[clang-fuzzer] Allow building without coverage instrumentation.

[morehouse]

Summary

Compile with DummyClangFuzzer.cpp as entry point rather than
libFuzzer's main when coverage instrumentation is missing.

https://llvm.org/pr34314

[kcc]

It's not about coverage instrumentation (not) being present, but about libFuzzer's main() being present, right?
Will we be able to reuse some of Justin's code instead of creating one more main() function?
Or, why not link with libFuzzer (-fsanitize=fuzzer at link time) even if we don't us einstrumentation at compile time?

[morehouse]

In D38642#890963, @kcc wrote:

It's not about coverage instrumentation (not) being present, but about libFuzzer's main() being present, right?

Yes.

Will we be able to reuse some of Justin's code instead of creating one more main() function?

This reuses the code that Justin moved to FuzzMutate/FuzzerCLI. That's why the main is so short. But perhaps we could move the main itself into FuzzerCLI?

Or, why not link with libFuzzer (-fsanitize=fuzzer at link time) even if we don't us einstrumentation at compile time?

When I tried this, I got undefined references to all kinds of __sanitizer_cov_* symbols.

[kcc]

Will we be able to reuse some of Justin's code instead of creating one more main() function?

This reuses the code that Justin moved to FuzzMutate/FuzzerCLI. That's why the main is so short. But perhaps we could move the main itself into FuzzerCLI?

Yes, having one common main makes sense, but see below.

Or, why not link with libFuzzer (-fsanitize=fuzzer at link time) even if we don't us einstrumentation at compile time?

When I tried this, I got undefined references to all kinds of __sanitizer_cov_* symbols.

I'd like to know more.
At least simple cases work fine:

clang++ ~/llvm/projects/compiler-rt/test/fuzzer/SimpleTest.cpp -std=c++11  -c && clang++ SimpleTest.o -fsanitize=fuzzer

[morehouse]

In D38642#890969, @kcc wrote:

I'd like to know more.
At least simple cases work fine:

You're right. I was trying to add -fsanitize=fuzzer to CMAKE_CXX_FLAGS right before the link command, which was causing a later compilation to give the error. Setting CMAKE_EXE_LINKER_FLAGS seems to work though.

This seems simpler and cleaner than the approach @bogner took.

[kcc]

We often suggest to code owners to implement their own dummy main to run fuzz targets as regression tests.
But for ourselves (LLVM) this recommendations makes less sense since libFuzzer is part of LLVM and we can use it's main directly.

[morehouse]

• Remove dummy main and link with -fsantize=fuzzer.

[kcc]

grrr. I am sorry, I've just contradicted myself. :(
The goal here is to build the fuzz targets always and use them as tests, which includes building with any toolchain, including toolchains that don't support -fsanitize=fuzzer....
your original change actually solved this.
If you can *easily* share main() with the one in LLVM -- do it, otherwise don't bother.

[morehouse]

• Revert "Remove dummy main and link with -fsantize=fuzzer."

[kcc]

conceptually ok, but please let Vitaly review the cmake part.

[morehouse]

In D38642#891074, @kcc wrote:

If you can *easily* share main() with the one in LLVM -- do it, otherwise don't bother.

Does the fuzzer main come from LLVM or compiler-rt now? There's still FuzzerMain.cpp in LLVM, but I'm not sure if we should be using that or not.

[kcc]

In D38642#891125, @morehouse wrote:

In D38642#891074, @kcc wrote:

If you can *easily* share main() with the one in LLVM -- do it, otherwise don't bother.

Does the fuzzer main come from LLVM or compiler-rt now? There's still FuzzerMain.cpp in LLVM, but I'm not sure if we should be using that or not.

Don't reuse FuzzerMain.cpp.
There is llvm/tools/llvm-isel-fuzzer/DummyISelFuzzer.cpp which your main() duplicates, but these are in different projects (llvm vs clang) so perhaps it's ok.

clang/tools/clang-fuzzer/CMakeLists.txt

-if( LLVM_USE_SANITIZE_COVERAGE )
-  set(LLVM_LINK_COMPONENTS ${LLVM_TARGETS_TO_BUILD})
-  set(CXX_FLAGS_NOFUZZ ${CMAKE_CXX_FLAGS})
+set(LLVM_LINK_COMPONENTS ${LLVM_TARGETS_TO_BUILD} FuzzMutate)
+set(DUMMY_MAIN DummyClangFuzzer.cpp)
+if(LLVM_USE_SANITIZE_COVERAGE)
   set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fsanitize=fuzzer")
+  unset(DUMMY_MAIN)
+endif()
+
+# Hack to bypass LLVM's cmake sources check and allow multiple libraries and
+# executables from this directory.
+set(LLVM_OPTIONAL_SOURCES
+  ClangFuzzer.cpp
+  DummyClangFuzzer.cpp
+  ExampleClangProtoFuzzer.cpp
+  )
 
-  if(CLANG_ENABLE_PROTO_FUZZER)
-    # Create protobuf .h and .cc files, and put them in a library for use by
-    # clang-proto-fuzzer components.
-    find_package(Protobuf REQUIRED)
-    add_definitions(-DGOOGLE_PROTOBUF_NO_RTTI)
-    include_directories(${PROTOBUF_INCLUDE_DIRS})
-    include_directories(${CMAKE_CURRENT_BINARY_DIR})
-    protobuf_generate_cpp(PROTO_SRCS PROTO_HDRS cxx_proto.proto)
-    # Hack to bypass LLVM's cmake sources check and allow multiple libraries and
-    # executables from this directory.
-    set(LLVM_OPTIONAL_SOURCES
-      ClangFuzzer.cpp
-      ExampleClangProtoFuzzer.cpp
-      ${PROTO_SRCS}
-      )
-    add_clang_library(clangCXXProto
-      ${PROTO_SRCS}
-      ${PROTO_HDRS}
+  set(LLVM_OPTIONAL_SOURCES ${LLVM_OPTIONAL_SOURCES} ${PROTO_SRCS})
 
-      LINK_LIBS
-      ${PROTOBUF_LIBRARIES}
-      )
 
-    # Build and include libprotobuf-mutator
-    include(ProtobufMutator)
-    include_directories(${ProtobufMutator_INCLUDE_DIRS})
 
-    # Build the protobuf->C++ translation library and driver.
-    add_clang_subdirectory(proto-to-cxx)
 
-    # Build the protobuf fuzzer
-    add_clang_executable(clang-proto-fuzzer ExampleClangProtoFuzzer.cpp)
-    target_link_libraries(clang-proto-fuzzer
-      ${ProtobufMutator_LIBRARIES}
-      clangCXXProto
-      clangHandleCXX
-      clangProtoToCXX
-      )
-  else()
-    # Hack to bypass LLVM's cmake sources check and allow multiple libraries and
-    # executables from this directory.
-    set(LLVM_OPTIONAL_SOURCES ClangFuzzer.cpp ExampleClangProtoFuzzer.cpp)
-  endif()
+  add_clang_executable(clang-proto-fuzzer
+    ${DUMMY_MAIN}
+    ExampleClangProtoFuzzer.cpp
+    )
+
 
-  add_clang_subdirectory(handle-cxx)
 
-  add_clang_executable(clang-fuzzer
-    EXCLUDE_FROM_ALL
-    ClangFuzzer.cpp
-    )
+  ${DUMMY_MAIN}
 
-  target_link_libraries(clang-fuzzer
-    clangHandleCXX
-    )
-endif()

clang/tools/clang-fuzzer/ClangFuzzer.cpp

 ///  input. This function is then linked into the Fuzzer library.
 ///
 //===----------------------------------------------------------------------===//
 
 #include "handle-cxx/handle_cxx.h"
 
 using namespace clang_fuzzer;
 
+extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) { return 0; }
+
 extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
   std::string s((const char *)data, size);
   HandleCXX(s, {"-O2"});
   return 0;
 }

clang/tools/clang-fuzzer/DummyClangFuzzer.cpp

+//===-- DummyClangFuzzer.cpp - Entry point to sanity check fuzzers --------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// Provides a main() to build without linking libFuzzer.
+//
+//===----------------------------------------------------------------------===//
+#include "llvm/FuzzMutate/FuzzerCLI.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
+extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv);
+
+int main(int argc, char *argv[]) {
+  return llvm::runFuzzerOnInputs(argc, argv, LLVMFuzzerTestOneInput,
+                                 LLVMFuzzerInitialize);
+}