementation but I'm surprised we don't hit this on Linux.

Actually I guess the difference here is the use of libcxx on OSX based on the error message from the linker

[100%] Linking CXX executable ../LLVMFuzzer-FourIndependentBranchesTest-TracePC
Undefined symbols for architecture x86_64:
  "___sanitizer_cov_trace_pc_indir", referenced from:
      std::__1::basic_ostream<char, std::__1::char_traits<char> >& std::__1::__put_character_sequence<char, std::__1::char_traits
<char> >(std::__1::basic_ostream<char, std::__1::char_traits<char> >&, char const*, unsigned long) in FourIndependentBranchesTest
.cpp.o
      std::__1::ostreambuf_iterator<char, std::__1::char_traits<char> > std::__1::__pad_and_output<char, std::__1::char_traits<ch
ar> >(std::__1::ostreambuf_iterator<char, std::__1::char_traits<char> >, char const*, char const*, char const*, std::__1::ios_bas
e&, char) in FourIndependentBranchesTest.cpp.o
ld: symbol(s) not found for architecture x86_64

[kcc]

lib/Fuzzer/FuzzerExtFunctions.def

24 ↗

(On Diff #59484)

This last boolean argument is hard to reason about.
BTW, I don't know why you need it at all.
We must be able to link w./o any of those symbols (see test/UninstrumentedTest.cpp)

lib/Fuzzer/FuzzerIO.cpp

126 ↗

(On Diff #59484)

Ouch. That's becoming too annoying.
Let's just have a singleton global object "fuzzer::ExternalFunctions *EF" that we initialized at startup
and delete all private instances.

lib/Fuzzer/FuzzerLoop.cpp

49 ↗

(On Diff #59484)

what do you want to fix here?

[delcypher]

lib/Fuzzer/FuzzerExtFunctions.def

24 ↗

(On Diff #59484)

The meaning of the last boolean argument is whether or not to emit a warning during initialization of ExternalFunctions if the function cannot be found at runtime.

What I was suggesting is that this last argument could be turned into an enum to indicate what to do when function cannot be found at runtime during initialization. This could be one of three things.

• Do Nothing
• Emit a warning
• Emit an error and exit

This does not affect the compile time linking, it affects what happens at run time.

What this would change is that we would immediately exit at runtime if the essential functions are not available rather than waiting until they are called (the currently behaviour). This would then allow the CHECK_WEAK_API_FUNCTION macro to be removed.

How do you feel about this proposal?

lib/Fuzzer/FuzzerLoop.cpp

49 ↗

(On Diff #59484)

• The name of the macro is now wrong for OSX (we don't use weak symbols)
• The suggestion I have made to check for function availability in the ExternalFunctions CTOR means we could get rid of this macro entirely.
• What I've done is a hack to keep the tests passing because the stringified name #fn gets given to MissingWeakApiFunction(const char *FnName) I had to have users of the macro do

CHECK_WEAK_API_FUNCTION(__sanitizer_reset_coverage)

rather than

CHECK_WEAK_API_FUNCTION(EF.__sanitizer_reset_coverage)

[kcc]

lib/Fuzzer/FuzzerExtFunctions.def

24 ↗

(On Diff #59484)

At the very least that's a change in behavior.
Try not to combine refactoring and changing the behavior it complicates reasoning during the code review.
If you will this functionality is needed let's do it separately.
In this change, please just drop this.

lib/Fuzzer/FuzzerLoop.cpp

49 ↗

(On Diff #59484)

Remove the FIXME for now.

[delcypher]

lib/Fuzzer/FuzzerIO.cpp

126 ↗

(On Diff #59484)

Do you want this change to be in this patch or a subsequent patch?

[kcc]

lib/Fuzzer/FuzzerIO.cpp

126 ↗

(On Diff #59484)

I don't want you to introduce one more EF here, so yes, in this patch.

[delcypher]

Rework patch.

[delcypher]

@kcc: Sorry for the delay in reworking the patch. I've tested this on Linux and OSX. The tests continue to pass on Linux and on OSX all the tests successfully compile and link although they don't all pass.

[kcc]

lib/Fuzzer/FuzzerDriver.cpp

272 ↗

(On Diff #59799)

remove the comment, it makes little sense to me

428 ↗

(On Diff #59799)

make this ExternalFunctions *EF

lib/Fuzzer/FuzzerExtFunctions.h

23 ↗

(On Diff #59799)

Leave the CTOR, initialize with

EF = new ...

[delcypher]

lib/Fuzzer/FuzzerDriver.cpp

272 ↗

(On Diff #59799)

The comment is stating something fairly important. It's stating that Init should be called after main(). It how is also stated in the ExternalFunctions.h header so I guess this is probably redundant. I'll remove it.

[delcypher]

lib/Fuzzer/FuzzerDriver.cpp

428 ↗

(On Diff #59799)

We could also use std::unique_ptr<ExternalFunctions> instead or are you fine with an explicit delete?

[kcc]

lib/Fuzzer/FuzzerDriver.cpp

428 ↗

(On Diff #59799)

I am *not* ok with std::unique_ptr<ExternalFunctions>
And there is no need for an explicit delete.
Just

EF = new  .... ;

in main is enough

In tests you may have new/delete or even

std::unique_ptr<ExternalFunctions> t;
EF = t.get()

[delcypher]

lib/Fuzzer/FuzzerDriver.cpp

428 ↗

(On Diff #59799)

I am *not* ok with std::unique_ptr<ExternalFunctions>
And there is no need for an explicit delete.
Just

EF = new .... ;
in main is enough

I don't understand. Why do you want a deliberate leak?

In tests you may have new/delete or even

std::unique_ptr<ExternalFunctions> t;
EF = t.get()

Again I don't understand. Why would I want to assign nullptr (that is what t.get() would return here) to EF?

[kcc]

lib/Fuzzer/FuzzerDriver.cpp

428 ↗

(On Diff #59799)

This won't be a leak. It will be a global variable which is alive throughout the process.

I meant, in test you could either do

FE = new ...
 ....
 delete EF;
 EF = nullptr; // just in case

or, better

       
std::unique_ptr<ExternalFunctions> t(new ...);
EF = t.get()
...
EF = nullptr;  // just tin case

[delcypher]

• Use global pointer for EF
• Add main() to unit tests to initialize EF.

[kcc]

lib/Fuzzer/FuzzerExtFunctions.h

21 ↗

(On Diff #59831)

Why you can't call this before main()?
Just curious.

lib/Fuzzer/test/FuzzerUnittest.cpp

430 ↗

(On Diff #59831)

Are you sure you need to do that?
Have you seen an lsan report of you don't?

When you do

global_var = new ...

there is no leak from lsan POV because the memory is reachable.

[delcypher]

lib/Fuzzer/FuzzerExtFunctions.h

21 ↗

(On Diff #59831)

It is probably possible to call somewhere before main() but on OSX when running the uninstrumented test ExternalFunctions::ExternalFunctions tries to use the Printf() function to report that a function is missing. It seems the Printf() call crashes (trying to access an invalid address) when it is invoked from a global initializer. The crash happens when calling vfprintf()

I suspect something wasn't correctly initialized when the Printf() was called leading to the crash. So for safety I thought it best to leave a note saying not to try calling it before entering main().

lib/Fuzzer/test/FuzzerUnittest.cpp

430 ↗

(On Diff #59831)

@kcc: Good catch.

Originally the implementation of main() was like this

int main(int argc, char **argv) {
  fuzzer::EF = new ExternalFunctions();
  ::testing::InitGoogleTest(&argc, argv);
  int result =  RUN_ALL_TESTS();
  fuzzer::EF = nullptr;
  return result;
}

In this implementation LSan will fire because I set fuzzer::EF to nullptr. Because of that I started using a std::unique_ptr<ExternalFunctions> but then later I simplified the main() function to not set fuzzer::EF to nullptr. After doing that I forgot to check if the std::unique_ptr<ExternalFunction> was still needed. It isn't really needed anymore.

Would you like me to remove it?

[delcypher]

• Rebase to support (r272054) @aizatsky.

[kcc]

lib/Fuzzer/FuzzerExtFunctions.h

21 ↗

(On Diff #59961)

That's quite strange, but ok...

lib/Fuzzer/test/FuzzerUnittest.cpp

430 ↗

(On Diff #59961)

Of course, if you do

EF = new ... 
 ...
EF = nullptr

lsan will bark.

Ideally, I want to not add main()
Can you create and destroy EF in every test that needs it?

std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
EF = t.get();
...

[delcypher]

• Modify each unittest that needs fuzzer::EF to be initialized to initialize it instead of implementing our main() function.

[kcc]

LGTM

[delcypher]

In D20943#451689, @kcc wrote:

LGTM

Great! With this patch all link failures under OSX are gone :)

llvm/trunk/lib/Fuzzer/FuzzerDriver.cpp

for (auto &Path : *Inputs)
     if (!IsFile(Path))
       return false;
   return true;
 }
 
 int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
   using namespace fuzzer;
   assert(argc && argv && "Argument pointers cannot be nullptr");
-  fuzzer::ExternalFunctions EF;
-  if (EF.LLVMFuzzerInitialize)
-    EF.LLVMFuzzerInitialize(argc, argv);
+  EF = new ExternalFunctions();
+  if (EF->LLVMFuzzerInitialize)
+    EF->LLVMFuzzerInitialize(argc, argv);
   const std::vector<std::string> Args(*argv, *argv + *argc);
   assert(!Args.empty());
   ProgName = new std::string(Args[0]);
   ParseFlags(Args);
   if (Flags.help) {
     PrintHelp();
     return 0;
   }
int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
 
   if (Flags.verbosity)
     Printf("Done %d runs in %zd second(s)\n", F.getTotalNumberOfRuns(),
            F.secondsSinceProcessStartUp());
   F.PrintFinalStats();
 
   exit(0);  // Don't let F destroy itself.
 }
+
+// Storage for global ExternalFunctions object.
+ExternalFunctions *EF = nullptr;
+
 }  // namespace fuzzer

llvm/trunk/lib/Fuzzer/FuzzerExtFunctions.h

 #define LLVM_FUZZER_EXT_FUNCTIONS_H
 
 #include <stddef.h>
 #include <stdint.h>
 
 namespace fuzzer {
 
 struct ExternalFunctions {
-  // Initialize function pointers. Functions that are not available
-  // will be set to nullptr.
+  // Initialize function pointers. Functions that are not available will be set
+  // to nullptr.  Do not call this constructor  before ``main()`` has been
+  // entered.
   ExternalFunctions();
 
 #define EXT_FUNC(NAME, RETURN_TYPE, FUNC_SIG, WARN)                            \
   RETURN_TYPE(*NAME) FUNC_SIG = nullptr
 
 #include "FuzzerExtFunctions.def"
 
 #undef EXT_FUNC
 };
 } // namespace fuzzer
 #endif

llvm/trunk/lib/Fuzzer/FuzzerExtFunctions.def

EXT_FUNC(LLVMFuzzerCustomMutator, size_t,
          (uint8_t * Data, size_t Size, size_t MaxSize, unsigned int Seed),
          false);
 EXT_FUNC(LLVMFuzzerCustomCrossOver, size_t,
          (const uint8_t * Data1, size_t Size1,
           const uint8_t * Data2, size_t Size2,
           uint8_t * Out, size_t MaxOutSize, unsigned int Seed),
          false);
 
-// TODO: Sanitizer functions
+// Sanitizer functions
+EXT_FUNC(__lsan_enable, void, (), false);
+EXT_FUNC(__lsan_disable, void, (), false);
+EXT_FUNC(__lsan_do_recoverable_leak_check, int, (), false);
+EXT_FUNC(__sanitizer_get_coverage_pc_buffer, uintptr_t, (uintptr_t**), true);
+EXT_FUNC(__sanitizer_get_number_of_counters, size_t, (), false);
+EXT_FUNC(__sanitizer_get_total_unique_caller_callee_pairs, size_t, (), false);
+EXT_FUNC(__sanitizer_get_total_unique_coverage, size_t, (), true);
+EXT_FUNC(__sanitizer_print_memory_profile, int, (size_t), false);
+EXT_FUNC(__sanitizer_print_stack_trace, void, (), true);
+EXT_FUNC(__sanitizer_reset_coverage, void, (), true);
+EXT_FUNC(__sanitizer_set_death_callback, void, (void (*)(void)), true);
+EXT_FUNC(__sanitizer_set_report_fd, void, (void*), false);
+EXT_FUNC(__sanitizer_update_counter_bitset_and_clear_counters, uintptr_t,
+  (uint8_t*), false);

llvm/trunk/lib/Fuzzer/FuzzerIO.cpp

 //===- FuzzerIO.cpp - IO utils. -------------------------------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 // IO functions.
 //===----------------------------------------------------------------------===//
+#include "FuzzerExtFunctions.h"
 #include "FuzzerInternal.h"
 #include <iterator>
 #include <fstream>
 #include <dirent.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
 #include <cstdarg>
 #include <cstdio>
 
-extern "C" {
-__attribute__((weak)) void __sanitizer_set_report_fd(void *);
-}
-
 namespace fuzzer {
 
 static FILE *OutputFile = stderr;
 
 bool IsFile(const std::string &Path) {
   struct stat St;
   if (stat(Path.c_str(), &St))
     return false;

 }
 
 void DupAndCloseStderr() {
   int OutputFd = dup(2);
   if (OutputFd > 0) {
     FILE *NewOutputFile = fdopen(OutputFd, "w");
     if (NewOutputFile) {
       OutputFile = NewOutputFile;
-      if (__sanitizer_set_report_fd)
-        __sanitizer_set_report_fd(reinterpret_cast<void*>(OutputFd));
+      if (EF->__sanitizer_set_report_fd)
+        EF->__sanitizer_set_report_fd(reinterpret_cast<void *>(OutputFd));
       close(2);
     }
   }
 }
 
 void CloseStdout() { close(1); }
 
 void Printf(const char *Fmt, ...) {
   va_list ap;
   va_start(ap, Fmt);
   vfprintf(OutputFile, Fmt, ap);
   va_end(ap);
   fflush(OutputFile);
 }
 
 }  // namespace fuzzer

llvm/trunk/lib/Fuzzer/FuzzerInternal.h

struct Mutator {
     const char *Name;
   };
 
   size_t AddWordFromDictionary(Dictionary &D, uint8_t *Data, size_t Size,
                                size_t MaxSize);
   size_t MutateImpl(uint8_t *Data, size_t Size, size_t MaxSize,
                     const std::vector<Mutator> &Mutators);
 
-  // Interface to functions that may or may not be available.
-  const ExternalFunctions EF;
-
   Random &Rand;
   // Dictionary provided by the user via -dict=DICT_FILE.
   Dictionary ManualDictionary;
   // Temporary dictionary modified by the fuzzer itself,
   // recreated periodically.
   Dictionary TempAutoDictionary;
   // Persistent dictionary modified by the fuzzer, consists of
   // entries that led to successfull discoveries in the past mutations.
private:
   long TimeOfLongestUnitInSeconds = 0;
   long EpochOfLastReadOfOutputCorpus = 0;
 
   // Maximum recorded coverage.
   Coverage MaxCoverage;
 
   // Need to know our own thread.
   static thread_local bool IsMyThread;
-
-  // Interface to functions that may or may not be available.
-  // For future use, currently not used.
-  const ExternalFunctions EF;
 };
 
+// Global interface to functions that may or may not be available.
+extern ExternalFunctions *EF;
+
 }; // namespace fuzzer
 
 #endif // LLVM_FUZZER_INTERNAL_H

llvm/trunk/lib/Fuzzer/FuzzerLoop.cpp

 #define NO_SANITIZE_MEMORY
 #if defined(__has_feature)
 #if __has_feature(memory_sanitizer)
 #undef NO_SANITIZE_MEMORY
 #define NO_SANITIZE_MEMORY __attribute__((no_sanitize_memory))
 #endif
 #endif
 
-extern "C" {
-// Re-declare some of the sanitizer functions as "weak" so that
-// libFuzzer can be linked w/o the sanitizers and sanitizer-coverage
-// (in which case it will complain at start-up time).
-__attribute__((weak)) void __sanitizer_print_stack_trace();
-__attribute__((weak)) void __sanitizer_reset_coverage();
-__attribute__((weak)) size_t __sanitizer_get_total_unique_caller_callee_pairs();
-__attribute__((weak)) size_t __sanitizer_get_total_unique_coverage();
-__attribute__((weak)) void
-__sanitizer_set_death_callback(void (*callback)(void));
-__attribute__((weak)) size_t __sanitizer_get_number_of_counters();
-__attribute__((weak)) uintptr_t
-__sanitizer_update_counter_bitset_and_clear_counters(uint8_t *bitset);
-__attribute__((weak)) uintptr_t
-__sanitizer_get_coverage_pc_buffer(uintptr_t **data);
-
-__attribute__((weak)) void __sanitizer_malloc_hook(void *ptr, size_t size);
-__attribute__((weak)) void __sanitizer_free_hook(void *ptr);
-__attribute__((weak)) void __lsan_enable();
-__attribute__((weak)) void __lsan_disable();
-__attribute__((weak)) int __lsan_do_recoverable_leak_check();
-__attribute__((weak)) int __sanitizer_print_memory_profile(size_t);
-}
-
 namespace fuzzer {
 static const size_t kMaxUnitSizeToPrint = 256;
 static const size_t TruncateMaxRuns = 1000;
 
 thread_local bool Fuzzer::IsMyThread;
 
-static void MissingWeakApiFunction(const char *FnName) {
+static void MissingExternalApiFunction(const char *FnName) {
   Printf("ERROR: %s is not defined. Exiting.\n"
          "Did you use -fsanitize-coverage=... to build your code?\n",
          FnName);
   exit(1);
 }
 
-#define CHECK_WEAK_API_FUNCTION(fn)                                            \
+#define CHECK_EXTERNAL_FUNCTION(fn)                                            \
   do {                                                                         \
-    if (!fn)                                                                   \
-      MissingWeakApiFunction(#fn);                                             \
+    if (!(EF->fn))                                                             \
+      MissingExternalApiFunction(#fn);                                         \
   } while (false)
 
 // Only one Fuzzer per process.
 static Fuzzer *F;
 
 struct CoverageController {
   static void Reset() {
-    CHECK_WEAK_API_FUNCTION(__sanitizer_reset_coverage);
-    __sanitizer_reset_coverage();
+    CHECK_EXTERNAL_FUNCTION(__sanitizer_reset_coverage);
+    EF->__sanitizer_reset_coverage();
     PcMapResetCurrent();
   }
 
   static void ResetCounters(const Fuzzer::FuzzingOptions &Options) {
     if (Options.UseCounters) {
-      __sanitizer_update_counter_bitset_and_clear_counters(0);
+      EF->__sanitizer_update_counter_bitset_and_clear_counters(0);
     }
   }
 
   static void Prepare(const Fuzzer::FuzzingOptions &Options,
                       Fuzzer::Coverage *C) {
     if (Options.UseCounters) {
-      size_t NumCounters = __sanitizer_get_number_of_counters();
+      size_t NumCounters = EF->__sanitizer_get_number_of_counters();
       C->CounterBitmap.resize(NumCounters);
     }
   }
 
   // Records data to a maximum coverage tracker. Returns true if additional
   // coverage was discovered.
   static bool RecordMax(const Fuzzer::FuzzingOptions &Options,
                         Fuzzer::Coverage *C) {
     bool Res = false;
 
-    uint64_t NewBlockCoverage = __sanitizer_get_total_unique_coverage();
+    uint64_t NewBlockCoverage = EF->__sanitizer_get_total_unique_coverage();
     if (NewBlockCoverage > C->BlockCoverage) {
       Res = true;
       C->BlockCoverage = NewBlockCoverage;
     }
 
     if (Options.UseIndirCalls &&
-        __sanitizer_get_total_unique_caller_callee_pairs) {
+        EF->__sanitizer_get_total_unique_caller_callee_pairs) {
       uint64_t NewCallerCalleeCoverage =
-          __sanitizer_get_total_unique_caller_callee_pairs();
+          EF->__sanitizer_get_total_unique_caller_callee_pairs();
       if (NewCallerCalleeCoverage > C->CallerCalleeCoverage) {
         Res = true;
         C->CallerCalleeCoverage = NewCallerCalleeCoverage;
       }
     }
 
     if (Options.UseCounters) {
       uint64_t CounterDelta =
-          __sanitizer_update_counter_bitset_and_clear_counters(
+          EF->__sanitizer_update_counter_bitset_and_clear_counters(
               C->CounterBitmap.data());
       if (CounterDelta > 0) {
         Res = true;
         C->CounterBitmapBits += CounterDelta;
       }
     }
 
     uint64_t NewPcMapBits = PcMapMergeInto(&C->PCMap);
     if (NewPcMapBits > C->PcMapBits) {
       Res = true;
       C->PcMapBits = NewPcMapBits;
     }
 
     uintptr_t *CoverageBuf;
-    uint64_t NewPcBufferLen = __sanitizer_get_coverage_pc_buffer(&CoverageBuf);
+    uint64_t NewPcBufferLen =
+        EF->__sanitizer_get_coverage_pc_buffer(&CoverageBuf);
     if (NewPcBufferLen > C->PcBufferLen) {
       Res = true;
       C->PcBufferLen = NewPcBufferLen;
     }
 
     return Res;
   }
 };

 }
 
 void Fuzzer::LazyAllocateCurrentUnitData() {
   if (CurrentUnitData || Options.MaxLen == 0) return;
   CurrentUnitData = new uint8_t[Options.MaxLen];
 }
 
 void Fuzzer::SetDeathCallback() {
-  CHECK_WEAK_API_FUNCTION(__sanitizer_set_death_callback);
-  __sanitizer_set_death_callback(StaticDeathCallback);
+  CHECK_EXTERNAL_FUNCTION(__sanitizer_set_death_callback);
+  EF->__sanitizer_set_death_callback(StaticDeathCallback);
 }
 
 void Fuzzer::StaticDeathCallback() {
   assert(F);
   F->DeathCallback();
 }
 
 void Fuzzer::DumpCurrentUnit(const char *Prefix) {

 
 void Fuzzer::StaticInterruptCallback() {
   assert(F);
   F->InterruptCallback();
 }
 
 void Fuzzer::CrashCallback() {
   Printf("==%d== ERROR: libFuzzer: deadly signal\n", GetPid());
-  if (__sanitizer_print_stack_trace)
-    __sanitizer_print_stack_trace();
+  if (EF->__sanitizer_print_stack_trace)
+    EF->__sanitizer_print_stack_trace();
   Printf("NOTE: libFuzzer has rudimentary signal handlers.\n"
          "      Combine libFuzzer with AddressSanitizer or similar for better "
          "crash reports.\n");
   Printf("SUMMARY: libFuzzer: deadly signal\n");
   DumpCurrentUnit("crash-");
   PrintFinalStats();
   exit(Options.ErrorExitCode);
 }
if (Options.Verbosity >= 2)
     Printf("AlarmCallback %zd\n", Seconds);
   if (Seconds >= (size_t)Options.UnitTimeoutSec) {
     Printf("ALARM: working on the last Unit for %zd seconds\n", Seconds);
     Printf("       and the timeout value is %d (use -timeout=N to change)\n",
            Options.UnitTimeoutSec);
     DumpCurrentUnit("timeout-");
     Printf("==%d== ERROR: libFuzzer: timeout after %d seconds\n", GetPid(),
            Seconds);
-    if (__sanitizer_print_stack_trace)
-      __sanitizer_print_stack_trace();
+    if (EF->__sanitizer_print_stack_trace)
+      EF->__sanitizer_print_stack_trace();
     Printf("SUMMARY: libFuzzer: timeout\n");
     PrintFinalStats();
     _Exit(Options.TimeoutExitCode); // Stop right now.
   }
 }
 
 void Fuzzer::RssLimitCallback() {
   Printf(
       "==%d== ERROR: libFuzzer: out-of-memory (used: %zdMb; limit: %zdMb)\n",
       GetPid(), GetPeakRSSMb(), Options.RssLimitMb);
   Printf("   To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
-  if (__sanitizer_print_memory_profile)
-    __sanitizer_print_memory_profile(50);
+  if (EF->__sanitizer_print_memory_profile)
+    EF->__sanitizer_print_memory_profile(50);
   DumpCurrentUnit("oom-");
   Printf("SUMMARY: libFuzzer: out-of-memory\n");
   PrintFinalStats();
   _Exit(Options.ErrorExitCode); // Stop right now.
 }
 
 void Fuzzer::PrintStats(const char *Where, const char *End) {
   size_t ExecPerSec = execPerSec();

 }
 
 bool Fuzzer::UpdateMaxCoverage() {
   uintptr_t PrevBufferLen = MaxCoverage.PcBufferLen;
   bool Res = CoverageController::RecordMax(Options, &MaxCoverage);
 
   if (Options.PrintNewCovPcs && PrevBufferLen != MaxCoverage.PcBufferLen) {
     uintptr_t *CoverageBuf;
-    __sanitizer_get_coverage_pc_buffer(&CoverageBuf);
+    EF->__sanitizer_get_coverage_pc_buffer(&CoverageBuf);
     assert(CoverageBuf);
     for (size_t I = PrevBufferLen; I < MaxCoverage.PcBufferLen; ++I) {
       Printf("%p\n", CoverageBuf[I]);
     }
   }
 
   return Res;
 }

 }
 
 // Tries detecting a memory leak on the particular input that we have just
 // executed before calling this function.
 void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
                                      bool DuringInitialCorpusExecution) {
   if (!HasMoreMallocsThanFrees) return;  // mallocs==frees, a leak is unlikely.
   if (!Options.DetectLeaks) return;
-  if (!&__lsan_enable || !&__lsan_disable || !__lsan_do_recoverable_leak_check)
+  if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) ||
+      !(EF->__lsan_do_recoverable_leak_check))
     return;  // No lsan.
   // Run the target once again, but with lsan disabled so that if there is
   // a real leak we do not report it twice.
-  __lsan_disable();
+  EF->__lsan_disable();
   RunOne(Data, Size);
-  __lsan_enable();
+  EF->__lsan_enable();
   if (!HasMoreMallocsThanFrees) return;  // a leak is unlikely.
   if (NumberOfLeakDetectionAttempts++ > 1000) {
     Options.DetectLeaks = false;
     Printf("INFO: libFuzzer disabled leak detection after every mutation.\n"
            "      Most likely the target function accumulates allocated\n"
            "      memory in a global state w/o actually leaking it.\n"
            "      If LeakSanitizer is enabled in this process it will still\n"
            "      run on the process shutdown.\n");
     return;
   }
   // Now perform the actual lsan pass. This is expensive and we must ensure
   // we don't call it too often.
-  if (__lsan_do_recoverable_leak_check()) {  // Leak is found, report it.
+  if (EF->__lsan_do_recoverable_leak_check()) { // Leak is found, report it.
     if (DuringInitialCorpusExecution)
       Printf("\nINFO: a leak has been found in the initial corpus.\n\n");
     Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n");
     CurrentUnitSize = Size;
     DumpCurrentUnit("leak-");
     PrintFinalStats();
     _Exit(Options.ErrorExitCode);  // not exit() to disable lsan further on.
   }

llvm/trunk/lib/Fuzzer/FuzzerMutate.cpp

DefaultMutators.insert(
           {&MutationDispatcher::Mutate_AddWordFromManualDictionary,
            "AddFromManualDict"},
           {&MutationDispatcher::Mutate_AddWordFromTemporaryAutoDictionary,
            "AddFromTempAutoDict"},
           {&MutationDispatcher::Mutate_AddWordFromPersistentAutoDictionary,
            "AddFromPersAutoDict"},
       });
 
-  if (EF.LLVMFuzzerCustomMutator)
+  if (EF->LLVMFuzzerCustomMutator)
     Mutators.push_back({&MutationDispatcher::Mutate_Custom, "Custom"});
   else
     Mutators = DefaultMutators;
 
-  if (EF.LLVMFuzzerCustomCrossOver)
+  if (EF->LLVMFuzzerCustomCrossOver)
     Mutators.push_back(
         {&MutationDispatcher::Mutate_CustomCrossOver, "CustomCrossOver"});
 }
 
 static char FlipRandomBit(char X, Random &Rand) {
   int Bit = Rand(8);
   char Mask = 1 << Bit;
   char R;
   if (X & (1 << Bit))
     R = X & ~Mask;
   else
     R = X | Mask;
   assert(R != X);
   return R;
 }
 
 static char RandCh(Random &Rand) {
   if (Rand.RandBool()) return Rand(256);
   const char *Special = "!*'();:@&=+$,/?%#[]123ABCxyz-`~.";
   return Special[Rand(sizeof(Special) - 1)];
 }
 
 size_t MutationDispatcher::Mutate_Custom(uint8_t *Data, size_t Size,
                                          size_t MaxSize) {
-  return EF.LLVMFuzzerCustomMutator(Data, Size, MaxSize, Rand.Rand());
+  return EF->LLVMFuzzerCustomMutator(Data, Size, MaxSize, Rand.Rand());
 }
 
 size_t MutationDispatcher::Mutate_CustomCrossOver(uint8_t *Data, size_t Size,
                                                   size_t MaxSize) {
   if (!Corpus || Corpus->size() < 2 || Size == 0)
     return 0;
   size_t Idx = Rand(Corpus->size());
   const Unit &Other = (*Corpus)[Idx];
   if (Other.empty())
     return 0;
   MutateInPlaceHere.resize(MaxSize);
   auto &U = MutateInPlaceHere;
-  size_t NewSize = EF.LLVMFuzzerCustomCrossOver(
+  size_t NewSize = EF->LLVMFuzzerCustomCrossOver(
       Data, Size, Other.data(), Other.size(), U.data(), U.size(), Rand.Rand());
   if (!NewSize)
     return 0;
   assert(NewSize <= MaxSize && "CustomCrossOver returned overisized unit");
   memcpy(Data, U.data(), NewSize);
   return NewSize;
 }
 

llvm/trunk/lib/Fuzzer/test/FuzzerUnittest.cpp

 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 
 #include "FuzzerInternal.h"
 #include "gtest/gtest.h"
+#include <memory>
 #include <set>
 
 using namespace fuzzer;
 
 // For now, have LLVMFuzzerTestOneInput just to make it link.
 // Later we may want to make unittests that actually call LLVMFuzzerTestOneInput.
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
   abort();
 }
 
 TEST(Fuzzer, CrossOver) {
+  std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
+  fuzzer::EF = t.get();
   Random Rand(0);
   MutationDispatcher MD(Rand);
   Unit A({0, 1, 2}), B({5, 6, 7});
   Unit C;
   Unit Expected[] = {
        { 0 },
        { 0, 1 },
        { 0, 5 },
TEST(Fuzzer, Hash) {
   U.push_back('d');
   EXPECT_EQ("81fe8bfe87576c3ecb22426f8e57847382917acf", fuzzer::Hash(U));
 }
 
 typedef size_t (MutationDispatcher::*Mutator)(uint8_t *Data, size_t Size,
                                               size_t MaxSize);
 
 void TestEraseByte(Mutator M, int NumIter) {
+  std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
+  fuzzer::EF = t.get();
   uint8_t REM0[8] = {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
   uint8_t REM1[8] = {0x00, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
   uint8_t REM2[8] = {0x00, 0x11, 0x33, 0x44, 0x55, 0x66, 0x77};
   uint8_t REM3[8] = {0x00, 0x11, 0x22, 0x44, 0x55, 0x66, 0x77};
   uint8_t REM4[8] = {0x00, 0x11, 0x22, 0x33, 0x55, 0x66, 0x77};
   uint8_t REM5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x66, 0x77};
   uint8_t REM6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x77};
   uint8_t REM7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66};

 TEST(FuzzerMutate, EraseByte1) {
   TestEraseByte(&MutationDispatcher::Mutate_EraseByte, 100);
 }
 TEST(FuzzerMutate, EraseByte2) {
   TestEraseByte(&MutationDispatcher::Mutate, 1000);
 }
 
 void TestInsertByte(Mutator M, int NumIter) {
+  std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
+  fuzzer::EF = t.get();
   Random Rand(0);
   MutationDispatcher MD(Rand);
   int FoundMask = 0;
   uint8_t INS0[8] = {0xF1, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66};
   uint8_t INS1[8] = {0x00, 0xF2, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66};
   uint8_t INS2[8] = {0x00, 0x11, 0xF3, 0x22, 0x33, 0x44, 0x55, 0x66};
   uint8_t INS3[8] = {0x00, 0x11, 0x22, 0xF4, 0x33, 0x44, 0x55, 0x66};
   uint8_t INS4[8] = {0x00, 0x11, 0x22, 0x33, 0xF5, 0x44, 0x55, 0x66};

 TEST(FuzzerMutate, InsertByte1) {
   TestInsertByte(&MutationDispatcher::Mutate_InsertByte, 1 << 15);
 }
 TEST(FuzzerMutate, InsertByte2) {
   TestInsertByte(&MutationDispatcher::Mutate, 1 << 17);
 }
 
 void TestChangeByte(Mutator M, int NumIter) {
+  std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
+  fuzzer::EF = t.get();
   Random Rand(0);
   MutationDispatcher MD(Rand);
   int FoundMask = 0;
   uint8_t CH0[8] = {0xF0, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
   uint8_t CH1[8] = {0x00, 0xF1, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
   uint8_t CH2[8] = {0x00, 0x11, 0xF2, 0x33, 0x44, 0x55, 0x66, 0x77};
   uint8_t CH3[8] = {0x00, 0x11, 0x22, 0xF3, 0x44, 0x55, 0x66, 0x77};
   uint8_t CH4[8] = {0x00, 0x11, 0x22, 0x33, 0xF4, 0x55, 0x66, 0x77};

 TEST(FuzzerMutate, ChangeByte1) {
   TestChangeByte(&MutationDispatcher::Mutate_ChangeByte, 1 << 15);
 }
 TEST(FuzzerMutate, ChangeByte2) {
   TestChangeByte(&MutationDispatcher::Mutate, 1 << 17);
 }
 
 void TestChangeBit(Mutator M, int NumIter) {
+  std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
+  fuzzer::EF = t.get();
   Random Rand(0);
   MutationDispatcher MD(Rand);
   int FoundMask = 0;
   uint8_t CH0[8] = {0x01, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
   uint8_t CH1[8] = {0x00, 0x13, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
   uint8_t CH2[8] = {0x00, 0x11, 0x02, 0x33, 0x44, 0x55, 0x66, 0x77};
   uint8_t CH3[8] = {0x00, 0x11, 0x22, 0x37, 0x44, 0x55, 0x66, 0x77};
   uint8_t CH4[8] = {0x00, 0x11, 0x22, 0x33, 0x54, 0x55, 0x66, 0x77};

 TEST(FuzzerMutate, ChangeBit1) {
   TestChangeBit(&MutationDispatcher::Mutate_ChangeBit, 1 << 16);
 }
 TEST(FuzzerMutate, ChangeBit2) {
   TestChangeBit(&MutationDispatcher::Mutate, 1 << 18);
 }
 
 void TestShuffleBytes(Mutator M, int NumIter) {
+  std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
+  fuzzer::EF = t.get();
   Random Rand(0);
   MutationDispatcher MD(Rand);
   int FoundMask = 0;
   uint8_t CH0[7] = {0x00, 0x22, 0x11, 0x33, 0x44, 0x55, 0x66};
   uint8_t CH1[7] = {0x11, 0x00, 0x33, 0x22, 0x44, 0x55, 0x66};
   uint8_t CH2[7] = {0x00, 0x33, 0x11, 0x22, 0x44, 0x55, 0x66};
   uint8_t CH3[7] = {0x00, 0x11, 0x22, 0x44, 0x55, 0x66, 0x33};
   uint8_t CH4[7] = {0x00, 0x11, 0x22, 0x33, 0x55, 0x44, 0x66};

 TEST(FuzzerMutate, ShuffleBytes1) {
   TestShuffleBytes(&MutationDispatcher::Mutate_ShuffleBytes, 1 << 16);
 }
 TEST(FuzzerMutate, ShuffleBytes2) {
   TestShuffleBytes(&MutationDispatcher::Mutate, 1 << 19);
 }
 
 void TestAddWordFromDictionary(Mutator M, int NumIter) {
+  std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
+  fuzzer::EF = t.get();
   Random Rand(0);
   MutationDispatcher MD(Rand);
   uint8_t Word1[4] = {0xAA, 0xBB, 0xCC, 0xDD};
   uint8_t Word2[3] = {0xFF, 0xEE, 0xEF};
   MD.AddWordToManualDictionary(Word(Word1, sizeof(Word1)));
   MD.AddWordToManualDictionary(Word(Word2, sizeof(Word2)));
   int FoundMask = 0;
   uint8_t CH0[7] = {0x00, 0x11, 0x22, 0xAA, 0xBB, 0xCC, 0xDD};
TestAddWordFromDictionary(
       &MutationDispatcher::Mutate_AddWordFromManualDictionary, 1 << 15);
 }
 
 TEST(FuzzerMutate, AddWordFromDictionary2) {
   TestAddWordFromDictionary(&MutationDispatcher::Mutate, 1 << 15);
 }
 
 void TestAddWordFromDictionaryWithHint(Mutator M, int NumIter) {
+  std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
+  fuzzer::EF = t.get();
   Random Rand(0);
   MutationDispatcher MD(Rand);
   uint8_t W[] = {0xAA, 0xBB, 0xCC, 0xDD, 0xFF, 0xEE, 0xEF};
   size_t PosHint = 7777;
   MD.AddWordToAutoDictionary(Word(W, sizeof(W)), PosHint);
   int FoundMask = 0;
   for (int i = 0; i < NumIter; i++) {
     uint8_t T[10000];
TestAddWordFromDictionaryWithHint(
       &MutationDispatcher::Mutate_AddWordFromTemporaryAutoDictionary, 1 << 5);
 }
 
 TEST(FuzzerMutate, AddWordFromDictionaryWithHint2) {
   TestAddWordFromDictionaryWithHint(&MutationDispatcher::Mutate, 1 << 10);
 }
 
 void TestChangeASCIIInteger(Mutator M, int NumIter) {
+  std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
+  fuzzer::EF = t.get();
   Random Rand(0);
   MutationDispatcher MD(Rand);
 
   uint8_t CH0[8] = {'1', '2', '3', '4', '5', '6', '7', '7'};
   uint8_t CH1[8] = {'1', '2', '3', '4', '5', '6', '7', '9'};
   uint8_t CH2[8] = {'2', '4', '6', '9', '1', '3', '5', '6'};
   uint8_t CH3[8] = {'0', '6', '1', '7', '2', '8', '3', '9'};
   int FoundMask = 0;
TEST(FuzzerUtil, Base64) {
   EXPECT_EQ("YWJj", Base64({'a', 'b', 'c'}));
   EXPECT_EQ("eHl6", Base64({'x', 'y', 'z'}));
   EXPECT_EQ("YWJjeA==", Base64({'a', 'b', 'c', 'x'}));
   EXPECT_EQ("YWJjeHk=", Base64({'a', 'b', 'c', 'x', 'y'}));
   EXPECT_EQ("YWJjeHl6", Base64({'a', 'b', 'c', 'x', 'y', 'z'}));
 }
 
 TEST(Corpus, Distribution) {
+  std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
+  fuzzer::EF = t.get();
   Random Rand(0);
   MutationDispatcher MD(Rand);
   Fuzzer::FuzzingOptions Options;
   Fuzzer Fuzz(LLVMFuzzerTestOneInput, MD, Options);
   size_t N = 10;
   size_t TriesPerUnit = 1<<20;
   for (size_t i = 0; i < N; i++) {
     Fuzz.AddToCorpus(Unit{ static_cast<uint8_t>(i) });