Commit 13b5cee4cce2be7b5d1423fcd59b00ff1807142e | zig

author	Andrew Kelley <andrew@ziglang.org> 2024-08-28 18:06:35-07:00
committer	Andrew Kelley <andrew@ziglang.org> 2024-08-28 18:07:13-07:00
log	13b5cee4cce2be7b5d1423fcd59b00ff1807142e
tree	18102a8fd19ea54f1049ba6a0be522391a2bb7c7
parent	c81219c573f75a2163dfaae5bae7d7373e179f91

fuzzing: fix entry address logic

* the pcs list is unsorted
* use the function address

Fixes entry points in ReleaseSafe mode.

2 files changed, 12 insertions(+), 8 deletions(-)

lib
- compiler
  - test_runner.zig
- std
  - Build
    Fuzz
    WebServer.zig

lib/compiler/test_runner.zig+1-2

...	@@ -166,6 +166,7 @@ fn mainServer() !void {	...	@@ -166,6 +166,7 @@ fn mainServer() !void {
166	if (log_err_count != 0) @panic("error logs detected");	166	if (log_err_count != 0) @panic("error logs detected");
167	if (first) {	167	if (first) {
168	first = false;	168	first = false;
		169	const entry_addr = @intFromPtr(test_fn.func);
169	try server.serveU64Message(.fuzz_start_addr, entry_addr);	170	try server.serveU64Message(.fuzz_start_addr, entry_addr);
170	}	171	}
171	}	172	}
...	@@ -347,7 +348,6 @@ const FuzzerSlice = extern struct {	...	@@ -347,7 +348,6 @@ const FuzzerSlice = extern struct {
347	};	348	};
348		349
349	var is_fuzz_test: bool = undefined;	350	var is_fuzz_test: bool = undefined;
350	var entry_addr: usize = 0;
351		351
352	extern fn fuzzer_next() FuzzerSlice;	352	extern fn fuzzer_next() FuzzerSlice;
353	extern fn fuzzer_init(cache_dir: FuzzerSlice) void;	353	extern fn fuzzer_init(cache_dir: FuzzerSlice) void;
...	@@ -358,7 +358,6 @@ pub fn fuzzInput(options: testing.FuzzInputOptions) []const u8 {	...	@@ -358,7 +358,6 @@ pub fn fuzzInput(options: testing.FuzzInputOptions) []const u8 {
358	if (crippled) return "";	358	if (crippled) return "";
359	is_fuzz_test = true;	359	is_fuzz_test = true;
360	if (builtin.fuzz) {	360	if (builtin.fuzz) {
361	if (entry_addr == 0) entry_addr = @returnAddress();
362	return fuzzer_next().toSlice();	361	return fuzzer_next().toSlice();
363	}	362	}
364	if (options.corpus.len == 0) return "";	363	if (options.corpus.len == 0) return "";

lib/std/Build/Fuzz/WebServer.zig+11-6

 @@ -664,11 +664,16 @@ fn addEntryPoint(ws: *WebServer, coverage_id: u64, addr: u64) error{ AlreadyRepo
     const coverage_map = ws.coverage_files.getPtr(coverage_id).?;
     const header: *const abi.SeenPcsHeader = @ptrCast(coverage_map.mapped_memory[0..@sizeOf(abi.SeenPcsHeader)]);
     const pcs = header.pcAddrs();
-    const index = std.sort.upperBound(usize, pcs, addr, struct {
+    // Since this pcs list is unsorted, we must linear scan for the best index.
-        fn order(context: usize, item: usize) std.math.Order {
+    const index = i: {
-            return std.math.order(item, context);
+        var best: usize = 0;
+        for (pcs[1..], 1..) |elem_addr, i| {
+            if (elem_addr == addr) break :i i;
+            if (elem_addr > addr) continue;
+            if (elem_addr > pcs[best]) best = i;
         }
-    }.order);
+        break :i best;
+    };
     if (index >= pcs.len) {
         log.err("unable to find unit test entry address 0x{x} in source locations (range: 0x{x} to 0x{x})", .{
             addr, pcs[0], pcs[pcs.len - 1],
 @@ -678,8 +683,8 @@ fn addEntryPoint(ws: *WebServer, coverage_id: u64, addr: u64) error{ AlreadyRepo
     if (false) {
         const sl = coverage_map.source_locations[index];
         const file_name = coverage_map.coverage.stringAt(coverage_map.coverage.fileAt(sl.file).basename);
-        log.debug("server found entry point for 0x{x} at {s}:{d}:{d}", .{
+        log.debug("server found entry point for 0x{x} at {s}:{d}:{d} - index {d} between {x} and {x}", .{
-            addr, file_name, sl.line, sl.column,
+            addr, file_name, sl.line, sl.column, index, pcs[index - 1], pcs[index + 1],
         });
     }
     const gpa = ws.gpa;