[sanitizers] trace buffer API to use user-allocated buffer.

[aizatsky]

nits

[vitalybuka]

LGTM

lib/Fuzzer/FuzzerLoop.cpp

59

explicit?

141

defaults inline here?

[aizatsky]

lib/Fuzzer/FuzzerLoop.cpp

141

not sure what you mean here.

[aizatsky]

review

[aizatsky]

reviewreviewreviewreview

[aizatsky]

lib/Fuzzer/FuzzerLoop.cpp

141

done.

lib/Fuzzer/FuzzerExtFunctions.def

EXT_FUNC(LLVMFuzzerCustomCrossOver, size_t,
           const uint8_t * Data2, size_t Size2,
           uint8_t * Out, size_t MaxOutSize, unsigned int Seed),
          false);
 
 // Sanitizer functions
 EXT_FUNC(__lsan_enable, void, (), false);
 EXT_FUNC(__lsan_disable, void, (), false);
 EXT_FUNC(__lsan_do_recoverable_leak_check, int, (), false);
-EXT_FUNC(__sanitizer_get_coverage_pc_buffer, uintptr_t, (uintptr_t**), true);
+EXT_FUNC(__sanitizer_set_coverage_pc_buffer, void, (uintptr_t*, uintptr_t), true);
+EXT_FUNC(__sanitizer_get_coverage_pc_buffer_pos, uintptr_t, (), true);
 EXT_FUNC(__sanitizer_get_number_of_counters, size_t, (), false);
 EXT_FUNC(__sanitizer_install_malloc_and_free_hooks, int,
          (void (*malloc_hook)(const volatile void *, size_t),
           void (*free_hook)(const volatile void *)),
          false);
 EXT_FUNC(__sanitizer_get_total_unique_caller_callee_pairs, size_t, (), false);
 EXT_FUNC(__sanitizer_get_total_unique_coverage, size_t, (), true);
 EXT_FUNC(__sanitizer_print_memory_profile, int, (size_t), false);
 EXT_FUNC(__sanitizer_print_stack_trace, void, (), true);
 EXT_FUNC(__sanitizer_reset_coverage, void, (), true);
 EXT_FUNC(__sanitizer_set_death_callback, void, (void (*)(void)), true);
 EXT_FUNC(__sanitizer_set_report_fd, void, (void*), false);
 EXT_FUNC(__sanitizer_update_counter_bitset_and_clear_counters, uintptr_t,
   (uint8_t*), false);

lib/Fuzzer/FuzzerInternal.h

 
 #include <algorithm>
 #include <atomic>
 #include <cassert>
 #include <chrono>
 #include <climits>
 #include <cstddef>
 #include <cstdlib>
+#include <memory>
 #include <random>
 #include <string.h>
 #include <string>
 #include <unordered_set>
 #include <vector>
 
 #include "FuzzerExtFunctions.h"
 #include "FuzzerInterface.h"
private:
   std::vector<DictionaryEntry *> CurrentDictionaryEntrySequence;
   const std::vector<Unit> *Corpus = nullptr;
   std::vector<uint8_t> MutateInPlaceHere;
 
   std::vector<Mutator> Mutators;
   std::vector<Mutator> DefaultMutators;
 };
 
+class CoverageController;
+
 class Fuzzer {
 public:
 
   // Aggregates all available coverage measurements.
   struct Coverage {
     Coverage() { Reset(); }
 
     void Reset() {
       BlockCoverage = 0;
       CallerCalleeCoverage = 0;
       PcMapBits = 0;
       CounterBitmapBits = 0;
-      PcBufferLen = 0;
       CounterBitmap.clear();
       PCMap.Reset();
+      PcBufferPos = 0;
     }
 
     std::string DebugString() const;
 
     size_t BlockCoverage;
     size_t CallerCalleeCoverage;
 
-    size_t PcBufferLen;
+    size_t PcBufferPos;
+
     // Precalculated number of bits in CounterBitmap.
     size_t CounterBitmapBits;
     std::vector<uint8_t> CounterBitmap;
     // Precalculated number of bits in PCMap.
     size_t PcMapBits;
     PcCoverageMap PCMap;
   };
 
   Fuzzer(UserCallback CB, MutationDispatcher &MD, FuzzingOptions Options);
+  ~Fuzzer();
   void AddToCorpus(const Unit &U) {
     Corpus.push_back(U);
     UpdateCorpusDistribution();
   }
   size_t ChooseUnitIdxToMutate();
   const Unit &ChooseUnitToMutate() { return Corpus[ChooseUnitIdxToMutate()]; };
   void TruncateUnits(std::vector<Unit> *NewCorpus);
   void Loop();
private:
   FuzzingOptions Options;
   system_clock::time_point ProcessStartTime = system_clock::now();
   system_clock::time_point UnitStartTime;
   long TimeOfLongestUnitInSeconds = 0;
   long EpochOfLastReadOfOutputCorpus = 0;
 
   // Maximum recorded coverage.
   Coverage MaxCoverage;
+  std::unique_ptr<CoverageController> CController;
 
   // Need to know our own thread.
   static thread_local bool IsMyThread;
 };
 
 // Global interface to functions that may or may not be available.
 extern ExternalFunctions *EF;
 
 }; // namespace fuzzer
 
 #endif // LLVM_FUZZER_INTERNAL_H

lib/Fuzzer/FuzzerLoop.cpp

#define CHECK_EXTERNAL_FUNCTION(fn)                                            \
   do {                                                                         \
     if (!(EF->fn))                                                             \
       MissingExternalApiFunction(#fn);                                         \
   } while (false)
 
 // Only one Fuzzer per process.
 static Fuzzer *F;
 
-struct CoverageController {
-  static void Reset() {
+// Only one CoverageController per process should be created.
+class CoverageController {
+ public:
+  CoverageController(const FuzzingOptions &Options) 
+    : Options(Options), PcBuffer(nullptr), PcBufferLen(0) {
+    if (Options.PrintNewCovPcs) {
+      PcBufferLen = 1 << 24;
+      PcBuffer = new uintptr_t[PcBufferLen];
+      EF->__sanitizer_set_coverage_pc_buffer(PcBuffer, PcBufferLen);
+    }
+  }
+
+  uintptr_t* pc_buffer() const { return PcBuffer; }
+
+  void Reset() {
     CHECK_EXTERNAL_FUNCTION(__sanitizer_reset_coverage);
     EF->__sanitizer_reset_coverage();
     PcMapResetCurrent();
   }
 
-  static void ResetCounters(const FuzzingOptions &Options) {
+  void ResetCounters() {
     if (Options.UseCounters) {
       EF->__sanitizer_update_counter_bitset_and_clear_counters(0);
     }
   }
 
-  static void Prepare(const FuzzingOptions &Options, Fuzzer::Coverage *C) {
+  void Prepare(Fuzzer::Coverage *C) {
     if (Options.UseCounters) {
       size_t NumCounters = EF->__sanitizer_get_number_of_counters();
       C->CounterBitmap.resize(NumCounters);
     }
   }
 
   // Records data to a maximum coverage tracker. Returns true if additional
   // coverage was discovered.
-  static bool RecordMax(const FuzzingOptions &Options, Fuzzer::Coverage *C) {
+  bool RecordMax(Fuzzer::Coverage *C) {
     bool Res = false;
 
     uint64_t NewBlockCoverage = EF->__sanitizer_get_total_unique_coverage();
     if (NewBlockCoverage > C->BlockCoverage) {
       Res = true;
       C->BlockCoverage = NewBlockCoverage;
     }
 
bool RecordMax(Fuzzer::Coverage *C) {
     }
 
     uint64_t NewPcMapBits = PcMapMergeInto(&C->PCMap);
     if (NewPcMapBits > C->PcMapBits) {
       Res = true;
       C->PcMapBits = NewPcMapBits;
     }
 
-    uintptr_t *CoverageBuf;
-    uint64_t NewPcBufferLen =
-        EF->__sanitizer_get_coverage_pc_buffer(&CoverageBuf);
-    if (NewPcBufferLen > C->PcBufferLen) {
+    uint64_t NewPcBufferPos = EF->__sanitizer_get_coverage_pc_buffer_pos();
+    if (NewPcBufferPos > C->PcBufferPos) {
       Res = true;
-      C->PcBufferLen = NewPcBufferLen;
+      C->PcBufferPos = NewPcBufferPos;
+    }
+
+    if (NewPcBufferPos >= PcBufferLen) {
+      Printf("ERROR: PC buffer overflow.\n");
     }
 
     return Res;
   }
+
+
+ private:
+  const FuzzingOptions Options;
+  uintptr_t* PcBuffer;
+  size_t PcBufferLen;
 };
 
 // Leak detection is expensive, so we first check if there were more mallocs
 // than frees (using the sanitizer malloc hooks) and only then try to call lsan.
 struct MallocFreeTracer {
   void Start() {
     Mallocs = 0;
     Frees = 0;

 void MallocHook(const volatile void *ptr, size_t size) {
   AllocTracer.Mallocs++;
 }
 void FreeHook(const volatile void *ptr) {
   AllocTracer.Frees++;
 }
 
 Fuzzer::Fuzzer(UserCallback CB, MutationDispatcher &MD, FuzzingOptions Options)
-    : CB(CB), MD(MD), Options(Options) {
+    : CB(CB), MD(MD), Options(Options),
+      CController(new CoverageController(Options)) {
   SetDeathCallback();
   InitializeTraceState();
   assert(!F);
   F = this;
   ResetCoverage();
   IsMyThread = true;
   if (Options.DetectLeaks && EF->__sanitizer_install_malloc_and_free_hooks)
     EF->__sanitizer_install_malloc_and_free_hooks(MallocHook, FreeHook);
 }
 
+Fuzzer::~Fuzzer() { }
+
 void Fuzzer::LazyAllocateCurrentUnitData() {
   if (CurrentUnitData || Options.MaxLen == 0) return;
   CurrentUnitData = new uint8_t[Options.MaxLen];
 }
 
 void Fuzzer::SetDeathCallback() {
   CHECK_EXTERNAL_FUNCTION(__sanitizer_set_death_callback);
   EF->__sanitizer_set_death_callback(StaticDeathCallback);
void Fuzzer::ShuffleAndMinimize() {
   if (Corpus.empty()) {
     Printf("ERROR: no interesting inputs were found. "
            "Is the code instrumented for coverage? Exiting.\n");
     exit(1);
   }
 }
 
 bool Fuzzer::UpdateMaxCoverage() {
-  uintptr_t PrevBufferLen = MaxCoverage.PcBufferLen;
-  bool Res = CoverageController::RecordMax(Options, &MaxCoverage);
+  uintptr_t PrevPcBufferPos = MaxCoverage.PcBufferPos;
+  bool Res = CController->RecordMax(&MaxCoverage);
 
-  if (Options.PrintNewCovPcs && PrevBufferLen != MaxCoverage.PcBufferLen) {
-    uintptr_t *CoverageBuf;
-    EF->__sanitizer_get_coverage_pc_buffer(&CoverageBuf);
-    assert(CoverageBuf);
-    for (size_t I = PrevBufferLen; I < MaxCoverage.PcBufferLen; ++I) {
-      Printf("%p\n", CoverageBuf[I]);
+  if (Options.PrintNewCovPcs && PrevPcBufferPos != MaxCoverage.PcBufferPos) {
+    uintptr_t* PcBuffer = CController->pc_buffer();
+    for (size_t I = PrevPcBufferPos; I < MaxCoverage.PcBufferPos; ++I) {
+      Printf("%p\n", PcBuffer[I]);
     }
   }
 
   return Res;
 }
 
 bool Fuzzer::RunOne(const uint8_t *Data, size_t Size) {
   TotalNumberOfRuns++;
 
   // TODO(aizatsky): this Reset call seems to be not needed.
-  CoverageController::ResetCounters(Options);
+  CController->ResetCounters();
   ExecuteCallback(Data, Size);
   bool Res = UpdateMaxCoverage();
 
   auto UnitStopTime = system_clock::now();
   auto TimeOfUnit =
       duration_cast<seconds>(UnitStopTime - UnitStartTime).count();
   if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) &&
       secondsSinceProcessStartUp() >= 2)

 size_t Fuzzer::ChooseUnitIdxToMutate() {
   size_t Idx =
       static_cast<size_t>(CorpusDistribution(MD.GetRand().Get_mt19937()));
   assert(Idx < Corpus.size());
   return Idx;
 }
 
 void Fuzzer::ResetCoverage() {
-  CoverageController::Reset();
+  CController->Reset();
   MaxCoverage.Reset();
-  CoverageController::Prepare(Options, &MaxCoverage);
+  CController->Prepare(&MaxCoverage);
 }
 
 // Experimental search heuristic: drilling.
 // - Read, shuffle, execute and minimize the corpus.
 // - Choose one random unit.
 // - Reset the coverage.
 // - Start fuzzing as if the chosen unit was the only element of the corpus.
 // - When done, reset the coverage again.