[libFuzzer] Add deep recursion test.

[morehouse]

Summary

• Test that libFuzzer uses -fsanitize-coverage=stack-depth instrumentation when present.
• Fix a bug that caused InitialStack to change every time ExecuteCallback was called.
• Make stack-depth-guided fuzzing work without compiling libFuzzer with -fsanitize-coverage=stack-depth.

[kcc]

Please update the patch to reflect the new code location.

[kcc]

never mind, I've made a different change: r311421.

This one is not exactly correct: we should reset __sancov_lowest_stack on every run.

llvm/lib/Fuzzer/FuzzerTracePC.h

private:
   size_t NumPCsInPCTables;
 
   uint8_t *Counters() const;
   uintptr_t *PCs() const;
 
   std::set<uintptr_t> ObservedPCs;
 
   ValueBitMap ValueProfileMap;
-  uintptr_t InitialStack;
+  uintptr_t InitialStack = 0;
 };
 
 template <class Callback>
 // void Callback(size_t FirstFeature, size_t Idx, uint8_t Value);
 ATTRIBUTE_NO_SANITIZE_ALL
 void ForEachNonZeroByte(const uint8_t *Begin, const uint8_t *End,
                         size_t FirstFeature, Callback Handle8bitCounter) {
   typedef uintptr_t LargeType;

llvm/lib/Fuzzer/FuzzerTracePC.cpp

 // experiments with inlined instrumentation.
 alignas(64) ATTRIBUTE_INTERFACE
 uint8_t __sancov_trace_pc_guard_8bit_counters[fuzzer::TracePC::kNumPCs];
 
 ATTRIBUTE_INTERFACE
 uintptr_t __sancov_trace_pc_pcs[fuzzer::TracePC::kNumPCs];
 
 // Used by -fsanitize-coverage=stack-depth to track stack depth
-ATTRIBUTE_INTERFACE thread_local uintptr_t __sancov_lowest_stack;
+ATTRIBUTE_INTERFACE thread_local uintptr_t __sancov_lowest_stack = UINTPTR_MAX;
 
 namespace fuzzer {
 
 TracePC TPC;
 
 int ScopedDoingMyOwnMemOrStr::DoingMyOwnMemOrStr;
 
 uint8_t *TracePC::Counters() const {
void TracePC::ClearInlineCounters() {
   for (size_t i = 0; i < NumModulesWithInline8bitCounters; i++) {
     uint8_t *Beg = ModuleCounters[i].Start;
     size_t Size = ModuleCounters[i].Stop - Beg;
     memset(Beg, 0, Size);
   }
 }
 
 void TracePC::RecordInitialStack() {
+  if (InitialStack == 0)
     InitialStack = __sancov_lowest_stack;
 }
 
 uintptr_t TracePC::GetMaxStackOffset() const {
   return InitialStack - __sancov_lowest_stack;  // Stack grows down
 }
 
 } // namespace fuzzer
 

llvm/lib/Fuzzer/test/deep-recursion.test

+RUN: %cpp_compiler -fsanitize-coverage=stack-depth %S/DeepRecursionTest.cpp \
+RUN:     -o %t
+RUN: not %t -seed=1 -runs=100000000 2>&1 | FileCheck %s
+CHECK: ERROR: libFuzzer: deadly signal