[libFuzzer] Dump trace and provide correct msg for overwritten input.

[hctim]

Summary

Now crashes with a stacktrace and uses 'overwrites-const-input' as the error
message instead of 'out-of-memory'.

[morehouse]

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

518 ↗

(On Diff #221874)

I don't see a benefit to printing this stack trace -- it will always be in libFuzzer code.

521 ↗

(On Diff #221874)

Also not sure if stats are actually valuable. Overwriting the input means there's a bug in the fuzz target, probably not the library being fuzzed.

[Dor1s]

I think Matt is right, but I wouldn't mind to have the stacktrace and stats just to be consistent with the other crashes. Also, having a stacktrace should increase the chances that such a crash would be handled by fuzzing infrastructure and reported to people.

[hctim]

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

518 ↗

(On Diff #221874)

From @Dor1s above - it may be nice to have just for consistency's sake.

521 ↗

(On Diff #221874)

Not necessarily, they could const_cast away deep in a library and mangle the data down there.

[morehouse]

LGTM

compiler-rt/trunk/lib/fuzzer/FuzzerLoop.cpp

size_t Fuzzer::GetCurrentUnitInFuzzingThead(const uint8_t **Data) const {
   assert(InFuzzingThread());
   *Data = CurrentUnitData;
   return CurrentUnitSize;
 }
 
 void Fuzzer::CrashOnOverwrittenData() {
   Printf("==%d== ERROR: libFuzzer: fuzz target overwrites its const input\n",
          GetPid());
+  PrintStackTrace();
+  Printf("SUMMARY: libFuzzer: overwrites-const-input\n");
   DumpCurrentUnit("crash-");
-  Printf("SUMMARY: libFuzzer: out-of-memory\n");
+  PrintFinalStats();
   _Exit(Options.ErrorExitCode); // Stop right now.
 }
 
 // Compare two arrays, but not all bytes if the arrays are large.
 static bool LooseMemeq(const uint8_t *A, const uint8_t *B, size_t Size) {
   const size_t Limit = 64;
   if (Size <= 64)
     return !memcmp(A, B, Size);