[libFuzzer] Make dataflow and focus functions more user friendly.

[Dor1s]

Summary

• Fail loudly if SetFocusFunction failed when it should not. For more info see
  • https://github.com/google/oss-fuzz/issues/3311
  • https://github.com/google/sanitizers/issues/1190
• Fail loudly if CollectDataFlow is called without seed corpus.

[kcc]

LGTM, thanks!

[Dor1s]

Hm, there is a failure in http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux/builds/25533, but I don't understand how it can be related... Looking more.

[Dor1s]

In D73813#1855658, @Dor1s wrote:

Hm, there is a failure in http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux/builds/25533, but I don't understand how it can be related... Looking more.

I'm having trouble reproducing it, will wait and see if the next build fails too: http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux/builds/25534

[Dor1s]

The next build succeeded. Must be a flake. And I'm seeing some other unrelated failures locally, but not this one. False alarm

[metzman]

LGTM

compiler-rt/lib/fuzzer/FuzzerDataFlowTrace.cpp

Printf("INFO: DataFlowTrace: %zd trace files, %zd functions, "
          NumTraceFiles, NumFunctions, NumTracesWithFocusFunction);
   return NumTraceFiles > 0;
 }
 
 int CollectDataFlow(const std::string &DFTBinary, const std::string &DirPath,
                     const Vector<SizedFile> &CorporaFiles) {
   Printf("INFO: collecting data flow: bin: %s dir: %s files: %zd\n",
          DFTBinary.c_str(), DirPath.c_str(), CorporaFiles.size());
+  if (CorporaFiles.empty()) {
+    Printf("ERROR: can't collect data flow without corpus provided.");
+    return 1;
+  }
+
   static char DFSanEnv[] = "DFSAN_OPTIONS=fast16labels=1:warn_unimplemented=0";
   putenv(DFSanEnv);
   MkDir(DirPath);
   for (auto &F : CorporaFiles) {
     // For every input F we need to collect the data flow and the coverage.
     // Data flow collection may fail if we request too many DFSan tags at once.
     // So, we start from requesting all tags in range [0,Size) and if that fails
     // we then request tags in [0,Size/2) and [Size/2, Size), and so on.

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

for (auto NextFE = M.Start; NextFE < M.Stop; ) {
       CB(FE, NextFE, ObservedFuncs[FE->PC]);
     }
   }
 }
 
 void TracePC::SetFocusFunction(const std::string &FuncName) {
   // This function should be called once.
   assert(!FocusFunctionCounterPtr);
-  if (FuncName.empty())
+  // "auto" is not a valid function name. If this function is called with "auto"
+  // that means the auto focus functionality failed.
+  if (FuncName.empty() || FuncName == "auto")
     return;
   for (size_t M = 0; M < NumModules; M++) {
     auto &PCTE = ModulePCTable[M];
     size_t N = PCTE.Stop - PCTE.Start;
     for (size_t I = 0; I < N; I++) {
       if (!(PcIsFuncEntry(&PCTE.Start[I]))) continue;  // not a function entry.
       auto Name = DescribePC("%F", GetNextInstructionPc(PCTE.Start[I].PC));
       if (Name[0] == 'i' && Name[1] == 'n' && Name[2] == ' ')
         Name = Name.substr(3, std::string::npos);
       if (FuncName != Name) continue;
       Printf("INFO: Focus function is set to '%s'\n", Name.c_str());
       FocusFunctionCounterPtr = Modules[M].Start() + I;
       return;
     }
   }
+
+  Printf("ERROR: Failed to set focus function. Make sure the function name is "
+         "valid (%s) and symbolization is enabled.\n", FuncName.c_str());
+  exit(1);
 }
 
 bool TracePC::ObservedFocusFunction() {
   return FocusFunctionCounterPtr && *FocusFunctionCounterPtr;
 }
 
 void TracePC::PrintCoverage() {
   if (!EF->__sanitizer_symbolize_pc ||

compiler-rt/test/fuzzer/dataflow.test

 USE_DATA_FLOW_TRACE: INFO: DataFlowTrace: 6 trace files, 3 functions, 1 traces with focus function
 USE_DATA_FLOW_TRACE: INFO: Focus function is set to 'Func2'
 
 # Test that we can run collect_data_flow on a long input (>2**16 bytes)
 RUN: printf "%0.sA" {1..150001} > %t/IN/very_long_input
 RUN: rm -rf %t/OUT
 RUN: %t-ThreeFunctionsTest  -collect_data_flow=%t-ThreeFunctionsTestDF -data_flow_trace=%t/OUT %t/IN/very_long_input
 RUN: rm %t/IN/very_long_input
+
+# Test that it fails explicitly when an empty corpus is provided.
+RUN: rm -rf %t/IN && mkdir %t/IN
+RUN: not %t-ThreeFunctionsTest  -collect_data_flow=%t-ThreeFunctionsTestDF -data_flow_trace=%t/OUT %t/IN 2>&1 | FileCheck %s --check-prefix=EMPTY_CORPUS
+
+EMPTY_CORPUS: ERROR: can't collect data flow without corpus provided

compiler-rt/test/fuzzer/focus-function.test

 # Tests -focus_function
 #
 # TODO: don't require linux.
 # REQUIRES: linux
 UNSUPPORTED: aarch64
 
 RUN: %cpp_compiler %S/OnlySomeBytesTest.cpp -o %t-exe
 
 RUN: %t-exe -runs=100 2>&1 | FileCheck %s --check-prefix=FOCUS_NONE
 FOCUS_NONE-NOT: INFO: Focus function is set to
 FOCUS_NONE-NOT: INFO: {{.*}} inputs touch the focus function
 
-RUN: %t-exe -runs=100 -focus_function=WRONG 2>&1 | FileCheck %s --check-prefix=FOCUS_WRONG
+RUN: not %t-exe -runs=100 -focus_function=WRONG 2>&1 | FileCheck %s --check-prefix=FOCUS_WRONG
 FOCUS_WRONG-NOT: INFO: Focus function is set to
-FOCUS_WRONG: INFO: 0/1 inputs touch the focus function
+FOCUS_WRONG: ERROR: Failed to set focus function
 
 RUN: %t-exe -runs=100 -focus_function=f0 2>&1 | FileCheck %s --check-prefix=FOCUS_F0
 FOCUS_F0: INFO: Focus function is set to 'f0'
 FOCUS_F0: INFO: 0/1 inputs touch the focus function
 
 RUN: rm -rf %t-corpus
 RUN: mkdir %t-corpus
 # ABC triggers the focus function, others don't.
 RUN: echo ABC$(for((i=0;i<2048;i++)); do echo -n x; done) > %t-corpus/ABC
 RUN: echo AXY$(for((i=0;i<2048;i++)); do echo -n x; done) > %t-corpus/AXY
 RUN: echo ABX$(for((i=0;i<2048;i++)); do echo -n x; done) > %t-corpus/ABX
 
 RUN: %t-exe -runs=10000 -focus_function=f0 %t-corpus 2>&1 | FileCheck %s --check-prefix=CORPUS_1_3
 CORPUS_1_3: INFO: 1/3 inputs touch the focus function
 CORPUS_1_3: DONE {{.*}} focus: