[libFuzzer] Fix minimizing timeouts

[iii]

Summary

When one tries to minimize timeouts using -minimize_crash=1,
minimization immediately fails. The following sequence of events is
responsible for this:

[parent] SIGALRM occurs
[parent] read() returns -EINTR (or -ERESTARTSYS according to strace)
[parent] fgets() returns NULL
[parent] ExecuteCommand() closes child's stdout and returns
[child ] SIGALRM occurs
[child ] AlarmCallback() attempts to write "ALARM: ..." to stdout
[child ] Dies with SIGPIPE without calling DumpCurrentUnit()
[parent] Does not see -exact_artifact_path and exits

When minimizing, the timer in parent is not necessary, so fix by not
setting it in this case.

[kcc]

O, wow, thanks for catching this.
Could you please add a test (in compiler-rt/test/fuzzer) that would reliably fail currently
and reliably pass with this change?

[iii]

• Added a test.
• Moved Alrm after Abrt in order to maintain the alphabetic order.

[iii]

The failing test is libFuzzer :: cleanse.test, but I don't think this is due to my patch - it doesn't fail locally, and it didn't fail the last time. I wonder if build machines do parallel builds? If yes, then the following code might be the culprit:

auto TmpFilePath = TempPath("CleanseCrashInput", ".repro");
...
for (int NumAttempts = 0; NumAttempts < 5; NumAttempts++) {
    ...
    for (auto NewByte : ReplacementBytes) {
      U[Idx] = NewByte;
      WriteToFile(U, TmpFilePath);
      auto ExitCode = ExecuteCommand(Cmd);
      RemoveFile(TmpFilePath);

After the file is removed, a parallel build might be reusing its name, causing all sorts of chaos.

[morehouse]

LGTM

compiler-rt/lib/fuzzer/FuzzerDriver.cpp

if (U.size() <= Word::GetMaxSize())
 
       // Threads are only supported by Chrome. Don't use them with emscripten
       // for now.
 #if !LIBFUZZER_EMSCRIPTEN
   StartRssThread(F, Flags.rss_limit_mb);
 #endif // LIBFUZZER_EMSCRIPTEN
 
   Options.HandleAbrt = Flags.handle_abrt;
+  Options.HandleAlrm = !Flags.minimize_crash;
   Options.HandleBus = Flags.handle_bus;
   Options.HandleFpe = Flags.handle_fpe;
   Options.HandleIll = Flags.handle_ill;
   Options.HandleInt = Flags.handle_int;
   Options.HandleSegv = Flags.handle_segv;
   Options.HandleTerm = Flags.handle_term;
   Options.HandleXfsz = Flags.handle_xfsz;
   Options.HandleUsr1 = Flags.handle_usr1;

compiler-rt/lib/fuzzer/FuzzerOptions.h

struct FuzzingOptions {
   bool PrintFinalStats = false;
   bool PrintCorpusStats = false;
   bool PrintCoverage = false;
   bool DumpCoverage = false;
   bool DetectLeaks = true;
   int PurgeAllocatorIntervalSec = 1;
   int  TraceMalloc = 0;
   bool HandleAbrt = false;
+  bool HandleAlrm = false;
   bool HandleBus = false;
   bool HandleFpe = false;
   bool HandleIll = false;
   bool HandleInt = false;
   bool HandleSegv = false;
   bool HandleTerm = false;
   bool HandleXfsz = false;
   bool HandleUsr1 = false;
   bool HandleUsr2 = false;
 };
 
 }  // namespace fuzzer
 
 #endif  // LLVM_FUZZER_OPTIONS_H

compiler-rt/lib/fuzzer/FuzzerUtilFuchsia.cpp

void SetSignalHandler(const FuzzingOptions &Options) {
   char Buf[64];
   memset(Buf, 0, sizeof(Buf));
   snprintf(Buf, sizeof(Buf), "==%lu== INFO: libFuzzer starting.\n", GetPid());
   if (EF->__sanitizer_log_write)
     __sanitizer_log_write(Buf, sizeof(Buf));
   Printf("%s", Buf);
 
   // Set up alarm handler if needed.
-  if (Options.UnitTimeoutSec > 0) {
+  if (Options.HandleAlrm && Options.UnitTimeoutSec > 0) {
     std::thread T(AlarmHandler, Options.UnitTimeoutSec / 2 + 1);
     T.detach();
   }
 
   // Set up interrupt handler if needed.
   if (Options.HandleInt || Options.HandleTerm) {
     std::thread T(InterruptHandler);
     T.detach();

compiler-rt/lib/fuzzer/FuzzerUtilPosix.cpp

if (setitimer(ITIMER_REAL, &T, nullptr)) {
     Printf("libFuzzer: setitimer failed with %d\n", errno);
     exit(1);
   }
   SetSigaction(SIGALRM, AlarmHandler);
 }
 
 void SetSignalHandler(const FuzzingOptions& Options) {
   // setitimer is not implemented in emscripten.
-  if (Options.UnitTimeoutSec > 0 && !LIBFUZZER_EMSCRIPTEN)
+  if (Options.HandleAlrm && Options.UnitTimeoutSec > 0 && !LIBFUZZER_EMSCRIPTEN)
     SetTimer(Options.UnitTimeoutSec / 2 + 1);
   if (Options.HandleInt)
     SetSigaction(SIGINT, InterruptHandler);
   if (Options.HandleTerm)
     SetSigaction(SIGTERM, InterruptHandler);
   if (Options.HandleSegv)
     SetSigaction(SIGSEGV, SegvHandler);
   if (Options.HandleBus)

compiler-rt/lib/fuzzer/FuzzerUtilWindows.cpp

 
 static TimerQ Timer;
 
 static void CrashHandler(int) { Fuzzer::StaticCrashSignalCallback(); }
 
 void SetSignalHandler(const FuzzingOptions& Options) {
   HandlerOpt = &Options;
 
-  if (Options.UnitTimeoutSec > 0)
+  if (Options.HandleAlrm && Options.UnitTimeoutSec > 0)
     Timer.SetTimer(Options.UnitTimeoutSec / 2 + 1);
 
   if (Options.HandleInt || Options.HandleTerm)
     if (!SetConsoleCtrlHandler(CtrlHandler, TRUE)) {
       DWORD LastError = GetLastError();
       Printf("libFuzzer: SetConsoleCtrlHandler failed (Error code: %lu).\n",
         LastError);
       exit(1);

compiler-rt/test/fuzzer/minimize_timeout.test

+RUN: %cpp_compiler %S/TimeoutTest.cpp -o %t-TimeoutTest
+RUN: mkdir -p %t.dir
+
+RUN: echo 'Hi!?' > %t.dir/not_minimal_timeout
+RUN: %run %t-TimeoutTest -minimize_crash=1 %t.dir/not_minimal_timeout -timeout=1 -max_total_time=3 2>&1 | FileCheck %s
+CHECK: CRASH_MIN: failed to minimize beyond {{.*}}minimized-from{{.*}} (3 bytes), exiting