[libFuzzer] Migrate to the new exception syscalls on Fuchsia

[phosek]

Summary

This is part of the transition to the new Fuchsia exception syscalls
signature.

compiler-rt/lib/fuzzer/FuzzerUtilFuchsia.cpp

 #include <unistd.h>
 #include <zircon/errors.h>
 #include <zircon/process.h>
 #include <zircon/sanitizer.h>
 #include <zircon/status.h>
 #include <zircon/syscalls.h>
 #include <zircon/syscalls/debug.h>
 #include <zircon/syscalls/exception.h>
-#include <zircon/syscalls/port.h>
+#include <zircon/syscalls/object.h>
 #include <zircon/types.h>
 
 namespace fuzzer {
 
 // Given that Fuchsia doesn't have the POSIX signals that libFuzzer was written
 // around, the general approach is to spin up dedicated threads to watch for
 // each requested condition (alarm, interrupt, crash).  Of these, the crash
 // handler is the most involved, as it requires resuming the crashed thread in
 // order to invoke the sanitizers to get the needed state.
 
 // Forward declaration of assembly trampoline needed to resume crashed threads.
 // This appears to have external linkage to  C++, which is why it's not in the
 // anonymous namespace.  The assembly definition inside MakeTrampoline()
 // actually defines the symbol with internal linkage only.
 void CrashTrampolineAsm() __asm__("CrashTrampolineAsm");
 
 namespace {
 
-// A magic value for the Zircon exception port, chosen to spell 'FUZZING'
-// when interpreted as a byte sequence on little-endian platforms.
-const uint64_t kFuzzingCrash = 0x474e495a5a5546;
-
 // Helper function to handle Zircon syscall failures.
 void ExitOnErr(zx_status_t Status, const char *Syscall) {
   if (Status != ZX_OK) {
     Printf("libFuzzer: %s failed: %s\n", Syscall,
            _zx_status_get_string(Status));
     exit(1);
   }
 }

 void CrashHandler(zx_handle_t *Event) {
   // This structure is used to ensure we close handles to objects we create in
   // this handler.
   struct ScopedHandle {
     ~ScopedHandle() { _zx_handle_close(Handle); }
     zx_handle_t Handle = ZX_HANDLE_INVALID;
   };
 
-  // Create and bind the exception port.  We need to claim to be a "debugger" so
-  // the kernel will allow us to modify and resume dying threads (see below).
-  // Once the port is set, we can signal the main thread to continue and wait
+  // Create the exception channel.  We need to claim to be a "debugger" so the
+  // kernel will allow us to modify and resume dying threads (see below). Once
+  // the channel is set, we can signal the main thread to continue and wait
   // for the exception to arrive.
-  ScopedHandle Port;
-  ExitOnErr(_zx_port_create(0, &Port.Handle), "_zx_port_create");
+  ScopedHandle Channel;
   zx_handle_t Self = _zx_process_self();
-
-  ExitOnErr(_zx_task_bind_exception_port(Self, Port.Handle, kFuzzingCrash,
-                                         ZX_EXCEPTION_PORT_DEBUGGER),
-            "_zx_task_bind_exception_port");
+  ExitOnErr(_zx_task_create_exception_channel(
+                Self, ZX_EXCEPTION_CHANNEL_DEBUGGER, &Channel.Handle),
+            "_zx_task_create_exception_channel");
 
   ExitOnErr(_zx_object_signal(*Event, 0, ZX_USER_SIGNAL_0),
             "_zx_object_signal");
 
   // This thread lives as long as the process in order to keep handling
   // crashes.  In practice, the first crashed thread to reach the end of the
   // StaticCrashHandler will end the process.
   while (true) {
-    zx_port_packet_t Packet;
-    ExitOnErr(_zx_port_wait(Port.Handle, ZX_TIME_INFINITE, &Packet),
-              "_zx_port_wait");
+    ExitOnErr(_zx_object_wait_one(Channel.Handle, ZX_CHANNEL_READABLE,
+                                  ZX_TIME_INFINITE, nullptr),
+              "_zx_object_wait_one");
+
+    zx_exception_info_t ExceptionInfo;
+    ScopedHandle Exception;
+    ExitOnErr(_zx_channel_read(Channel.Handle, 0, &ExceptionInfo,
+                               &Exception.Handle, sizeof(ExceptionInfo), 1,
+                               nullptr, nullptr),
+              "_zx_channel_read");
 
     // Ignore informational synthetic exceptions.
-    assert(ZX_PKT_IS_EXCEPTION(Packet.type));
-    if (ZX_EXCP_THREAD_STARTING == Packet.type ||
-        ZX_EXCP_THREAD_EXITING == Packet.type ||
-        ZX_EXCP_PROCESS_STARTING == Packet.type) {
+    if (ZX_EXCP_THREAD_STARTING == ExceptionInfo.type ||
+        ZX_EXCP_THREAD_EXITING == ExceptionInfo.type ||
+        ZX_EXCP_PROCESS_STARTING == ExceptionInfo.type) {
       continue;
     }
 
     // At this point, we want to get the state of the crashing thread, but
     // libFuzzer and the sanitizers assume this will happen from that same
     // thread via a POSIX signal handler. "Resurrecting" the thread in the
     // middle of the appropriate callback is as simple as forcibly setting the
     // instruction pointer/program counter, provided we NEVER EVER return from
     // that function (since otherwise our stack will not be valid).
     ScopedHandle Thread;
-    ExitOnErr(_zx_object_get_child(Self, Packet.exception.tid,
-                                   ZX_RIGHT_SAME_RIGHTS, &Thread.Handle),
-              "_zx_object_get_child");
+    ExitOnErr(_zx_exception_get_thread(Exception, &Thread.Handle),
+              "_zx_exception_get_thread");
 
     zx_thread_state_general_regs_t GeneralRegisters;
     ExitOnErr(_zx_thread_read_state(Thread.Handle, ZX_THREAD_STATE_GENERAL_REGS,
                                     &GeneralRegisters,
                                     sizeof(GeneralRegisters)),
               "_zx_thread_read_state");
 
     // To unwind properly, we need to push the crashing thread's register state

 #endif
 
     // Now force the crashing thread's state.
     ExitOnErr(
         _zx_thread_write_state(Thread.Handle, ZX_THREAD_STATE_GENERAL_REGS,
                                &GeneralRegisters, sizeof(GeneralRegisters)),
         "_zx_thread_write_state");
 
-    ExitOnErr(_zx_task_resume_from_exception(Thread.Handle, Port.Handle, 0),
-              "_zx_task_resume_from_exception");
+    // Set the exception to HANDLED so it resumes the thread on close.
+    uint32_t ExceptionState = ZX_EXCEPTION_STATE_HANDLED;
+    ExitOnErr(_zx_object_set_property(Exception.Handle, ZX_PROP_EXCEPTION_STATE,
+                                      &ExceptionState, sizeof(ExceptionState)),
+              "zx_object_set_property");
   }
 }
 
 } // namespace
 
 bool Mprotect(void *Ptr, size_t Size, bool AllowReadWrite) {
   return false;  // UNIMPLEMENTED
 }