[libFuzzer] Ignore synthetic exceptions on Fuchsia

[aarongreen]

Summary

Fuchsia has several exceptions which are merely informational and should not be treated as crashes. This patch puts logic that read from the exception port and handled the exception in a loop, and ignores non-exceptions and informational exceptions.

[mcgrathr]

lgtm with one nit: either change to an assert or improve the comment to clarify what other cases are expected

compiler-rt/lib/fuzzer/FuzzerUtilFuchsia.cpp

244 ↗

(On Diff #200623)

I think !ZX_PKT_IS_EXCEPTION here is unexpected and would indicate a bug.
There should be no packets received except the ones you've asked for.
Probably you should just assert that it is.

[aarongreen]

Address mcgrathr's nit.

compiler-rt/trunk/lib/fuzzer/FuzzerUtilFuchsia.cpp

 //===- FuzzerUtilFuchsia.cpp - Misc utils for Fuchsia. --------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 // Misc utils implementation using Fuchsia/Zircon APIs.
 //===----------------------------------------------------------------------===//
 #include "FuzzerDefs.h"
 
 #if LIBFUZZER_FUCHSIA
 
 #include "FuzzerInternal.h"
 #include "FuzzerUtil.h"
+#include <cassert>
 #include <cerrno>
 #include <cinttypes>
 #include <cstdint>
 #include <fcntl.h>
 #include <lib/fdio/spawn.h>
 #include <string>
 #include <sys/select.h>
 #include <thread>
void CrashHandler(zx_handle_t *Event) {
 
   ExitOnErr(_zx_task_bind_exception_port(Self, Port.Handle, kFuzzingCrash,
                                          ZX_EXCEPTION_PORT_DEBUGGER),
             "_zx_task_bind_exception_port");
 
   ExitOnErr(_zx_object_signal(*Event, 0, ZX_USER_SIGNAL_0),
             "_zx_object_signal");
 
+  // This thread lives as long as the process in order to keep handling
+  // crashes.  In practice, the first crashed thread to reach the end of the
+  // StaticCrashHandler will end the process.
+  while (true) {
     zx_port_packet_t Packet;
     ExitOnErr(_zx_port_wait(Port.Handle, ZX_TIME_INFINITE, &Packet),
               "_zx_port_wait");
 
+    // Ignore informational synthetic exceptions.
+    assert(ZX_PKT_IS_EXCEPTION(Packet.type));
+    if (ZX_EXCP_THREAD_STARTING == Packet.type ||
+        ZX_EXCP_THREAD_EXITING == Packet.type ||
+        ZX_EXCP_PROCESS_STARTING == Packet.type) {
+      continue;
+    }
+
     // At this point, we want to get the state of the crashing thread, but
-  // libFuzzer and the sanitizers assume this will happen from that same thread
-  // via a POSIX signal handler. "Resurrecting" the thread in the middle of the
-  // appropriate callback is as simple as forcibly setting the instruction
-  // pointer/program counter, provided we NEVER EVER return from that function
-  // (since otherwise our stack will not be valid).
+    // libFuzzer and the sanitizers assume this will happen from that same
+    // thread via a POSIX signal handler. "Resurrecting" the thread in the
+    // middle of the appropriate callback is as simple as forcibly setting the
+    // instruction pointer/program counter, provided we NEVER EVER return from
+    // that function (since otherwise our stack will not be valid).
     ScopedHandle Thread;
     ExitOnErr(_zx_object_get_child(Self, Packet.exception.tid,
                                    ZX_RIGHT_SAME_RIGHTS, &Thread.Handle),
               "_zx_object_get_child");
 
     zx_thread_state_general_regs_t GeneralRegisters;
     ExitOnErr(_zx_thread_read_state(Thread.Handle, ZX_THREAD_STATE_GENERAL_REGS,
-                                  &GeneralRegisters, sizeof(GeneralRegisters)),
+                                    &GeneralRegisters,
+                                    sizeof(GeneralRegisters)),
               "_zx_thread_read_state");
 
     // To unwind properly, we need to push the crashing thread's register state
     // onto the stack and jump into a trampoline with CFI instructions on how
     // to restore it.
 #if defined(__x86_64__)
     uintptr_t StackPtr =
         (GeneralRegisters.rsp - (128 + sizeof(GeneralRegisters))) &
         -(uintptr_t)16;
     __unsanitized_memcpy(reinterpret_cast<void *>(StackPtr), &GeneralRegisters,
                          sizeof(GeneralRegisters));
     GeneralRegisters.rsp = StackPtr;
     GeneralRegisters.rip = reinterpret_cast<zx_vaddr_t>(CrashTrampolineAsm);
 
 #elif defined(__aarch64__)
     uintptr_t StackPtr =
         (GeneralRegisters.sp - sizeof(GeneralRegisters)) & -(uintptr_t)16;
     __unsanitized_memcpy(reinterpret_cast<void *>(StackPtr), &GeneralRegisters,
                          sizeof(GeneralRegisters));
     GeneralRegisters.sp = StackPtr;
     GeneralRegisters.pc = reinterpret_cast<zx_vaddr_t>(CrashTrampolineAsm);
 
 #else
 #error "Unsupported architecture for fuzzing on Fuchsia"
 #endif
 
     // Now force the crashing thread's state.
-  ExitOnErr(_zx_thread_write_state(Thread.Handle, ZX_THREAD_STATE_GENERAL_REGS,
-                                   &GeneralRegisters, sizeof(GeneralRegisters)),
-            "_zx_thread_write_state");
+    ExitOnErr(
+        _zx_thread_write_state(Thread.Handle, ZX_THREAD_STATE_GENERAL_REGS,
 
     ExitOnErr(_zx_task_resume_from_exception(Thread.Handle, Port.Handle, 0),
               "_zx_task_resume_from_exception");
   }
+}
 
 } // namespace
 
 bool Mprotect(void *Ptr, size_t Size, bool AllowReadWrite) {
   return false;  // UNIMPLEMENTED
 }
 
 // Platform specific functions.