Add thread annotations.

[aarongreen]

Summary

This change adds wrappers for std::unique_lock and std::recursive_lock and adds thread annotations so the code can be compiled with "-Wthread-safety -D_LIBCPP_ENABLE_THREAD_SAFETY_ANNOTATIONS".

See also https://clang.llvm.org/docs/ThreadSafetyAnalysis.html

[aarongreen]

Rebase

[aarongreen]

Multiprocess fuzzing will not be supported by the libFuzzer maintainers. Fuchsia has implemented a new approach with their Component Fuzzing Framework (RFC-117).

compiler-rt/lib/fuzzer/CMakeLists.txt

set(LIBFUZZER_HEADERS
   FuzzerDSORelative.h
   FuzzerExtFunctions.def
   FuzzerExtFunctions.h
   FuzzerFlags.def
   FuzzerFork.h
   FuzzerIO.h
   FuzzerInterface.h
   FuzzerInternal.h
+  FuzzerLock.h
   FuzzerMerge.h
   FuzzerMonitor.h
   FuzzerMutate.h
   FuzzerOptions.h
   FuzzerRandom.h
   FuzzerSHA1.h
   FuzzerTracePC.h
   FuzzerUtil.h
CHECK_CXX_SOURCE_COMPILES("
   " HAS_THREAD_LOCAL)
 
 set(LIBFUZZER_CFLAGS ${COMPILER_RT_COMMON_CFLAGS})
 
 if(OS_NAME MATCHES "Linux|Fuchsia" AND
    COMPILER_RT_LIBCXX_PATH AND
    COMPILER_RT_LIBCXXABI_PATH)
   list(APPEND LIBFUZZER_CFLAGS -D_LIBCPP_ABI_VERSION=Fuzzer)
+  list(APPEND LIBFUZZER_CFLAGS -D_LIBCPP_ABI_VERSION=Fuzzer)
   append_list_if(COMPILER_RT_HAS_NOSTDINCXX_FLAG -nostdinc++ LIBFUZZER_CFLAGS)
 elseif(TARGET cxx-headers OR HAVE_LIBCXX)
   # libFuzzer uses C++ standard library headers.
   set(LIBFUZZER_DEPS cxx-headers)
 endif()
 
 append_list_if(COMPILER_RT_HAS_OMIT_FRAME_POINTER_FLAG -fno-omit-frame-pointer LIBFUZZER_CFLAGS)
 
 if (CMAKE_CXX_FLAGS MATCHES "fsanitize-coverage")
   list(APPEND LIBFUZZER_CFLAGS -fno-sanitize-coverage=trace-pc-guard,edge,trace-cmp,indirect-calls,8bit-counters)
 endif()
 
 if(MSVC)
   # Silence warnings by turning off exceptions in MSVC headers and avoid an
   # error by unecessarily defining thread_local when it isn't even used on
   # Windows.
   list(APPEND LIBFUZZER_CFLAGS -D_HAS_EXCEPTIONS=0)
 else()
   if(NOT HAS_THREAD_LOCAL)
     list(APPEND LIBFUZZER_CFLAGS -Dthread_local=__thread)
   endif()
 endif()
 
+list(APPEND LIBFUZZER_CFLAGS -D_LIBCPP_ENABLE_THREAD_SAFETY_ANNOTATIONS)
+
 add_compiler_rt_component(fuzzer)
 
 add_compiler_rt_object_libraries(RTfuzzer
   OS ${FUZZER_SUPPORTED_OS}
   ARCHS ${FUZZER_SUPPORTED_ARCH}
   SOURCES ${LIBFUZZER_SOURCES}
   ADDITIONAL_HEADERS ${LIBFUZZER_HEADERS}
   CFLAGS ${LIBFUZZER_CFLAGS}

compiler-rt/lib/fuzzer/FuzzerDefs.h

 int FuzzerDriver(int *argc, char ***argv, UserCallback Callback);
 
 uint8_t *ExtraCountersBegin();
 uint8_t *ExtraCountersEnd();
 void ClearExtraCounters();
 
 extern bool RunningUserCallback;
 
+// Macros to delete copy and/or move constructors
+#define FUZZER_NO_COPY(Type)                                                   \
+  Type(const Type &) = delete;                                                 \
+  Type &operator=(const Type &) = delete;
+#define FUZZER_NO_MOVE(Type)                                                   \
+  Type(Type &&) = delete;                                                      \
+  Type &operator=(Type &&) = delete;
+#define FUZZER_NO_COPY_OR_MOVE(Type)                                           \
+  FUZZER_NO_COPY(Type);                                                        \
+  FUZZER_NO_MOVE(Type);
+
 }  // namespace fuzzer
 
 #endif  // LLVM_FUZZER_DEFS_H

compiler-rt/lib/fuzzer/FuzzerLock.h

+//===-- FuzzerLock.h ------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+// Thread annotation wrappers for std::unique_lock and std::recursize_lock.
+//
+// These wrappers are minimal. They only add methods for the respective lock
+// types as they are used.
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_FUZZER_LOCK_H
+#define LLVM_FUZZER_LOCK_H
+
+#include "FuzzerDefs.h"
+#include <mutex>
+
+// Enable thread safety attributes only with clang.
+// The attributes can be safely erased when compiling with other compilers.
+#if defined(__clang__) && (!defined(SWIG))
+#define THREAD_ANNOTATION_ATTRIBUTE__(x) __attribute__((x))
+#else
+#define THREAD_ANNOTATION_ATTRIBUTE__(x) // no-op
+#endif
+
+#define CAPABILITY(x) THREAD_ANNOTATION_ATTRIBUTE__(capability(x))
+#define SCOPED_CAPABILITY THREAD_ANNOTATION_ATTRIBUTE__(scoped_lockable)
+#define GUARDED_BY(x) THREAD_ANNOTATION_ATTRIBUTE__(guarded_by(x))
+#define REQUIRES(...)                                                          \
+  THREAD_ANNOTATION_ATTRIBUTE__(requires_capability(__VA_ARGS__))
+#define ACQUIRE(...)                                                           \
+  THREAD_ANNOTATION_ATTRIBUTE__(acquire_capability(__VA_ARGS__))
+#define RELEASE(...)                                                           \
+  THREAD_ANNOTATION_ATTRIBUTE__(release_capability(__VA_ARGS__))
+#define EXCLUDES(...) THREAD_ANNOTATION_ATTRIBUTE__(locks_excluded(__VA_ARGS__))
+#define RETURN_CAPABILITY(x) THREAD_ANNOTATION_ATTRIBUTE__(lock_returned(x))
+
+namespace fuzzer {
+
+// Minimal wrapper for std::unique_lock.
+class SCOPED_CAPABILITY UniqueLock final {
+public:
+  explicit UniqueLock(std::mutex &Mutex) ACQUIRE(Mutex) : Lock(Mutex) {}
+  ~UniqueLock() RELEASE() {}
+  operator bool() const { return Lock.owns_lock(); }
+  std::unique_lock<std::mutex> &get() { return Lock; }
+  std::mutex *release() { return Lock.release(); }
+
+private:
+  std::unique_lock<std::mutex> Lock;
+  FUZZER_NO_COPY_OR_MOVE(UniqueLock);
+};
+
+// Minimal wrapper for std::recursive_mutex.
+class CAPABILITY("recursive_mutex") RecursiveMutex final {
+public:
+  RecursiveMutex() = default;
+  ~RecursiveMutex() = default;
+  void lock() ACQUIRE() { Mutex.lock(); }
+  void unlock() RELEASE() { Mutex.unlock(); }
+
+private:
+  std::recursive_mutex Mutex;
+  FUZZER_NO_COPY_OR_MOVE(RecursiveMutex);
+};
+
+} // namespace fuzzer
+
+#endif // LLVM_FUZZER_LOCK_H

compiler-rt/lib/fuzzer/FuzzerMonitor.cpp

 //===- FuzzerMonitor.cpp ----------------------------------------*- C++ -* ===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 // Defines an interface for tracing mallocs and frees.
 //===----------------------------------------------------------------------===//
 
 #include "FuzzerMonitor.h"
 #include "FuzzerExtFunctions.h"
 #include "FuzzerIO.h"
+#include "FuzzerLock.h"
 #include "FuzzerPlatform.h"
 #include "FuzzerUtil.h"
 #include <atomic>
 #include <chrono>
 #include <mutex>
 
 namespace fuzzer {
 namespace {
void Purge() {
     LastPurgeAttempt = Now;
   }
 
   size_t MallocLimit;
   std::atomic<size_t> Mallocs;
   std::atomic<size_t> Frees;
   int TraceLevel = 0;
 
-  std::recursive_mutex TraceMutex;
-  bool TraceDisabled;
+  RecursiveMutex TraceMutex;
+  bool TraceDisabled GUARDED_BY(TraceMutex);
 
   size_t RssLimitMb;
   int PurgeIntervalSec;
   std::chrono::system_clock::time_point LastPurgeAttempt =
       std::chrono::system_clock::now();
 
 } AllocMonitor;
 
 // Locks printing and avoids nested hooks triggered from mallocs/frees in
 // sanitizer.
-class TraceLock {
+class SCOPED_CAPABILITY TraceLock {
 public:
-  TraceLock() : Lock(AllocMonitor.TraceMutex) {
+  TraceLock() ACQUIRE(AllocMonitor.TraceMutex) : Lock(AllocMonitor.TraceMutex) {
     AllocMonitor.TraceDisabled = !AllocMonitor.TraceDisabled;
   }
-  ~TraceLock() { AllocMonitor.TraceDisabled = !AllocMonitor.TraceDisabled; }
 
-  bool IsDisabled() const {
+  ~TraceLock() RELEASE() {
+    AllocMonitor.TraceDisabled = !AllocMonitor.TraceDisabled;
+  }
+
+  bool IsDisabled() const REQUIRES(AllocMonitor.TraceMutex) {
     // This is already inverted value.
     return !AllocMonitor.TraceDisabled;
   }
 
 private:
-  std::lock_guard<std::recursive_mutex> Lock;
+  std::lock_guard<RecursiveMutex> Lock;
 };
 
 ATTRIBUTE_NO_SANITIZE_MEMORY
 void MallocHook(const volatile void *ptr, size_t size) {
   size_t N = AllocMonitor.Mallocs++;
   if (AllocMonitor.MallocLimit && size >= AllocMonitor.MallocLimit)
     FuzzerMallocLimitCallback(0, size);
   if (int TraceLevel = AllocMonitor.TraceLevel) {