[libFuzzer] Allow discarding output in ExecuteCommand in Fuchsia.

[charco]

Summary

This commit modifies the way ExecuteCommand works in fuchsia by adding
special logic to handle /dev/null.

The FuzzerCommand interface does not have a way to "discard" the output,
so other parts of the code just set the output file to getDevNull().
The problem is that fuchsia does not have a named file that is
equivalent to /dev/null, so opening that file just fails.

This commit detects whether the specified output file is getDevNull,
and if that's the case, it will not copy the file descriptor for stdout
in the spawned process.

NOTE that modifying FuzzerCommand to add a "discardOutput" function
involves a significant refactor of all the other platforms, as they all
rely on the toString() method of FuzzerCommand.

This allows libfuzzer in fuchsia to run with fork=1, as the merge
process (FuzzerMerge.cpp) invoked ExecuteCommand with /dev/null as the
output.

[charco]

Ran clang-format

[charco]

Thanks for the review, Aaron!

compiler-rt/lib/fuzzer/FuzzerUtilFuchsia.cpp

 #include <zircon/sanitizer.h>
 #include <zircon/status.h>
 #include <zircon/syscalls.h>
 #include <zircon/syscalls/debug.h>
 #include <zircon/syscalls/exception.h>
 #include <zircon/syscalls/object.h>
 #include <zircon/types.h>
 
+#include <vector>
+
 namespace fuzzer {
 
 // Given that Fuchsia doesn't have the POSIX signals that libFuzzer was written
 // around, the general approach is to spin up dedicated threads to watch for
 // each requested condition (alarm, interrupt, crash).  Of these, the crash
 // handler is the most involved, as it requires resuming the crashed thread in
 // order to invoke the sanitizers to get the needed state.
 
private:
   Fn fn_;
 };
 
 template <typename Fn>
 RunOnDestruction<Fn> at_scope_exit(Fn fn) {
   return RunOnDestruction<Fn>(fn);
 }
 
+static fdio_spawn_action_t clone_fd_action(int localFd, int targetFd) {
+  return {
+      .action = FDIO_SPAWN_ACTION_CLONE_FD,
+      .fd =
+          {
+              .local_fd = localFd,
+              .target_fd = targetFd,
+          },
+  };
+}
+
 int ExecuteCommand(const Command &Cmd) {
   zx_status_t rc;
 
   // Convert arguments to C array
   auto Args = Cmd.getArguments();
   size_t Argc = Args.size();
   assert(Argc != 0);
   std::unique_ptr<const char *[]> Argv(new const char *[Argc + 1]);
   for (size_t i = 0; i < Argc; ++i)
     Argv[i] = Args[i].c_str();
   Argv[Argc] = nullptr;
 
   // Determine output.  On Fuchsia, the fuzzer is typically run as a component
   // that lacks a mutable working directory. Fortunately, when this is the case
   // a mutable output directory must be specified using "-artifact_prefix=...",
   // so write the log file(s) there.
   // However, we don't want to apply this logic for absolute paths.
   int FdOut = STDOUT_FILENO;
+  bool discardStdout = false;
+  bool discardStderr = false;
+
   if (Cmd.hasOutputFile()) {
     std::string Path = Cmd.getOutputFile();
+    if (Path == getDevNull()) {
+      // On Fuchsia, there's no "/dev/null" like-file, so we
+      // just don't copy the FDs into the spawned process.
+      discardStdout = true;
+    } else {
       bool IsAbsolutePath = Path.length() > 1 && Path[0] == '/';
       if (!IsAbsolutePath && Cmd.hasFlag("artifact_prefix"))
         Path = Cmd.getFlagValue("artifact_prefix") + "/" + Path;
 
       FdOut = open(Path.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0);
       if (FdOut == -1) {
         Printf("libFuzzer: failed to open %s: %s\n", Path.c_str(),
                strerror(errno));
         return ZX_ERR_IO;
       }
     }
+  }
   auto CloseFdOut = at_scope_exit([FdOut]() {
     if (FdOut != STDOUT_FILENO)
       close(FdOut);
   });
 
   // Determine stderr
   int FdErr = STDERR_FILENO;
-  if (Cmd.isOutAndErrCombined())
+  if (Cmd.isOutAndErrCombined()) {
     FdErr = FdOut;
+    if (discardStdout)
+      discardStderr = true;
+  }
 
   // Clone the file descriptors into the new process
-  fdio_spawn_action_t SpawnAction[] = {
-      {
-          .action = FDIO_SPAWN_ACTION_CLONE_FD,
-          .fd =
-              {
-                  .local_fd = STDIN_FILENO,
-                  .target_fd = STDIN_FILENO,
-              },
-      },
-      {
-          .action = FDIO_SPAWN_ACTION_CLONE_FD,
-          .fd =
-              {
-                  .local_fd = FdOut,
-                  .target_fd = STDOUT_FILENO,
-              },
-      },
-      {
-          .action = FDIO_SPAWN_ACTION_CLONE_FD,
-          .fd =
-              {
-                  .local_fd = FdErr,
-                  .target_fd = STDERR_FILENO,
-              },
-      },
-  };
+  std::vector<fdio_spawn_action_t> SpawnActions;
+  SpawnActions.push_back(clone_fd_action(STDIN_FILENO, STDIN_FILENO));
+
+  if (!discardStdout)
+    SpawnActions.push_back(clone_fd_action(FdOut, STDOUT_FILENO));
+  if (!discardStderr)
+    SpawnActions.push_back(clone_fd_action(FdErr, STDERR_FILENO));
 
   // Start the process.
   char ErrorMsg[FDIO_SPAWN_ERR_MSG_MAX_LENGTH];
   zx_handle_t ProcessHandle = ZX_HANDLE_INVALID;
-  rc = fdio_spawn_etc(
-      ZX_HANDLE_INVALID, FDIO_SPAWN_CLONE_ALL & (~FDIO_SPAWN_CLONE_STDIO),
-      Argv[0], Argv.get(), nullptr, 3, SpawnAction, &ProcessHandle, ErrorMsg);
+  rc = fdio_spawn_etc(ZX_HANDLE_INVALID,
+                      FDIO_SPAWN_CLONE_ALL & (~FDIO_SPAWN_CLONE_STDIO), Argv[0],
+                      Argv.get(), nullptr, SpawnActions.size(),
+                      SpawnActions.data(), &ProcessHandle, ErrorMsg);
+
   if (rc != ZX_OK) {
     Printf("libFuzzer: failed to launch '%s': %s, %s\n", Argv[0], ErrorMsg,
            _zx_status_get_string(rc));
     return rc;
   }
   auto CloseHandle = at_scope_exit([&]() { _zx_handle_close(ProcessHandle); });
 
   // Now join the process and return the exit status.