[libc] Combine all math differential fuzzers into one target.

[sivachandra]

Summary

Also added diffing of a few more math functions. Combining the diff check
for all of these functions helps us meet the OSS fuzz bar of a minimum of
100 program edges.

[sivachandra]

See the discussion here for information on oss-fuzz's minimum program edge requirement: https://github.com/google/oss-fuzz/pull/3418

[lntue]

libc/fuzzing/math/SingleInputSingleOutputDiff.h

38

Why these checks are not isnan(r1) != isnan(r2)
and isinf(r1) != isinf(r2) ?

libc/fuzzing/math/TwoInputSingleOutputDiff.h

40

same comment as SingleInputSingleOutput

[sivachandra]

• Add more functions diffs.
• Address comments.

libc/fuzzing/math/SingleInputSingleOutputDiff.h

38

Doing this in a different way now.

libc/fuzzing/math/TwoInputSingleOutputDiff.h

40

Ditto.

libc/fuzzing/math/CMakeLists.txt

 add_libc_fuzzer(
-  ldexp_differential_fuzz
+  math_differential_fuzz
   SRCS
-    ldexp_differential_fuzz.cpp
+    math_differential_fuzz.cpp
   HDRS
     LdExpDiff.h
+    RemQuoDiff.h
+    SingleInputSingleOutputDiff.h
+    TwoInputSingleOutputDiff.h
   DEPENDS
+    libc.src.math.ceil
+    libc.src.math.ceilf
+    libc.src.math.ceill
+    libc.src.math.floor
+    libc.src.math.floorf
+    libc.src.math.floorl
+    libc.src.math.hypotf
     libc.src.math.ldexp
-    libc.utils.FPUtil.fputil
-)
-
-add_libc_fuzzer(
-  ldexpf_differential_fuzz
-  SRCS
-    ldexpf_differential_fuzz.cpp
-  HDRS
-    LdExpDiff.h
-  DEPENDS
     libc.src.math.ldexpf
-    libc.utils.FPUtil.fputil
-)
-
-add_libc_fuzzer(
-  ldexpl_differential_fuzz
-  SRCS
-    ldexpl_differential_fuzz.cpp
-  HDRS
-    LdExpDiff.h
-  DEPENDS
     libc.src.math.ldexpl
-    libc.utils.FPUtil.fputil
-)
-
-add_libc_fuzzer(
-  remquo_differential_fuzz
-  SRCS
-    remquo_differential_fuzz.cpp
-  HDRS
-    RemQuoDiff.h
-  DEPENDS
+    libc.src.math.sqrt
+    libc.src.math.sqrtf
+    libc.src.math.sqrtl
+    libc.src.math.remainder
+    libc.src.math.remainderf
+    libc.src.math.remainderl
     libc.src.math.remquo
-    libc.utils.FPUtil.fputil
-)
-
-add_libc_fuzzer(
-  remquof_differential_fuzz
-  SRCS
-    remquof_differential_fuzz.cpp
-  HDRS
-    RemQuoDiff.h
-  DEPENDS
     libc.src.math.remquof
-    libc.utils.FPUtil.fputil
-)
-
-add_libc_fuzzer(
-  remquol_differential_fuzz
-  SRCS
-    remquol_differential_fuzz.cpp
-  HDRS
-    RemQuoDiff.h
-  DEPENDS
     libc.src.math.remquol
+    libc.src.math.round
+    libc.src.math.roundf
+    libc.src.math.roundl
+    libc.src.math.trunc
+    libc.src.math.truncf
+    libc.src.math.truncl
     libc.utils.FPUtil.fputil
 )

libc/fuzzing/math/SingleInputSingleOutputDiff.h

+//===-- Template to diff single-input-single-output functions ---*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_LIBC_FUZZING_MATH_SINGLE_INPUT_SINGLE_OUTPUT_DIFF_H
+#define LLVM_LIBC_FUZZING_MATH_SINGLE_INPUT_SINGLE_OUTPUT_DIFF_H
+
+#include "utils/FPUtil/FPBits.h"
+
+#include <math.h>
+#include <stddef.h>
+#include <stdint.h>
+
+template <typename T> using SingleInputSingleOutputFunc = T (*)(T);
+
+template <typename T>
+void SingleInputSingleOutputDiff(SingleInputSingleOutputFunc<T> func1,
+                                 SingleInputSingleOutputFunc<T> func2,
+                                 const uint8_t *data, size_t size) {
+  if (size < sizeof(T))
+    return;
+
+  T x = *reinterpret_cast<const T *>(data);
+
+  T result1 = func1(x);
+  T result2 = func2(x);
+
+  if (isnan(result1)) {
+    if (!isnan(result2))
+      __builtin_trap();
+    return;
+  }
+  if (isinf(result1)) {
+    if (isinf(result2) != isinf(result1))
+      __builtin_trap();
+    return;
+  }
+
+  __llvm_libc::fputil::FPBits<T> bits1(result1);
+  __llvm_libc::fputil::FPBits<T> bits2(result2);
+  if (bits1.bitsAsUInt() != bits2.bitsAsUInt())
+    __builtin_trap();
+}
+
+#endif // LLVM_LIBC_FUZZING_MATH_SINGLE_INPUT_SINGLE_OUTPUT_DIFF_H

libc/fuzzing/math/TwoInputSingleOutputDiff.h

+//===-- Template to diff two-input-single-output functions ------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_LIBC_FUZZING_MATH_TWO_INPUT_SINGLE_OUTPUT_DIFF_H
+#define LLVM_LIBC_FUZZING_MATH_TWO_INPUT_SINGLE_OUTPUT_DIFF_H
+
+#include "utils/FPUtil/FPBits.h"
+
+#include <math.h>
+#include <stddef.h>
+#include <stdint.h>
+
+template <typename T> using TwoInputSingleOutputFunc = T (*)(T, T);
+
+template <typename T>
+void TwoInputSingleOutputDiff(TwoInputSingleOutputFunc<T> func1,
+                              TwoInputSingleOutputFunc<T> func2,
+                              const uint8_t *data, size_t size) {
+  constexpr size_t typeSize = sizeof(T);
+  if (size < 2 * typeSize)
+    return;
+
+  T x = *reinterpret_cast<const T *>(data);
+  T y = *reinterpret_cast<const T *>(data + typeSize);
+
+  T result1 = func1(x, y);
+  T result2 = func2(x, y);
+
+  if (isnan(result1)) {
+    if (!isnan(result2))
+      __builtin_trap();
+    return;
+  }
+  if (isinf(result1)) {
+    if (isinf(result2) != isinf(result1))
+      __builtin_trap();
+    return;
+  }
+
+  __llvm_libc::fputil::FPBits<T> bits1(result1);
+  __llvm_libc::fputil::FPBits<T> bits2(result2);
+  if (bits1.bitsAsUInt() != bits2.bitsAsUInt())
+    __builtin_trap();
+}
+
+#endif // LLVM_LIBC_FUZZING_MATH_TWO_INPUT_SINGLE_OUTPUT_DIFF_H

libc/fuzzing/math/ldexp_differential_fuzz.cpp

-//===-- ldexp_differential_fuzz.cpp ---------------------------------------===//
-//
-// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
-// See https://llvm.org/LICENSE.txt for license information.
-// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-//
-//===----------------------------------------------------------------------===//
-///
-/// Differential fuzz test for llvm-libc ldexp implementation.
-///
-//===----------------------------------------------------------------------===//
-
-#include "fuzzing/math/LdExpDiff.h"
-#include "src/math/ldexp.h"
-
-#include <math.h>
-#include <stddef.h>
-#include <stdint.h>
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
-  LdExpDiff<double>(&__llvm_libc::ldexp, &::ldexp, data, size);
-  return 0;
-}

libc/fuzzing/math/ldexpf_differential_fuzz.cpp

-//===-- ldexpf_differential_fuzz.cpp --------------------------------------===//
-//
-// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
-// See https://llvm.org/LICENSE.txt for license information.
-// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-//
-//===----------------------------------------------------------------------===//
-///
-/// Differential fuzz test for llvm-libc ldexpf implementation.
-///
-//===----------------------------------------------------------------------===//
-
-#include "fuzzing/math/LdExpDiff.h"
-#include "src/math/ldexpf.h"
-
-#include <math.h>
-#include <stddef.h>
-#include <stdint.h>
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
-  LdExpDiff<float>(&__llvm_libc::ldexpf, &::ldexpf, data, size);
-  return 0;
-}

libc/fuzzing/math/ldexpl_differential_fuzz.cpp

-//===-- ldexpl_differential_fuzz.cpp --------------------------------------===//
-//
-// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
-// See https://llvm.org/LICENSE.txt for license information.
-// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-//
-//===----------------------------------------------------------------------===//
-///
-/// Differential fuzz test for llvm-libc ldexpl implementation.
-///
-//===----------------------------------------------------------------------===//
-
-#include "fuzzing/math/LdExpDiff.h"
-#include "src/math/ldexpl.h"
-
-#include <math.h>
-#include <stddef.h>
-#include <stdint.h>
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
-  LdExpDiff<long double>(&__llvm_libc::ldexpl, &::ldexpl, data, size);
-  return 0;
-}

libc/fuzzing/math/math_differential_fuzz.cpp

+//===-- ldexp_differential_fuzz.cpp ---------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+///
+/// Differential fuzz test for llvm-libc ldexp implementation.
+///
+//===----------------------------------------------------------------------===//
+
+#include "fuzzing/math/LdExpDiff.h"
+#include "fuzzing/math/RemQuoDiff.h"
+#include "fuzzing/math/SingleInputSingleOutputDiff.h"
+#include "fuzzing/math/TwoInputSingleOutputDiff.h"
+
+#include "src/math/ceil.h"
+#include "src/math/ceilf.h"
+#include "src/math/ceill.h"
+
+#include "src/math/floor.h"
+#include "src/math/floorf.h"
+#include "src/math/floorl.h"
+
+#include "src/math/hypotf.h"
+
+#include "src/math/ldexp.h"
+#include "src/math/ldexpf.h"
+#include "src/math/ldexpl.h"
+
+#include "src/math/remainder.h"
+#include "src/math/remainderf.h"
+#include "src/math/remainderl.h"
+
+#include "src/math/remquo.h"
+#include "src/math/remquof.h"
+#include "src/math/remquol.h"
+
+#include "src/math/round.h"
+#include "src/math/roundf.h"
+#include "src/math/roundl.h"
+
+#include "src/math/sqrt.h"
+#include "src/math/sqrtf.h"
+#include "src/math/sqrtl.h"
+
+#include "src/math/trunc.h"
+#include "src/math/truncf.h"
+#include "src/math/truncl.h"
+
+#include <math.h>
+#include <stddef.h>
+#include <stdint.h>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  SingleInputSingleOutputDiff<float>(&__llvm_libc::ceilf, &::ceilf, data, size);
+  SingleInputSingleOutputDiff<double>(&__llvm_libc::ceil, &::ceil, data, size);
+  SingleInputSingleOutputDiff<long double>(&__llvm_libc::ceill, &::ceill, data,
+                                           size);
+
+  SingleInputSingleOutputDiff<float>(&__llvm_libc::floorf, &::floorf, data,
+                                     size);
+  SingleInputSingleOutputDiff<double>(&__llvm_libc::floor, &::floor, data,
+                                      size);
+  SingleInputSingleOutputDiff<long double>(&__llvm_libc::floorl, &::floorl,
+                                           data, size);
+
+  SingleInputSingleOutputDiff<float>(&__llvm_libc::roundf, &::roundf, data,
+                                     size);
+  SingleInputSingleOutputDiff<double>(&__llvm_libc::round, &::round, data,
+                                      size);
+  SingleInputSingleOutputDiff<long double>(&__llvm_libc::roundl, &::roundl,
+                                           data, size);
+
+  SingleInputSingleOutputDiff<float>(&__llvm_libc::truncf, &::truncf, data,
+                                     size);
+  SingleInputSingleOutputDiff<double>(&__llvm_libc::trunc, &::trunc, data,
+                                      size);
+  SingleInputSingleOutputDiff<long double>(&__llvm_libc::truncl, &::truncl,
+                                           data, size);
+
+  TwoInputSingleOutputDiff<float>(&__llvm_libc::hypotf, &::hypotf, data, size);
+
+  TwoInputSingleOutputDiff<float>(&__llvm_libc::remainderf, &::remainderf, data,
+                                  size);
+  TwoInputSingleOutputDiff<double>(&__llvm_libc::remainder, &::remainder, data,
+                                   size);
+  TwoInputSingleOutputDiff<long double>(&__llvm_libc::remainderl, &::remainderl,
+                                        data, size);
+
+  SingleInputSingleOutputDiff<float>(&__llvm_libc::sqrtf, &::sqrtf, data, size);
+  SingleInputSingleOutputDiff<double>(&__llvm_libc::sqrt, &::sqrt, data, size);
+  SingleInputSingleOutputDiff<long double>(&__llvm_libc::sqrtl, &::sqrtl, data,
+                                           size);
+
+  LdExpDiff<float>(&__llvm_libc::ldexpf, &::ldexpf, data, size);
+  LdExpDiff<double>(&__llvm_libc::ldexp, &::ldexp, data, size);
+  LdExpDiff<long double>(&__llvm_libc::ldexpl, &::ldexpl, data, size);
+
+  RemQuoDiff<float>(&__llvm_libc::remquof, &::remquof, data, size);
+  RemQuoDiff<double>(&__llvm_libc::remquo, &::remquo, data, size);
+  RemQuoDiff<long double>(&__llvm_libc::remquol, &::remquol, data, size);
+
+  return 0;
+}

libc/fuzzing/math/remquo_differential_fuzz.cpp

-//===-- remquo_differential_fuzz.cpp ---------------------------------------------------===//
-//
-// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
-// See https://llvm.org/LICENSE.txt for license information.
-// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-//
-//===----------------------------------------------------------------------===//
-///
-/// Differential fuzz test for llvm-libc remquo implementation.
-///
-//===----------------------------------------------------------------------===//
-
-#include "fuzzing/math/RemQuoDiff.h"
-#include "src/math/remquo.h"
-
-#include <math.h>
-#include <stddef.h>
-#include <stdint.h>
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
-  RemQuoDiff<double>(&__llvm_libc::remquo, &::remquo, data, size);
-  return 0;
-}

libc/fuzzing/math/remquof_differential_fuzz.cpp

-//===-- remquof_differential_fuzz.cpp --------------------------------------------------===//
-//
-// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
-// See https://llvm.org/LICENSE.txt for license information.
-// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-//
-//===----------------------------------------------------------------------===//
-///
-/// Differential fuzz test for llvm-libc remquof implementation.
-///
-//===----------------------------------------------------------------------===//
-
-#include "fuzzing/math/RemQuoDiff.h"
-#include "src/math/remquof.h"
-
-#include <math.h>
-#include <stddef.h>
-#include <stdint.h>
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
-  RemQuoDiff<float>(&__llvm_libc::remquof, &::remquof, data, size);
-  return 0;
-}

libc/fuzzing/math/remquol_differential_fuzz.cpp

-//===-- remquol_differential_fuzz.cpp --------------------------------------------------===//
-//
-// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
-// See https://llvm.org/LICENSE.txt for license information.
-// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-//
-//===----------------------------------------------------------------------===//
-///
-/// Differential fuzz test for llvm-libc remquol implementation.
-///
-//===----------------------------------------------------------------------===//
-
-#include "fuzzing/math/RemQuoDiff.h"
-#include "src/math/remquol.h"
-
-#include <math.h>
-#include <stddef.h>
-#include <stdint.h>
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
-  RemQuoDiff<long double>(&__llvm_libc::remquol, &::remquol, data, size);
-  return 0;
-}