[libFuzzer] communicate through pipe to subprocess for MinimizeCrashInput

[ychen]

Summary

For CleanseCrashInput, discards stdout output anyway since it is not used.

Also giving TempPath a prefix representing the work it is doing.

These changes are to defend against aggressive PID recycle on windows to reduce the chance of contention on files.

Using pipe instead of file also workaround the problem that when the
process is spawned by llvm-lit, the aborted process keeps a handle to the
output file such that the output file can not be removed. This will
cause random test failures.

https://devblogs.microsoft.com/oldnewthing/20110107-00/?p=11803

[merge_guards_bot]

Unit tests: fail. 62152 tests passed, 5 failed and 811 were skipped.

failed: libc++.std/language_support/cmp/cmp_partialord/partialord.pass.cpp
failed: libc++.std/language_support/cmp/cmp_strongeq/cmp.strongeq.pass.cpp
failed: libc++.std/language_support/cmp/cmp_strongord/strongord.pass.cpp
failed: libc++.std/language_support/cmp/cmp_weakeq/cmp.weakeq.pass.cpp
failed: libc++.std/language_support/cmp/cmp_weakord/weakord.pass.cpp

clang-tidy: fail. clang-tidy found 0 errors and 5 warnings. 0 of them are added as review comments below (why?).

clang-format: fail. Please format your changes with clang-format by running git-clang-format HEAD^ or applying this patch.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[ychen]

Somehow this caused three failures on Linux. I'll take a look.

[ychen]

• fix two linux test failure

[merge_guards_bot]

Unit tests: fail. 62195 tests passed, 1 failed and 815 were skipped.

failed: libc++.std/thread/thread_mutex/thread_mutex_requirements/thread_mutex_requirements_mutex/thread_mutex_recursive/lock.pass.cpp

clang-tidy: fail. clang-tidy found 0 errors and 4 warnings. 0 of them are added as review comments below (why?).

clang-format: fail. Please format your changes with clang-format by running git-clang-format HEAD^ or applying this patch.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[merge_guards_bot]

Unit tests: pass. 62243 tests passed, 0 failed and 816 were skipped.

clang-tidy: fail. clang-tidy found 0 errors and 4 warnings. 0 of them are added as review comments below (why?).

clang-format: fail. Please format your changes with clang-format by running git-clang-format HEAD^ or applying this patch.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[ychen]

• clang-format

[merge_guards_bot]

Unit tests: pass. 62246 tests passed, 0 failed and 816 were skipped.

clang-tidy: fail. clang-tidy found 0 errors and 4 warnings. 0 of them are added as review comments below (why?).

clang-format: pass.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[kcc]

It looks like this patch has at least two independent changes.
Please prefer to send two+ individual changes next time. (even if the patches are tiny).

Vitaly, please review

compiler-rt/lib/fuzzer/FuzzerDriver.cpp

36

any chance to not have any macros?

326

replace 128 with sizeof(TmpBuffer)

[ychen]

• Address comments

[ychen]

In D73329#1848269, @kcc wrote:

It looks like this patch has at least two independent changes.
Please prefer to send two+ individual changes next time. (even if the patches are tiny).

Thanks. I'll pay closer attention in the future.

[merge_guards_bot]

Unit tests: pass. 62315 tests passed, 0 failed and 838 were skipped.

clang-tidy: fail. clang-tidy found 0 errors and 8 warnings. 0 of them are added as review comments below (why?).

clang-format: fail. Please format your changes with clang-format by running git-clang-format HEAD^ or applying this patch.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[ychen]

• clang-format

[merge_guards_bot]

Unit tests: pass. 62315 tests passed, 0 failed and 838 were skipped.

clang-tidy: fail. clang-tidy found 0 errors and 6 warnings. 0 of them are added as review comments below (why?).

clang-format: fail. Please format your changes with clang-format by running git-clang-format HEAD^ or applying this patch.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[ychen]

ping?

[vitalybuka]

compiler-rt/lib/fuzzer/FuzzerDriver.cpp

321

exit code is used to check only success
please make it bool
true - success
false - error

503

This verbosity in temp names is nice but irrelevant to the goal of the patch.
Could you extract this into a separate NFC patch.

[ychen]

• make ExecuteCommandWithPopen return bool
• split out TempPath prefixing part as separate NFC patch

[leonardchan]

Hi, a bisect seems to show that this patch resulted in a series of linker errors when building fuzzers fuchsia:

[48364/49380] LINK user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer
FAILED: user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.debug user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.map
../../../recipe_cleanup/clang9HU4mg/bin/clang++ -o user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.debug -fuse-ld=lld -Wl,--threads -Wl,-z,combreloc -Wl,-z,relro -Wl,-z,now -Wl,-z,text -Wl,--pack-dyn-relocs=relr --target=x86_64-fuchsia -mcx16 -march=x86-64 -fcrash-diagnostics-dir=clang-crashreports -fcolor-diagnostics -Wl,--color-diagnostics -Wl,-z,max-page-size=4096 -ffile-prefix-map=/b/s/w/ir/k/fuchsia/out/default.zircon=. -ffile-prefix-map=/b/s/w/ir/k/fuchsia/out=.. -ffile-prefix-map=/b/s/w/ir/k/fuchsia=../.. -no-canonical-prefixes -O2 -Wl,--icf=all -g3 -ffunction-sections -Wl,--gc-sections -fdata-sections -fno-exceptions -fno-rtti -nostartfiles -nolibc -Wl,-dynamic-linker=fuzzer.asan-ubsan/ld.so.1 -fsanitize=fuzzer -fsanitize=undefined -fsanitize=address -L../../zircon/public/gn/config/libc-dummy -Wl,-Map,user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.map -Wl,--start-group @'user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.rsp' -lunwind -Wl,--end-group user.vdso-x64-clang.shlib/obj/system/ulib/zircon/libzircon.so.debug user.fuzzer-x64-asan-ubsan.shlib/obj/system/ulib/c/libc.so.debug user-x64-asan-ubsan.shlib/obj/system/ulib/fdio/libfdio.so.debug && ../../../recipe_cleanup/clang9HU4mg/bin/llvm-objcopy --strip-sections "user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.debug" "user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer" && case '-fuse-ld=lld -Wl,--threads -Wl,-z,combreloc -Wl,-z,relro -Wl,-z,now -Wl,-z,text -Wl,--pack-dyn-relocs=relr --target=x86_64-fuchsia -mcx16 -march=x86-64 -fcrash-diagnostics-dir=clang-crashreports -fcolor-diagnostics -Wl,--color-diagnostics -Wl,-z,max-page-size=4096 -ffile-prefix-map=/b/s/w/ir/k/fuchsia/out/default.zircon=. -ffile-prefix-map=/b/s/w/ir/k/fuchsia/out=.. -ffile-prefix-map=/b/s/w/ir/k/fuchsia=../.. -no-canonical-prefixes -O2 -Wl,--icf=all -g3 -ffunction-sections -Wl,--gc-sections -fdata-sections -fno-exceptions -fno-rtti -nostartfiles -nolibc -Wl,-dynamic-linker=fuzzer.asan-ubsan/ld.so.1 -fsanitize=fuzzer -fsanitize=undefined -fsanitize=address -L../../zircon/public/gn/config/libc-dummy' in *build-id=none*) ;; *) ../../prebuilt/tools/buildidtool/linux-x64/buildidtool -build-id-dir ".build-id" -stamp "user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.build-id.stamp" -entry "=user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer" -entry ".debug=user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.debug" ;; esac
ld.lld: error: undefined symbol: fuzzer::OpenProcessPipe(char const*, char const*)
>>> referenced by FuzzerDriver.cpp:321 (compiler-rt/lib/fuzzer/FuzzerDriver.cpp:321)
>>>               fuzzer.o:(fuzzer::ExecuteCommandWithPopen(fuzzer::Command const&, std::__Fuzzer::basic_string<char, std::__Fuzzer::char_traits<char>, std::__Fuzzer::allocator<char> >*)) in archive ../../../recipe_cleanup/clang9HU4mg/lib/clang/11.0.0/lib/x86_64-unknown-fuchsia/libclang_rt.fuzzer.a

... and many more

Could you take a look or revert this patch? Thanks.

I tested and if there will be a revert, 4f3c3bbbf85a1283796e0e80c654779e40ce328e may also need to be reverted since it depends on this patch.

Builder link: https://ci.chromium.org/p/fuchsia/builders/ci/clang_toolchain.fuchsia-x64-debug-subbuild/b8888652956426122432

[ychen]

In D73329#1873142, @leonardchan wrote:

Hi, a bisect seems to show that this patch resulted in a series of linker errors when building fuzzers fuchsia:

[48364/49380] LINK user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer
FAILED: user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.debug user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.map
../../../recipe_cleanup/clang9HU4mg/bin/clang++ -o user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.debug -fuse-ld=lld -Wl,--threads -Wl,-z,combreloc -Wl,-z,relro -Wl,-z,now -Wl,-z,text -Wl,--pack-dyn-relocs=relr --target=x86_64-fuchsia -mcx16 -march=x86-64 -fcrash-diagnostics-dir=clang-crashreports -fcolor-diagnostics -Wl,--color-diagnostics -Wl,-z,max-page-size=4096 -ffile-prefix-map=/b/s/w/ir/k/fuchsia/out/default.zircon=. -ffile-prefix-map=/b/s/w/ir/k/fuchsia/out=.. -ffile-prefix-map=/b/s/w/ir/k/fuchsia=../.. -no-canonical-prefixes -O2 -Wl,--icf=all -g3 -ffunction-sections -Wl,--gc-sections -fdata-sections -fno-exceptions -fno-rtti -nostartfiles -nolibc -Wl,-dynamic-linker=fuzzer.asan-ubsan/ld.so.1 -fsanitize=fuzzer -fsanitize=undefined -fsanitize=address -L../../zircon/public/gn/config/libc-dummy -Wl,-Map,user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.map -Wl,--start-group @'user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.rsp' -lunwind -Wl,--end-group user.vdso-x64-clang.shlib/obj/system/ulib/zircon/libzircon.so.debug user.fuzzer-x64-asan-ubsan.shlib/obj/system/ulib/c/libc.so.debug user-x64-asan-ubsan.shlib/obj/system/ulib/fdio/libfdio.so.debug && ../../../recipe_cleanup/clang9HU4mg/bin/llvm-objcopy --strip-sections "user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.debug" "user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer" && case '-fuse-ld=lld -Wl,--threads -Wl,-z,combreloc -Wl,-z,relro -Wl,-z,now -Wl,-z,text -Wl,--pack-dyn-relocs=relr --target=x86_64-fuchsia -mcx16 -march=x86-64 -fcrash-diagnostics-dir=clang-crashreports -fcolor-diagnostics -Wl,--color-diagnostics -Wl,-z,max-page-size=4096 -ffile-prefix-map=/b/s/w/ir/k/fuchsia/out/default.zircon=. -ffile-prefix-map=/b/s/w/ir/k/fuchsia/out=.. -ffile-prefix-map=/b/s/w/ir/k/fuchsia=../.. -no-canonical-prefixes -O2 -Wl,--icf=all -g3 -ffunction-sections -Wl,--gc-sections -fdata-sections -fno-exceptions -fno-rtti -nostartfiles -nolibc -Wl,-dynamic-linker=fuzzer.asan-ubsan/ld.so.1 -fsanitize=fuzzer -fsanitize=undefined -fsanitize=address -L../../zircon/public/gn/config/libc-dummy' in *build-id=none*) ;; *) ../../prebuilt/tools/buildidtool/linux-x64/buildidtool -build-id-dir ".build-id" -stamp "user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.build-id.stamp" -entry "=user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer" -entry ".debug=user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.debug" ;; esac
ld.lld: error: undefined symbol: fuzzer::OpenProcessPipe(char const*, char const*)
>>> referenced by FuzzerDriver.cpp:321 (compiler-rt/lib/fuzzer/FuzzerDriver.cpp:321)
>>>               fuzzer.o:(fuzzer::ExecuteCommandWithPopen(fuzzer::Command const&, std::__Fuzzer::basic_string<char, std::__Fuzzer::char_traits<char>, std::__Fuzzer::allocator<char> >*)) in archive ../../../recipe_cleanup/clang9HU4mg/lib/clang/11.0.0/lib/x86_64-unknown-fuchsia/libclang_rt.fuzzer.a

... and many more

Could you take a look or revert this patch? Thanks.

I tested and if there will be a revert, 4f3c3bbbf85a1283796e0e80c654779e40ce328e may also need to be reverted since it depends on this patch.

Builder link: https://ci.chromium.org/p/fuchsia/builders/ci/clang_toolchain.fuchsia-x64-debug-subbuild/b8888652956426122432

Apologies that I did not add OpenProcessPipe implementation on Fushia. Quick question is there popen/pclose on Fushia? Thanks.

[leonardchan]

In D73329#1873181, @ychen wrote:

In D73329#1873142, @leonardchan wrote:

Hi, a bisect seems to show that this patch resulted in a series of linker errors when building fuzzers fuchsia:

[48364/49380] LINK user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer
FAILED: user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.debug user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.map
../../../recipe_cleanup/clang9HU4mg/bin/clang++ -o user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.debug -fuse-ld=lld -Wl,--threads -Wl,-z,combreloc -Wl,-z,relro -Wl,-z,now -Wl,-z,text -Wl,--pack-dyn-relocs=relr --target=x86_64-fuchsia -mcx16 -march=x86-64 -fcrash-diagnostics-dir=clang-crashreports -fcolor-diagnostics -Wl,--color-diagnostics -Wl,-z,max-page-size=4096 -ffile-prefix-map=/b/s/w/ir/k/fuchsia/out/default.zircon=. -ffile-prefix-map=/b/s/w/ir/k/fuchsia/out=.. -ffile-prefix-map=/b/s/w/ir/k/fuchsia=../.. -no-canonical-prefixes -O2 -Wl,--icf=all -g3 -ffunction-sections -Wl,--gc-sections -fdata-sections -fno-exceptions -fno-rtti -nostartfiles -nolibc -Wl,-dynamic-linker=fuzzer.asan-ubsan/ld.so.1 -fsanitize=fuzzer -fsanitize=undefined -fsanitize=address -L../../zircon/public/gn/config/libc-dummy -Wl,-Map,user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.map -Wl,--start-group @'user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.rsp' -lunwind -Wl,--end-group user.vdso-x64-clang.shlib/obj/system/ulib/zircon/libzircon.so.debug user.fuzzer-x64-asan-ubsan.shlib/obj/system/ulib/c/libc.so.debug user-x64-asan-ubsan.shlib/obj/system/ulib/fdio/libfdio.so.debug && ../../../recipe_cleanup/clang9HU4mg/bin/llvm-objcopy --strip-sections "user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.debug" "user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer" && case '-fuse-ld=lld -Wl,--threads -Wl,-z,combreloc -Wl,-z,relro -Wl,-z,now -Wl,-z,text -Wl,--pack-dyn-relocs=relr --target=x86_64-fuchsia -mcx16 -march=x86-64 -fcrash-diagnostics-dir=clang-crashreports -fcolor-diagnostics -Wl,--color-diagnostics -Wl,-z,max-page-size=4096 -ffile-prefix-map=/b/s/w/ir/k/fuchsia/out/default.zircon=. -ffile-prefix-map=/b/s/w/ir/k/fuchsia/out=.. -ffile-prefix-map=/b/s/w/ir/k/fuchsia=../.. -no-canonical-prefixes -O2 -Wl,--icf=all -g3 -ffunction-sections -Wl,--gc-sections -fdata-sections -fno-exceptions -fno-rtti -nostartfiles -nolibc -Wl,-dynamic-linker=fuzzer.asan-ubsan/ld.so.1 -fsanitize=fuzzer -fsanitize=undefined -fsanitize=address -L../../zircon/public/gn/config/libc-dummy' in *build-id=none*) ;; *) ../../prebuilt/tools/buildidtool/linux-x64/buildidtool -build-id-dir ".build-id" -stamp "user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.build-id.stamp" -entry "=user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer" -entry ".debug=user.fuzzer-x64-asan-ubsan/obj/system/ulib/elfload/test/elfload-fuzzer.debug" ;; esac
ld.lld: error: undefined symbol: fuzzer::OpenProcessPipe(char const*, char const*)
>>> referenced by FuzzerDriver.cpp:321 (compiler-rt/lib/fuzzer/FuzzerDriver.cpp:321)
>>>               fuzzer.o:(fuzzer::ExecuteCommandWithPopen(fuzzer::Command const&, std::__Fuzzer::basic_string<char, std::__Fuzzer::char_traits<char>, std::__Fuzzer::allocator<char> >*)) in archive ../../../recipe_cleanup/clang9HU4mg/lib/clang/11.0.0/lib/x86_64-unknown-fuchsia/libclang_rt.fuzzer.a

... and many more

Could you take a look or revert this patch? Thanks.

I tested and if there will be a revert, 4f3c3bbbf85a1283796e0e80c654779e40ce328e may also need to be reverted since it depends on this patch.

Builder link: https://ci.chromium.org/p/fuchsia/builders/ci/clang_toolchain.fuchsia-x64-debug-subbuild/b8888652956426122432

Apologies that I did not add OpenProcessPipe implementation on Fushia. Quick question is there popen/pclose on Fushia? Thanks.

We do not have popen/pclose on Fuchsia. Thanks for getting back quickly!

compiler-rt/lib/fuzzer/FuzzerDriver.cpp

 #include <thread>
 #include <fstream>
 
 // This function should be present in the libFuzzer so that the client
 // binary can test for its existence.
 #if LIBFUZZER_MSVC
 extern "C" void __libfuzzer_is_present() {}
 #pragma comment(linker, "/include:__libfuzzer_is_present")
 #else
 extern "C" __attribute__((used)) void __libfuzzer_is_present() {}
 #endif  // LIBFUZZER_MSVC
 
 namespace fuzzer {
 
 // Program arguments.
 struct FlagDescription {
   const char *Name;

 static bool AllInputsAreFiles() {
   if (Inputs->empty()) return false;
   for (auto &Path : *Inputs)
     if (!IsFile(Path))
       return false;
   return true;
 }
 
-static std::string GetDedupTokenFromFile(const std::string &Path) {
-  auto S = FileToString(Path);
+static std::string GetDedupTokenFromCmdOutput(const std::string &S) {
   auto Beg = S.find("DEDUP_TOKEN:");
   if (Beg == std::string::npos)
     return "";
   auto End = S.find('\n', Beg);
   if (End == std::string::npos)
     return "";
   return S.substr(Beg, End - Beg);
 }
 
+// Return true on success, false otherwise.
+static bool ExecuteCommandWithPopen(const Command &Cmd, std::string *CmdOutput) {
+  FILE *Pipe = OpenProcessPipe(Cmd.toString().c_str(), "r");
+  if (!Pipe)
+    return false;
+
+  if (CmdOutput) {
+    char TmpBuffer[128];
+    while (fgets(TmpBuffer, sizeof(TmpBuffer), Pipe))
+      CmdOutput->append(TmpBuffer);
+  }
+  return CloseProcessPipe(Pipe) == 0;
+}
+
 int CleanseCrashInput(const Vector<std::string> &Args,
                        const FuzzingOptions &Options) {
   if (Inputs->size() != 1 || !Flags.exact_artifact_path) {
     Printf("ERROR: -cleanse_crash should be given one input file and"
           " -exact_artifact_path\n");
     exit(1);
   }
   std::string InputFilePath = Inputs->at(0);
   std::string OutputFilePath = Flags.exact_artifact_path;
   Command Cmd(Args);
   Cmd.removeFlag("cleanse_crash");
 
   assert(Cmd.hasArgument(InputFilePath));
   Cmd.removeArgument(InputFilePath);
 
-  auto LogFilePath = TempPath(".txt");
   auto TmpFilePath = TempPath(".repro");
   Cmd.addArgument(TmpFilePath);
-  Cmd.setOutputFile(LogFilePath);
+  Cmd.setOutputFile(getDevNull());
   Cmd.combineOutAndErr();
 
   std::string CurrentFilePath = InputFilePath;
   auto U = FileToVector(CurrentFilePath);
   size_t Size = U.size();
 
   const Vector<uint8_t> ReplacementBytes = {' ', 0xff};
   for (int NumAttempts = 0; NumAttempts < 5; NumAttempts++) {
for (size_t Idx = 0; Idx < Size; Idx++) {
           Printf("CLEANSE: Replaced byte %zd with 0x%x\n", Idx, NewByte);
           WriteToFile(U, OutputFilePath);
           break;
         }
       }
     }
     if (!Changed) break;
   }
-  RemoveFile(LogFilePath);
   return 0;
 }
 
 int MinimizeCrashInput(const Vector<std::string> &Args,
                        const FuzzingOptions &Options) {
   if (Inputs->size() != 1) {
     Printf("ERROR: -minimize_crash should be given one input file\n");
     exit(1);
   }
   std::string InputFilePath = Inputs->at(0);
   Command BaseCmd(Args);
   BaseCmd.removeFlag("minimize_crash");
   BaseCmd.removeFlag("exact_artifact_path");
   assert(BaseCmd.hasArgument(InputFilePath));
   BaseCmd.removeArgument(InputFilePath);
   if (Flags.runs <= 0 && Flags.max_total_time == 0) {
     Printf("INFO: you need to specify -runs=N or "
            "-max_total_time=N with -minimize_crash=1\n"
            "INFO: defaulting to -max_total_time=600\n");
     BaseCmd.addFlag("max_total_time", "600");
   }
 
-  auto LogFilePath = TempPath(".txt");
-  BaseCmd.setOutputFile(LogFilePath);
   BaseCmd.combineOutAndErr();
 
   std::string CurrentFilePath = InputFilePath;
   while (true) {
     Unit U = FileToVector(CurrentFilePath);
     Printf("CRASH_MIN: minimizing crash input: '%s' (%zd bytes)\n",
            CurrentFilePath.c_str(), U.size());
 
     Command Cmd(BaseCmd);
     Cmd.addArgument(CurrentFilePath);
 
-    std::string CommandLine = Cmd.toString();
-    Printf("CRASH_MIN: executing: %s\n", CommandLine.c_str());
-    int ExitCode = ExecuteCommand(Cmd);
-    if (ExitCode == 0) {
+    Printf("CRASH_MIN: executing: %s\n", Cmd.toString().c_str());
+    std::string CmdOutput;
+    bool Success = ExecuteCommandWithPopen(Cmd, &CmdOutput);
+    if (Success) {
       Printf("ERROR: the input %s did not crash\n", CurrentFilePath.c_str());
       exit(1);
     }
     Printf("CRASH_MIN: '%s' (%zd bytes) caused a crash. Will try to minimize "
            "it further\n",
            CurrentFilePath.c_str(), U.size());
-    auto DedupToken1 = GetDedupTokenFromFile(LogFilePath);
+    auto DedupToken1 = GetDedupTokenFromCmdOutput(CmdOutput);
     if (!DedupToken1.empty())
       Printf("CRASH_MIN: DedupToken1: %s\n", DedupToken1.c_str());
 
     std::string ArtifactPath =
         Flags.exact_artifact_path
             ? Flags.exact_artifact_path
             : Options.ArtifactPrefix + "minimized-from-" + Hash(U);
     Cmd.addFlag("minimize_crash_internal_step", "1");
     Cmd.addFlag("exact_artifact_path", ArtifactPath);
-    CommandLine = Cmd.toString();
-    Printf("CRASH_MIN: executing: %s\n", CommandLine.c_str());
-    ExitCode = ExecuteCommand(Cmd);
-    CopyFileToErr(LogFilePath);
-    if (ExitCode == 0) {
+    Printf("CRASH_MIN: executing: %s\n", Cmd.toString().c_str());
+    CmdOutput.clear();
+    Success = ExecuteCommandWithPopen(Cmd, &CmdOutput);
+    Printf("%s", CmdOutput.c_str());
+    if (Success) {
       if (Flags.exact_artifact_path) {
         CurrentFilePath = Flags.exact_artifact_path;
         WriteToFile(U, CurrentFilePath);
       }
       Printf("CRASH_MIN: failed to minimize beyond %s (%d bytes), exiting\n",
              CurrentFilePath.c_str(), U.size());
       break;
     }
-    auto DedupToken2 = GetDedupTokenFromFile(LogFilePath);
+    auto DedupToken2 = GetDedupTokenFromCmdOutput(CmdOutput);
     if (!DedupToken2.empty())
       Printf("CRASH_MIN: DedupToken2: %s\n", DedupToken2.c_str());
 
     if (DedupToken1 != DedupToken2) {
       if (Flags.exact_artifact_path) {
         CurrentFilePath = Flags.exact_artifact_path;
         WriteToFile(U, CurrentFilePath);
       }
       Printf("CRASH_MIN: mismatch in dedup tokens"
              " (looks like a different bug). Won't minimize further\n");
       break;
     }
 
     CurrentFilePath = ArtifactPath;
     Printf("*********************************\n");
   }
-  RemoveFile(LogFilePath);
   return 0;
 }
 
 int MinimizeCrashInputInternalStep(Fuzzer *F, InputCorpus *Corpus) {
   assert(Inputs->size() == 1);
   std::string InputFilePath = Inputs->at(0);
   Unit U = FileToVector(InputFilePath);
   Printf("INFO: Starting MinimizeCrashInputInternalStep: %zd\n", U.size());
void Merge(Fuzzer *F, FuzzingOptions &Options, const Vector<std::string> &Args,
   Vector<SizedFile> OldCorpus, NewCorpus;
   GetSizedFilesFromDir(Corpora[0], &OldCorpus);
   for (size_t i = 1; i < Corpora.size(); i++)
     GetSizedFilesFromDir(Corpora[i], &NewCorpus);
   std::sort(OldCorpus.begin(), OldCorpus.end());
   std::sort(NewCorpus.begin(), NewCorpus.end());
 
   std::string CFPath = CFPathOrNull ? CFPathOrNull : TempPath(".txt");
   Vector<std::string> NewFiles;
   Set<uint32_t> NewFeatures, NewCov;
   CrashResistantMerge(Args, OldCorpus, NewCorpus, &NewFiles, {}, &NewFeatures,
                       {}, &NewCov, CFPath, true);
   for (auto &Path : NewFiles)
     F->WriteToOutputCorpus(FileToVector(Path, Options.MaxLen));
   // We are done, delete the control file if it was a temporary one.
   if (!Flags.merge_control_file)
     RemoveFile(CFPath);

compiler-rt/lib/fuzzer/FuzzerUtil.h

 
 unsigned long GetPid();
 
 size_t GetPeakRSSMb();
 
 int ExecuteCommand(const Command &Cmd);
 
 FILE *OpenProcessPipe(const char *Command, const char *Mode);
+int CloseProcessPipe(FILE *F);
 
 const void *SearchMemory(const void *haystack, size_t haystacklen,
                          const void *needle, size_t needlelen);
 
 std::string CloneArgsWithoutX(const Vector<std::string> &Args,
                               const char *X1, const char *X2);
 
 inline std::string CloneArgsWithoutX(const Vector<std::string> &Args,

compiler-rt/lib/fuzzer/FuzzerUtilPosix.cpp

size_t GetPeakRSSMb() {
   assert(0 && "GetPeakRSSMb() is not implemented for your platform");
   return 0;
 }
 
 FILE *OpenProcessPipe(const char *Command, const char *Mode) {
   return popen(Command, Mode);
 }
 
+int CloseProcessPipe(FILE *F) {
+  return pclose(F);
+}
+
 const void *SearchMemory(const void *Data, size_t DataLen, const void *Patt,
                          size_t PattLen) {
   return memmem(Data, DataLen, Patt, PattLen);
 }
 
 std::string DisassembleCmd(const std::string &FileName) {
   return "objdump -d " + FileName;
 }
 
 std::string SearchRegexCmd(const std::string &Regex) {
   return "grep '" + Regex + "'";
 }
 
 }  // namespace fuzzer
 
 #endif // LIBFUZZER_POSIX

compiler-rt/lib/fuzzer/FuzzerUtilWindows.cpp

if (!GetProcessMemoryInfo(GetCurrentProcess(), &info, sizeof(info)))
     return 0;
   return info.PeakWorkingSetSize >> 20;
 }
 
 FILE *OpenProcessPipe(const char *Command, const char *Mode) {
   return _popen(Command, Mode);
 }
 
+int CloseProcessPipe(FILE *F) {
+  return _pclose(F);
+}
+
 int ExecuteCommand(const Command &Cmd) {
   std::string CmdLine = Cmd.toString();
   return system(CmdLine.c_str());
 }
 
 const void *SearchMemory(const void *Data, size_t DataLen, const void *Patt,
                          size_t PattLen) {
   // TODO: make this implementation more efficient.