| ... | ... | @@ -1,532 +1,1275 @@ |
| 1 | 1 | const builtin = @import("builtin"); |
| 2 | 2 | const std = @import("std"); |
| 3 | | const Allocator = std.mem.Allocator; |
| 3 | const mem = std.mem; |
| 4 | const math = std.math; |
| 5 | const Allocator = mem.Allocator; |
| 4 | 6 | const assert = std.debug.assert; |
| 5 | | const fatal = std.process.fatal; |
| 6 | | const SeenPcsHeader = std.Build.abi.fuzz.SeenPcsHeader; |
| 7 | const panic = std.debug.panic; |
| 8 | const abi = std.Build.abi.fuzz; |
| 9 | const native_endian = builtin.cpu.arch.endian(); |
| 7 | 10 | |
| 8 | 11 | pub const std_options = std.Options{ |
| 9 | 12 | .logFn = logOverride, |
| 10 | 13 | }; |
| 11 | 14 | |
| 12 | | var log_file_buffer: [256]u8 = undefined; |
| 13 | | var log_file_writer: ?std.fs.File.Writer = null; |
| 14 | | |
| 15 | 15 | fn logOverride( |
| 16 | 16 | comptime level: std.log.Level, |
| 17 | 17 | comptime scope: @Type(.enum_literal), |
| 18 | 18 | comptime format: []const u8, |
| 19 | 19 | args: anytype, |
| 20 | 20 | ) void { |
| 21 | | const fw = if (log_file_writer) |*f| f else f: { |
| 22 | | const f = fuzzer.cache_dir.createFile("tmp/libfuzzer.log", .{}) catch |
| 23 | | @panic("failed to open fuzzer log file"); |
| 24 | | log_file_writer = f.writer(&log_file_buffer); |
| 25 | | break :f &log_file_writer.?; |
| 26 | | }; |
| 21 | const f = log_f orelse |
| 22 | panic("attempt to use log before initialization, message:\n" ++ format, args); |
| 23 | f.lock(.exclusive) catch |e| panic("failed to lock logging file: {t}", .{e}); |
| 24 | defer f.unlock(); |
| 25 | |
| 26 | var buf: [256]u8 = undefined; |
| 27 | var fw = f.writer(&buf); |
| 28 | const end = f.getEndPos() catch |e| panic("failed to get fuzzer log file end: {t}", .{e}); |
| 29 | fw.seekTo(end) catch |e| panic("failed to seek to fuzzer log file end: {t}", .{e}); |
| 30 | |
| 27 | 31 | const prefix1 = comptime level.asText(); |
| 28 | 32 | const prefix2 = if (scope == .default) ": " else "(" ++ @tagName(scope) ++ "): "; |
| 29 | | fw.interface.print(prefix1 ++ prefix2 ++ format ++ "\n", args) catch |
| 30 | | @panic("failed to write to fuzzer log"); |
| 31 | | fw.interface.flush() catch @panic("failed to flush fuzzer log"); |
| 33 | fw.interface.print( |
| 34 | "[{s}] " ++ prefix1 ++ prefix2 ++ format ++ "\n", |
| 35 | .{current_test_name orelse "setup"} ++ args, |
| 36 | ) catch panic("failed to write to fuzzer log: {t}", .{fw.err.?}); |
| 37 | fw.interface.flush() catch panic("failed to write to fuzzer log: {t}", .{fw.err.?}); |
| 32 | 38 | } |
| 33 | 39 | |
| 34 | | /// Helps determine run uniqueness in the face of recursion. |
| 35 | | export threadlocal var __sancov_lowest_stack: usize = 0; |
| 40 | var debug_allocator: std.heap.DebugAllocator(.{}) = .init; |
| 41 | const gpa = switch (builtin.mode) { |
| 42 | .Debug => debug_allocator.allocator(), |
| 43 | .ReleaseFast, .ReleaseSmall, .ReleaseSafe => std.heap.smp_allocator, |
| 44 | }; |
| 36 | 45 | |
| 37 | | export fn __sanitizer_cov_trace_const_cmp1(arg1: u8, arg2: u8) void { |
| 38 | | handleCmp(@returnAddress(), arg1, arg2); |
| 39 | | } |
| 46 | /// Part of `exec`, however seperate to allow it to be set before `exec` is. |
| 47 | var log_f: ?std.fs.File = null; |
| 48 | var exec: Executable = .preinit; |
| 49 | var inst: Instrumentation = .preinit; |
| 50 | var fuzzer: Fuzzer = undefined; |
| 51 | var current_test_name: ?[]const u8 = null; |
| 40 | 52 | |
| 41 | | export fn __sanitizer_cov_trace_cmp1(arg1: u8, arg2: u8) void { |
| 42 | | handleCmp(@returnAddress(), arg1, arg2); |
| 53 | fn bitsetUsizes(elems: usize) usize { |
| 54 | return math.divCeil(usize, elems, @bitSizeOf(usize)) catch unreachable; |
| 43 | 55 | } |
| 44 | 56 | |
| 45 | | export fn __sanitizer_cov_trace_const_cmp2(arg1: u16, arg2: u16) void { |
| 46 | | handleCmp(@returnAddress(), arg1, arg2); |
| 47 | | } |
| 57 | const Executable = struct { |
| 58 | /// Tracks the hit count for each pc as updated by the process's instrumentation. |
| 59 | pc_counters: []u8, |
| 48 | 60 | |
| 49 | | export fn __sanitizer_cov_trace_cmp2(arg1: u16, arg2: u16) void { |
| 50 | | handleCmp(@returnAddress(), arg1, arg2); |
| 51 | | } |
| 61 | cache_f: std.fs.Dir, |
| 62 | /// Shared copy of all pcs that have been hit stored in a memory-mapped file that can viewed |
| 63 | /// while the fuzzer is running. |
| 64 | shared_seen_pcs: MemoryMappedList, |
| 65 | /// Hash of pcs used to uniquely identify the shared coverage file |
| 66 | pc_digest: u64, |
| 67 | |
| 68 | /// A minimal state for this struct which instrumentation can function on. |
| 69 | /// Used before this structure is initialized to avoid illegal behavior |
| 70 | /// from instrumentation functions being called and using undefined values. |
| 71 | pub const preinit: Executable = .{ |
| 72 | .pc_counters = undefined, // instrumentation works off the __sancov_cntrs section |
| 73 | .cache_f = undefined, |
| 74 | .shared_seen_pcs = undefined, |
| 75 | .pc_digest = undefined, |
| 76 | }; |
| 52 | 77 | |
| 53 | | export fn __sanitizer_cov_trace_const_cmp4(arg1: u32, arg2: u32) void { |
| 54 | | handleCmp(@returnAddress(), arg1, arg2); |
| 55 | | } |
| 78 | fn getCoverageFile(cache_dir: std.fs.Dir, pcs: []const usize, pc_digest: u64) MemoryMappedList { |
| 79 | const pc_bitset_usizes = bitsetUsizes(pcs.len); |
| 80 | const coverage_file_name = std.fmt.hex(pc_digest); |
| 81 | comptime assert(abi.SeenPcsHeader.trailing[0] == .pc_bits_usize); |
| 82 | comptime assert(abi.SeenPcsHeader.trailing[1] == .pc_addr); |
| 56 | 83 | |
| 57 | | export fn __sanitizer_cov_trace_cmp4(arg1: u32, arg2: u32) void { |
| 58 | | handleCmp(@returnAddress(), arg1, arg2); |
| 59 | | } |
| 84 | var v = cache_dir.makeOpenPath("v", .{}) catch |e| |
| 85 | panic("failed to create directory 'v': {t}", .{e}); |
| 86 | defer v.close(); |
| 87 | const coverage_file, const populate = if (v.createFile(&coverage_file_name, .{ |
| 88 | .read = true, |
| 89 | // If we create the file, we want to block other processes while we populate it |
| 90 | .lock = .exclusive, |
| 91 | .exclusive = true, |
| 92 | })) |f| |
| 93 | .{ f, true } |
| 94 | else |e| switch (e) { |
| 95 | error.PathAlreadyExists => .{ v.openFile(&coverage_file_name, .{ |
| 96 | .mode = .read_write, |
| 97 | .lock = .shared, |
| 98 | }) catch |e2| panic( |
| 99 | "failed to open existing coverage file '{s}': {t}", |
| 100 | .{ &coverage_file_name, e2 }, |
| 101 | ), false }, |
| 102 | else => panic("failed to create coverage file '{s}': {t}", .{ &coverage_file_name, e }), |
| 103 | }; |
| 60 | 104 | |
| 61 | | export fn __sanitizer_cov_trace_const_cmp8(arg1: u64, arg2: u64) void { |
| 62 | | handleCmp(@returnAddress(), arg1, arg2); |
| 63 | | } |
| 105 | const coverage_file_len = @sizeOf(abi.SeenPcsHeader) + |
| 106 | pc_bitset_usizes * @sizeOf(usize) + |
| 107 | pcs.len * @sizeOf(usize); |
| 108 | if (populate) { |
| 109 | defer coverage_file.lock(.shared) catch |e| panic( |
| 110 | "failed to demote lock for coverage file '{s}': {t}", |
| 111 | .{ &coverage_file_name, e }, |
| 112 | ); |
| 113 | var map = MemoryMappedList.create(coverage_file, 0, coverage_file_len) catch |e| panic( |
| 114 | "failed to init memory map for coverage file '{s}': {t}", |
| 115 | .{ &coverage_file_name, e }, |
| 116 | ); |
| 117 | map.appendSliceAssumeCapacity(mem.asBytes(&abi.SeenPcsHeader{ |
| 118 | .n_runs = 0, |
| 119 | .unique_runs = 0, |
| 120 | .pcs_len = pcs.len, |
| 121 | })); |
| 122 | map.appendNTimesAssumeCapacity(0, pc_bitset_usizes * @sizeOf(usize)); |
| 123 | map.appendSliceAssumeCapacity(mem.sliceAsBytes(pcs)); |
| 124 | return map; |
| 125 | } else { |
| 126 | const size = coverage_file.getEndPos() catch |e| panic( |
| 127 | "failed to stat coverage file '{s}': {t}", |
| 128 | .{ &coverage_file_name, e }, |
| 129 | ); |
| 130 | if (size != coverage_file_len) panic( |
| 131 | "incompatible existing coverage file '{s}' (differing lengths: {} != {})", |
| 132 | .{ &coverage_file_name, size, coverage_file_len }, |
| 133 | ); |
| 134 | |
| 135 | const map = MemoryMappedList.init( |
| 136 | coverage_file, |
| 137 | coverage_file_len, |
| 138 | coverage_file_len, |
| 139 | ) catch |e| panic( |
| 140 | "failed to init memory map for coverage file '{s}': {t}", |
| 141 | .{ &coverage_file_name, e }, |
| 142 | ); |
| 143 | |
| 144 | const seen_pcs_header: *const abi.SeenPcsHeader = @ptrCast(@volatileCast(map.items)); |
| 145 | if (seen_pcs_header.pcs_len != pcs.len) panic( |
| 146 | "incompatible existing coverage file '{s}' (differing pcs length: {} != {})", |
| 147 | .{ &coverage_file_name, seen_pcs_header.pcs_len, pcs.len }, |
| 148 | ); |
| 149 | if (mem.indexOfDiff(usize, seen_pcs_header.pcAddrs(), pcs)) |i| panic( |
| 150 | "incompatible existing coverage file '{s}' (differing pc at index {d}: {x} != {x})", |
| 151 | .{ &coverage_file_name, i, seen_pcs_header.pcAddrs()[i], pcs[i] }, |
| 152 | ); |
| 153 | |
| 154 | return map; |
| 155 | } |
| 156 | } |
| 64 | 157 | |
| 65 | | export fn __sanitizer_cov_trace_cmp8(arg1: u64, arg2: u64) void { |
| 66 | | handleCmp(@returnAddress(), arg1, arg2); |
| 67 | | } |
| 158 | pub fn init(cache_dir_path: []const u8) Executable { |
| 159 | var self: Executable = undefined; |
| 68 | 160 | |
| 69 | | export fn __sanitizer_cov_trace_switch(val: u64, cases_ptr: [*]u64) void { |
| 70 | | const pc = @returnAddress(); |
| 71 | | const len = cases_ptr[0]; |
| 72 | | const val_size_in_bits = cases_ptr[1]; |
| 73 | | const cases = cases_ptr[2..][0..len]; |
| 74 | | fuzzer.traceValue(pc ^ val); |
| 75 | | _ = val_size_in_bits; |
| 76 | | _ = cases; |
| 77 | | //std.log.debug("0x{x}: switch on value {d} ({d} bits) with {d} cases", .{ |
| 78 | | // pc, val, val_size_in_bits, cases.len, |
| 79 | | //}); |
| 80 | | } |
| 161 | const cache_dir = std.fs.cwd().makeOpenPath(cache_dir_path, .{}) catch |e| panic( |
| 162 | "failed to open directory '{s}': {t}", |
| 163 | .{ cache_dir_path, e }, |
| 164 | ); |
| 165 | log_f = cache_dir.createFile("tmp/libfuzzer.log", .{ .truncate = false }) catch |e| |
| 166 | panic("failed to create file 'tmp/libfuzzer.log': {t}", .{e}); |
| 167 | self.cache_f = cache_dir.makeOpenPath("f", .{}) catch |e| |
| 168 | panic("failed to open directory 'f': {t}", .{e}); |
| 169 | |
| 170 | // Linkers are expected to automatically add symbols prefixed with these for the start and |
| 171 | // end of sections whose names are valid C identifiers. |
| 172 | const ofmt = builtin.object_format; |
| 173 | const section_start_prefix, const section_end_prefix = switch (ofmt) { |
| 174 | .elf => .{ "__start_", "__stop_" }, |
| 175 | .macho => .{ "\x01section$start$__DATA$", "\x01section$end$__DATA$" }, |
| 176 | else => @compileError("unsupported fuzzing object format '" ++ @tagName(ofmt) ++ "'"), |
| 177 | }; |
| 81 | 178 | |
| 82 | | export fn __sanitizer_cov_trace_pc_indir(callee: usize) void { |
| 83 | | // Not valuable because we already have pc tracing via 8bit counters. |
| 84 | | _ = callee; |
| 85 | | //const pc = @returnAddress(); |
| 86 | | //fuzzer.traceValue(pc ^ callee); |
| 87 | | //std.log.debug("0x{x}: indirect call to 0x{x}", .{ pc, callee }); |
| 88 | | } |
| 89 | | export fn __sanitizer_cov_8bit_counters_init(start: usize, end: usize) void { |
| 90 | | // clang will emit a call to this function when compiling with code coverage instrumentation. |
| 91 | | // however fuzzer_init() does not need this information, since it directly reads from the symbol table. |
| 92 | | _ = start; |
| 93 | | _ = end; |
| 94 | | } |
| 95 | | export fn __sanitizer_cov_pcs_init(start: usize, end: usize) void { |
| 96 | | // clang will emit a call to this function when compiling with code coverage instrumentation. |
| 97 | | // however fuzzer_init() does not need this information, since it directly reads from the symbol table. |
| 98 | | _ = start; |
| 99 | | _ = end; |
| 100 | | } |
| 179 | self.pc_counters = blk: { |
| 180 | const pc_counters_start_name = section_start_prefix ++ "__sancov_cntrs"; |
| 181 | const pc_counters_start = @extern([*]u8, .{ |
| 182 | .name = pc_counters_start_name, |
| 183 | .linkage = .weak, |
| 184 | }) orelse panic("missing {s} symbol", .{pc_counters_start_name}); |
| 101 | 185 | |
| 102 | | fn handleCmp(pc: usize, arg1: u64, arg2: u64) void { |
| 103 | | fuzzer.traceValue(pc ^ arg1 ^ arg2); |
| 104 | | //std.log.debug("0x{x}: comparison of {d} and {d}", .{ pc, arg1, arg2 }); |
| 105 | | } |
| 186 | const pc_counters_end_name = section_end_prefix ++ "__sancov_cntrs"; |
| 187 | const pc_counters_end = @extern([*]u8, .{ |
| 188 | .name = pc_counters_end_name, |
| 189 | .linkage = .weak, |
| 190 | }) orelse panic("missing {s} symbol", .{pc_counters_end_name}); |
| 106 | 191 | |
| 107 | | const Fuzzer = struct { |
| 108 | | rng: std.Random.DefaultPrng, |
| 109 | | pcs: []const usize, |
| 110 | | pc_counters: []u8, |
| 111 | | n_runs: usize, |
| 112 | | traced_comparisons: std.AutoArrayHashMapUnmanaged(usize, void), |
| 113 | | /// Tracks which PCs have been seen across all runs that do not crash the fuzzer process. |
| 114 | | /// Stored in a memory-mapped file so that it can be shared with other |
| 115 | | /// processes and viewed while the fuzzer is running. |
| 116 | | seen_pcs: MemoryMappedList, |
| 117 | | cache_dir: std.fs.Dir, |
| 118 | | /// Identifies the file name that will be used to store coverage |
| 119 | | /// information, available to other processes. |
| 120 | | coverage_id: u64, |
| 121 | | unit_test_name: []const u8, |
| 122 | | |
| 123 | | /// The index corresponds to the file name within the f/ subdirectory. |
| 124 | | /// The string is the input. |
| 125 | | /// This data is read-only; it caches what is on the filesystem. |
| 126 | | corpus: std.ArrayListUnmanaged(Input), |
| 127 | | corpus_directory: std.Build.Cache.Directory, |
| 192 | break :blk pc_counters_start[0 .. pc_counters_end - pc_counters_start]; |
| 193 | }; |
| 128 | 194 | |
| 129 | | /// The next input that will be given to the testOne function. When the |
| 130 | | /// current process crashes, this memory-mapped file is used to recover the |
| 131 | | /// input. |
| 132 | | /// |
| 133 | | /// The file size corresponds to the capacity. The length is not stored |
| 134 | | /// and that is the next thing to work on! |
| 135 | | input: MemoryMappedList, |
| 195 | const pcs = blk: { |
| 196 | const pcs_start_name = section_start_prefix ++ "__sancov_pcs1"; |
| 197 | const pcs_start = @extern([*]usize, .{ |
| 198 | .name = pcs_start_name, |
| 199 | .linkage = .weak, |
| 200 | }) orelse panic("missing {s} symbol", .{pcs_start_name}); |
| 136 | 201 | |
| 137 | | const Input = struct { |
| 138 | | bytes: []u8, |
| 139 | | last_traced_comparison: usize, |
| 140 | | }; |
| 202 | const pcs_end_name = section_end_prefix ++ "__sancov_pcs1"; |
| 203 | const pcs_end = @extern([*]usize, .{ |
| 204 | .name = pcs_end_name, |
| 205 | .linkage = .weak, |
| 206 | }) orelse panic("missing {s} symbol", .{pcs_end_name}); |
| 207 | |
| 208 | break :blk pcs_start[0 .. pcs_end - pcs_start]; |
| 209 | }; |
| 141 | 210 | |
| 142 | | const Slice = extern struct { |
| 143 | | ptr: [*]const u8, |
| 144 | | len: usize, |
| 211 | if (self.pc_counters.len != pcs.len) panic( |
| 212 | "pc counters length and pcs length do not match ({} != {})", |
| 213 | .{ self.pc_counters.len, pcs.len }, |
| 214 | ); |
| 145 | 215 | |
| 146 | | fn toZig(s: Slice) []const u8 { |
| 147 | | return s.ptr[0..s.len]; |
| 148 | | } |
| 216 | self.pc_digest = std.hash.Wyhash.hash(0, mem.sliceAsBytes(pcs)); |
| 217 | self.shared_seen_pcs = getCoverageFile(cache_dir, pcs, self.pc_digest); |
| 149 | 218 | |
| 150 | | fn fromZig(s: []const u8) Slice { |
| 151 | | return .{ |
| 152 | | .ptr = s.ptr, |
| 153 | | .len = s.len, |
| 154 | | }; |
| 219 | return self; |
| 220 | } |
| 221 | |
| 222 | pub fn pcBitsetIterator(self: Executable) PcBitsetIterator { |
| 223 | return .{ .pc_counters = self.pc_counters }; |
| 224 | } |
| 225 | |
| 226 | /// Iterates over pc_counters returning a bitset for if each of them have been hit |
| 227 | pub const PcBitsetIterator = struct { |
| 228 | index: usize = 0, |
| 229 | pc_counters: []u8, |
| 230 | |
| 231 | pub fn next(self: *PcBitsetIterator) usize { |
| 232 | const rest = self.pc_counters[self.index..]; |
| 233 | if (rest.len >= @bitSizeOf(usize)) { |
| 234 | defer self.index += @bitSizeOf(usize); |
| 235 | const V = @Vector(@bitSizeOf(usize), u8); |
| 236 | return @as(usize, @bitCast(@as(V, @splat(0)) != rest[0..@bitSizeOf(usize)].*)); |
| 237 | } else if (rest.len != 0) { |
| 238 | defer self.index += rest.len; |
| 239 | var res: usize = 0; |
| 240 | for (0.., rest) |bit_index, byte| { |
| 241 | res |= @shlExact(@as(usize, @intFromBool(byte != 0)), @intCast(bit_index)); |
| 242 | } |
| 243 | return res; |
| 244 | } else unreachable; |
| 155 | 245 | } |
| 156 | 246 | }; |
| 247 | }; |
| 157 | 248 | |
| 158 | | fn init(f: *Fuzzer, cache_dir: std.fs.Dir, pc_counters: []u8, pcs: []const usize) !void { |
| 159 | | f.cache_dir = cache_dir; |
| 160 | | f.pc_counters = pc_counters; |
| 161 | | f.pcs = pcs; |
| 162 | | |
| 163 | | // Choose a file name for the coverage based on a hash of the PCs that will be stored within. |
| 164 | | const pc_digest = std.hash.Wyhash.hash(0, std.mem.sliceAsBytes(pcs)); |
| 165 | | f.coverage_id = pc_digest; |
| 166 | | const hex_digest = std.fmt.hex(pc_digest); |
| 167 | | const coverage_file_path = "v/" ++ hex_digest; |
| 168 | | |
| 169 | | // Layout of this file: |
| 170 | | // - Header |
| 171 | | // - list of PC addresses (usize elements) |
| 172 | | // - list of hit flag, 1 bit per address (stored in u8 elements) |
| 173 | | const coverage_file = createFileBail(cache_dir, coverage_file_path, .{ |
| 174 | | .read = true, |
| 175 | | .truncate = false, |
| 176 | | }); |
| 177 | | const n_bitset_elems = (pcs.len + @bitSizeOf(usize) - 1) / @bitSizeOf(usize); |
| 178 | | comptime assert(SeenPcsHeader.trailing[0] == .pc_bits_usize); |
| 179 | | comptime assert(SeenPcsHeader.trailing[1] == .pc_addr); |
| 180 | | const bytes_len = @sizeOf(SeenPcsHeader) + |
| 181 | | n_bitset_elems * @sizeOf(usize) + |
| 182 | | pcs.len * @sizeOf(usize); |
| 183 | | const existing_len = coverage_file.getEndPos() catch |err| { |
| 184 | | fatal("unable to check len of coverage file: {s}", .{@errorName(err)}); |
| 249 | /// Data gathered from instrumentation functions. |
| 250 | /// Seperate from Executable since its state is resetable and changes. |
| 251 | /// Seperate from Fuzzer since it may be needed before fuzzing starts. |
| 252 | const Instrumentation = struct { |
| 253 | /// Bitset of seen pcs across all runs excluding fresh pcs. |
| 254 | /// This is seperate then shared_seen_pcs because multiple fuzzing processes are likely using |
| 255 | /// it which causes contention and unrelated pcs to our campaign being set. |
| 256 | seen_pcs: []usize, |
| 257 | |
| 258 | /// Stores a fresh input's new pcs |
| 259 | fresh_pcs: []usize, |
| 260 | |
| 261 | /// Pcs which __sanitizer_cov_trace_switch and __sanitizer_cov_trace_const_cmpx |
| 262 | /// have been called from and have had their already been added to const_x_vals |
| 263 | const_pcs: std.AutoArrayHashMapUnmanaged(usize, void) = .empty, |
| 264 | /// Values that have been constant operands in comparisons and switch cases. |
| 265 | /// There may be duplicates in this array if they came from different addresses, which is |
| 266 | /// fine as they are likely more important and hence more likely to be selected. |
| 267 | const_vals2: std.ArrayListUnmanaged(u16) = .empty, |
| 268 | const_vals4: std.ArrayListUnmanaged(u32) = .empty, |
| 269 | const_vals8: std.ArrayListUnmanaged(u64) = .empty, |
| 270 | const_vals16: std.ArrayListUnmanaged(u128) = .empty, |
| 271 | |
| 272 | /// A minimal state for this struct which instrumentation can function on. |
| 273 | /// Used before this structure is initialized to avoid illegal behavior |
| 274 | /// from instrumentation functions being called and using undefined values. |
| 275 | pub const preinit: Instrumentation = .{ |
| 276 | .seen_pcs = undefined, // currently only updated by `Fuzzer` |
| 277 | .fresh_pcs = undefined, |
| 278 | }; |
| 279 | |
| 280 | pub fn depreinit(self: *Instrumentation) void { |
| 281 | self.const_vals2.deinit(gpa); |
| 282 | self.const_vals4.deinit(gpa); |
| 283 | self.const_vals8.deinit(gpa); |
| 284 | self.const_vals16.deinit(gpa); |
| 285 | self.* = undefined; |
| 286 | } |
| 287 | |
| 288 | pub fn init() Instrumentation { |
| 289 | const pc_bitset_usizes = bitsetUsizes(exec.pc_counters.len); |
| 290 | const alloc_usizes = pc_bitset_usizes * 2; |
| 291 | const buf = gpa.alloc(u8, alloc_usizes * @sizeOf(usize)) catch @panic("OOM"); |
| 292 | var fba_ctx: std.heap.FixedBufferAllocator = .init(buf); |
| 293 | const fba = fba_ctx.allocator(); |
| 294 | |
| 295 | var self: Instrumentation = .{ |
| 296 | .seen_pcs = fba.alloc(usize, pc_bitset_usizes) catch unreachable, |
| 297 | .fresh_pcs = fba.alloc(usize, pc_bitset_usizes) catch unreachable, |
| 185 | 298 | }; |
| 186 | | if (existing_len == 0) { |
| 187 | | coverage_file.setEndPos(bytes_len) catch |err| { |
| 188 | | fatal("unable to set len of coverage file: {s}", .{@errorName(err)}); |
| 189 | | }; |
| 190 | | } else if (existing_len != bytes_len) { |
| 191 | | fatal("incompatible existing coverage file (differing lengths)", .{}); |
| 299 | self.reset(); |
| 300 | return self; |
| 301 | } |
| 302 | |
| 303 | pub fn reset(self: *Instrumentation) void { |
| 304 | @memset(self.seen_pcs, 0); |
| 305 | @memset(self.fresh_pcs, 0); |
| 306 | self.const_pcs.clearRetainingCapacity(); |
| 307 | self.const_vals2.clearRetainingCapacity(); |
| 308 | self.const_vals4.clearRetainingCapacity(); |
| 309 | self.const_vals8.clearRetainingCapacity(); |
| 310 | self.const_vals16.clearRetainingCapacity(); |
| 311 | } |
| 312 | |
| 313 | /// If false is returned, then the pc is marked as seen |
| 314 | pub fn constPcSeen(self: *Instrumentation, pc: usize) bool { |
| 315 | return (self.const_pcs.getOrPut(gpa, pc) catch @panic("OOM")).found_existing; |
| 316 | } |
| 317 | |
| 318 | pub fn isFresh(self: *Instrumentation) bool { |
| 319 | var hit_pcs = exec.pcBitsetIterator(); |
| 320 | for (self.seen_pcs) |seen_pcs| { |
| 321 | if (hit_pcs.next() & ~seen_pcs != 0) return true; |
| 192 | 322 | } |
| 193 | | f.seen_pcs = MemoryMappedList.init(coverage_file, existing_len, bytes_len) catch |err| { |
| 194 | | fatal("unable to init coverage memory map: {s}", .{@errorName(err)}); |
| 195 | | }; |
| 196 | | if (existing_len != 0) { |
| 197 | | const existing_pcs_bytes = f.seen_pcs.items[@sizeOf(SeenPcsHeader) + @sizeOf(usize) * n_bitset_elems ..][0 .. pcs.len * @sizeOf(usize)]; |
| 198 | | const existing_pcs = std.mem.bytesAsSlice(usize, existing_pcs_bytes); |
| 199 | | for (existing_pcs, pcs, 0..) |old, new, i| { |
| 200 | | if (old != new) { |
| 201 | | fatal("incompatible existing coverage file (differing PC at index {d}: {x} != {x})", .{ |
| 202 | | i, old, new, |
| 203 | | }); |
| 204 | | } |
| 205 | | } |
| 206 | | } else { |
| 207 | | const header: SeenPcsHeader = .{ |
| 208 | | .n_runs = 0, |
| 209 | | .unique_runs = 0, |
| 210 | | .pcs_len = pcs.len, |
| 211 | | }; |
| 212 | | f.seen_pcs.appendSliceAssumeCapacity(std.mem.asBytes(&header)); |
| 213 | | f.seen_pcs.appendNTimesAssumeCapacity(0, n_bitset_elems * @sizeOf(usize)); |
| 214 | | f.seen_pcs.appendSliceAssumeCapacity(std.mem.sliceAsBytes(pcs)); |
| 323 | |
| 324 | return false; |
| 325 | } |
| 326 | |
| 327 | /// Updates `fresh_pcs` |
| 328 | pub fn setFresh(self: *Instrumentation) void { |
| 329 | var hit_pcs = exec.pcBitsetIterator(); |
| 330 | for (self.seen_pcs, self.fresh_pcs) |seen_pcs, *fresh_pcs| { |
| 331 | fresh_pcs.* = hit_pcs.next() & ~seen_pcs; |
| 215 | 332 | } |
| 216 | 333 | } |
| 217 | 334 | |
| 218 | | fn initNextInput(f: *Fuzzer) void { |
| 219 | | while (true) { |
| 220 | | const i = f.corpus.items.len; |
| 221 | | var buf: [30]u8 = undefined; |
| 222 | | const input_sub_path = std.fmt.bufPrint(&buf, "{d}", .{i}) catch unreachable; |
| 223 | | const input = f.corpus_directory.handle.readFileAlloc(input_sub_path, gpa, .limited(1 << 31)) catch |err| switch (err) { |
| 224 | | error.FileNotFound => { |
| 225 | | // Make this one the next input. |
| 226 | | const input_file = f.corpus_directory.handle.createFile(input_sub_path, .{ |
| 227 | | .exclusive = true, |
| 228 | | .truncate = false, |
| 229 | | .read = true, |
| 230 | | }) catch |e| switch (e) { |
| 231 | | error.PathAlreadyExists => continue, |
| 232 | | else => fatal("unable to create '{f}{d}: {s}", .{ f.corpus_directory, i, @errorName(err) }), |
| 233 | | }; |
| 234 | | errdefer input_file.close(); |
| 235 | | // Initialize the mmap for the current input. |
| 236 | | f.input = MemoryMappedList.create(input_file, 0, std.heap.page_size_max) catch |e| { |
| 237 | | fatal("unable to init memory map for input at '{f}{d}': {s}", .{ |
| 238 | | f.corpus_directory, i, @errorName(e), |
| 239 | | }); |
| 240 | | }; |
| 241 | | break; |
| 242 | | }, |
| 243 | | else => fatal("unable to read '{f}{d}': {s}", .{ f.corpus_directory, i, @errorName(err) }), |
| 244 | | }; |
| 245 | | errdefer gpa.free(input); |
| 246 | | f.corpus.append(gpa, .{ |
| 247 | | .bytes = input, |
| 248 | | .last_traced_comparison = 0, |
| 249 | | }) catch |err| oom(err); |
| 335 | /// Returns if `exec.pc_counters` is a superset of `fresh_pcs`. |
| 336 | pub fn atleastFresh(self: *Instrumentation) bool { |
| 337 | var hit_pcs = exec.pcBitsetIterator(); |
| 338 | for (self.fresh_pcs) |fresh_pcs| { |
| 339 | if (fresh_pcs & hit_pcs.next() != fresh_pcs) return false; |
| 250 | 340 | } |
| 341 | return true; |
| 251 | 342 | } |
| 252 | 343 | |
| 253 | | fn addCorpusElem(f: *Fuzzer, input: []const u8) !void { |
| 254 | | try f.corpus.append(gpa, .{ |
| 255 | | .bytes = try gpa.dupe(u8, input), |
| 256 | | .last_traced_comparison = 0, |
| 257 | | }); |
| 344 | /// Updates based off `fresh_pcs` |
| 345 | fn updateSeen(self: *Instrumentation) void { |
| 346 | comptime assert(abi.SeenPcsHeader.trailing[0] == .pc_bits_usize); |
| 347 | const shared_seen_pcs: [*]volatile usize = @ptrCast( |
| 348 | exec.shared_seen_pcs.items[@sizeOf(abi.SeenPcsHeader)..].ptr, |
| 349 | ); |
| 350 | |
| 351 | for (self.seen_pcs, shared_seen_pcs, self.fresh_pcs) |*seen, *shared_seen, fresh| { |
| 352 | seen.* |= fresh; |
| 353 | if (fresh != 0) |
| 354 | _ = @atomicRmw(usize, shared_seen, .Or, fresh, .monotonic); |
| 355 | } |
| 258 | 356 | } |
| 357 | }; |
| 259 | 358 | |
| 260 | | fn start(f: *Fuzzer) !void { |
| 261 | | const rng = fuzzer.rng.random(); |
| 359 | const Fuzzer = struct { |
| 360 | arena_ctx: std.heap.ArenaAllocator = .init(gpa), |
| 361 | rng: std.Random.DefaultPrng = .init(0), |
| 362 | test_one: abi.TestOne, |
| 363 | /// The next input that will be given to the testOne function. When the |
| 364 | /// current process crashes, this memory-mapped file is used to recover the |
| 365 | /// input. |
| 366 | input: MemoryMappedList, |
| 262 | 367 | |
| 263 | | // Grab the corpus which is namespaced based on `unit_test_name`. |
| 264 | | { |
| 265 | | if (f.unit_test_name.len == 0) fatal("test runner never set unit test name", .{}); |
| 266 | | const sub_path = try std.fmt.allocPrint(gpa, "f/{s}", .{f.unit_test_name}); |
| 267 | | f.corpus_directory = .{ |
| 268 | | .handle = f.cache_dir.makeOpenPath(sub_path, .{}) catch |err| |
| 269 | | fatal("unable to open corpus directory 'f/{s}': {t}", .{ sub_path, err }), |
| 270 | | .path = sub_path, |
| 368 | /// Minimized past inputs leading to new pc hits. |
| 369 | /// These are randomly mutated in round-robin fashion |
| 370 | /// Element zero is always an empty input. It is gauraunteed no other elements are empty. |
| 371 | corpus: std.ArrayListUnmanaged([]const u8), |
| 372 | corpus_pos: usize, |
| 373 | /// List of past mutations that have led to new inputs. This way, the mutations that are the |
| 374 | /// most effective are the most likely to be selected again. Starts with one of each mutation. |
| 375 | mutations: std.ArrayListUnmanaged(Mutation) = .empty, |
| 376 | |
| 377 | /// Filesystem directory containing found inputs for future runs |
| 378 | corpus_dir: std.fs.Dir, |
| 379 | corpus_dir_idx: usize = 0, |
| 380 | |
| 381 | pub fn init(test_one: abi.TestOne, unit_test_name: []const u8) Fuzzer { |
| 382 | var self: Fuzzer = .{ |
| 383 | .test_one = test_one, |
| 384 | .input = undefined, |
| 385 | .corpus = .empty, |
| 386 | .corpus_pos = 0, |
| 387 | .mutations = .empty, |
| 388 | .corpus_dir = undefined, |
| 389 | }; |
| 390 | const arena = self.arena_ctx.allocator(); |
| 391 | |
| 392 | self.corpus_dir = exec.cache_f.makeOpenPath(unit_test_name, .{}) catch |e| |
| 393 | panic("failed to open directory '{s}': {t}", .{ unit_test_name, e }); |
| 394 | self.input = in: { |
| 395 | const f = self.corpus_dir.createFile("in", .{ |
| 396 | .read = true, |
| 397 | .truncate = false, |
| 398 | // In case any other fuzz tests are running under the same test name, |
| 399 | // the input file is exclusively locked to ensures only one proceeds. |
| 400 | .lock = .exclusive, |
| 401 | .lock_nonblocking = true, |
| 402 | }) catch |e| switch (e) { |
| 403 | error.WouldBlock => @panic("input file 'in' is in use by another fuzzing process"), |
| 404 | else => panic("failed to create input file 'in': {t}", .{e}), |
| 271 | 405 | }; |
| 272 | | initNextInput(f); |
| 273 | | } |
| 406 | const size = f.getEndPos() catch |e| panic("failed to stat input file 'in': {t}", .{e}); |
| 407 | const map = (if (size < std.heap.page_size_max) |
| 408 | MemoryMappedList.create(f, 8, std.heap.page_size_max) |
| 409 | else |
| 410 | MemoryMappedList.init(f, size, size)) catch |e| |
| 411 | panic("failed to memory map input file 'in': {t}", .{e}); |
| 412 | |
| 413 | // Perform a dry-run of the stored input if there was one in case it might reproduce a |
| 414 | // crash. |
| 415 | const old_in_len = mem.littleToNative(usize, mem.bytesAsValue(usize, map.items[0..8]).*); |
| 416 | if (size >= 8 and old_in_len != 0 and map.items.len - 8 < old_in_len) { |
| 417 | test_one(.fromSlice(@volatileCast(map.items[8..][0..old_in_len]))); |
| 418 | } |
| 274 | 419 | |
| 275 | | assert(f.n_runs == 0); |
| 276 | | |
| 277 | | // If the corpus is empty, synthesize one input. |
| 278 | | if (f.corpus.items.len == 0) { |
| 279 | | const len = rng.uintLessThanBiased(usize, 200); |
| 280 | | const slice = try gpa.alloc(u8, len); |
| 281 | | rng.bytes(slice); |
| 282 | | f.input.appendSliceAssumeCapacity(slice); |
| 283 | | try f.corpus.append(gpa, .{ |
| 284 | | .bytes = slice, |
| 285 | | .last_traced_comparison = 0, |
| 286 | | }); |
| 287 | | runOne(f, 0); |
| 288 | | } |
| 420 | break :in map; |
| 421 | }; |
| 422 | inst.reset(); |
| 423 | |
| 424 | self.mutations.appendSlice(gpa, std.meta.tags(Mutation)) catch @panic("OOM"); |
| 425 | // Ensure there is never an empty corpus. Additionally, an empty input usually leads to |
| 426 | // new inputs. |
| 427 | self.addInput(&.{}); |
| 289 | 428 | |
| 290 | 429 | while (true) { |
| 291 | | const chosen_index = rng.uintLessThanBiased(usize, f.corpus.items.len); |
| 292 | | const modification = rng.enumValue(Mutation); |
| 293 | | f.mutateAndRunOne(chosen_index, modification); |
| 430 | var name_buf: [@sizeOf(usize) * 2]u8 = undefined; |
| 431 | const bytes = self.corpus_dir.readFileAlloc( |
| 432 | std.fmt.bufPrint(&name_buf, "{x}", .{self.corpus_dir_idx}) catch unreachable, |
| 433 | arena, |
| 434 | .unlimited, |
| 435 | ) catch |e| switch (e) { |
| 436 | error.FileNotFound => break, |
| 437 | else => panic("failed to read corpus file '{x}': {t}", .{ self.corpus_dir_idx, e }), |
| 438 | }; |
| 439 | // No corpus file of length zero will ever be created |
| 440 | if (bytes.len == 0) |
| 441 | panic("corrupt corpus file '{x}' (len of zero)", .{self.corpus_dir_idx}); |
| 442 | self.addInput(bytes); |
| 443 | self.corpus_dir_idx += 1; |
| 294 | 444 | } |
| 445 | |
| 446 | return self; |
| 295 | 447 | } |
| 296 | 448 | |
| 297 | | /// `x` represents a possible branch. It is the PC address of the possible |
| 298 | | /// branch site, hashed together with the value(s) used that determine to |
| 299 | | /// where it branches. |
| 300 | | fn traceValue(f: *Fuzzer, x: usize) void { |
| 301 | | errdefer |err| oom(err); |
| 302 | | try f.traced_comparisons.put(gpa, x, {}); |
| 449 | pub fn deinit(self: *Fuzzer) void { |
| 450 | self.input.deinit(); |
| 451 | self.corpus.deinit(gpa); |
| 452 | self.mutations.deinit(gpa); |
| 453 | self.corpus_dir.close(); |
| 454 | self.arena_ctx.deinit(); |
| 455 | self.* = undefined; |
| 303 | 456 | } |
| 304 | 457 | |
| 305 | | const Mutation = enum { |
| 306 | | remove_byte, |
| 307 | | modify_byte, |
| 308 | | add_byte, |
| 309 | | }; |
| 458 | pub fn addInput(self: *Fuzzer, bytes: []const u8) void { |
| 459 | self.corpus.append(gpa, bytes) catch @panic("OOM"); |
| 460 | self.input.clearRetainingCapacity(); |
| 461 | self.input.ensureTotalCapacity(8 + bytes.len) catch |e| |
| 462 | panic("could not resize shared input file: {t}", .{e}); |
| 463 | self.input.items.len = 8; |
| 464 | self.input.appendSliceAssumeCapacity(bytes); |
| 465 | self.run(); |
| 466 | inst.setFresh(); |
| 467 | inst.updateSeen(); |
| 468 | } |
| 310 | 469 | |
| 311 | | fn mutateAndRunOne(f: *Fuzzer, corpus_index: usize, mutation: Mutation) void { |
| 312 | | const rng = fuzzer.rng.random(); |
| 313 | | f.input.clearRetainingCapacity(); |
| 314 | | const old_input = f.corpus.items[corpus_index].bytes; |
| 315 | | f.input.ensureTotalCapacity(old_input.len + 1) catch @panic("mmap file resize failed"); |
| 316 | | switch (mutation) { |
| 317 | | .remove_byte => { |
| 318 | | const omitted_index = rng.uintLessThanBiased(usize, old_input.len); |
| 319 | | f.input.appendSliceAssumeCapacity(old_input[0..omitted_index]); |
| 320 | | f.input.appendSliceAssumeCapacity(old_input[omitted_index + 1 ..]); |
| 321 | | }, |
| 322 | | .modify_byte => { |
| 323 | | const modified_index = rng.uintLessThanBiased(usize, old_input.len); |
| 324 | | f.input.appendSliceAssumeCapacity(old_input); |
| 325 | | f.input.items[modified_index] = rng.int(u8); |
| 326 | | }, |
| 327 | | .add_byte => { |
| 328 | | const modified_index = rng.uintLessThanBiased(usize, old_input.len); |
| 329 | | f.input.appendSliceAssumeCapacity(old_input[0..modified_index]); |
| 330 | | f.input.appendAssumeCapacity(rng.int(u8)); |
| 331 | | f.input.appendSliceAssumeCapacity(old_input[modified_index..]); |
| 332 | | }, |
| 470 | /// Assumes `fresh_pcs` correspond to the input |
| 471 | fn minimizeInput(self: *Fuzzer) void { |
| 472 | // The minimization technique is kept relatively simple, we sequentially try to remove each |
| 473 | // byte and check that the new pcs and memory loads are still hit. |
| 474 | var i = self.input.items.len; |
| 475 | while (i != 8) { |
| 476 | i -= 1; |
| 477 | const old = self.input.orderedRemove(i); |
| 478 | |
| 479 | @memset(exec.pc_counters, 0); |
| 480 | self.run(); |
| 481 | |
| 482 | if (!inst.atleastFresh()) { |
| 483 | self.input.insertAssumeCapacity(i, old); |
| 484 | } else { |
| 485 | // This removal may have led to new pcs or memory loads being hit, so we need to |
| 486 | // update them to avoid duplicates. |
| 487 | inst.setFresh(); |
| 488 | } |
| 333 | 489 | } |
| 334 | | runOne(f, corpus_index); |
| 335 | 490 | } |
| 336 | 491 | |
| 337 | | fn runOne(f: *Fuzzer, corpus_index: usize) void { |
| 338 | | const header: *volatile SeenPcsHeader = @ptrCast(f.seen_pcs.items[0..@sizeOf(SeenPcsHeader)]); |
| 492 | fn run(self: *Fuzzer) void { |
| 493 | // `pc_counters` is not cleared since only new hits are relevant. |
| 339 | 494 | |
| 340 | | f.traced_comparisons.clearRetainingCapacity(); |
| 341 | | @memset(f.pc_counters, 0); |
| 342 | | __sancov_lowest_stack = std.math.maxInt(usize); |
| 495 | mem.bytesAsValue(usize, self.input.items[0..8]).* = |
| 496 | mem.nativeToLittle(usize, self.input.items.len - 8); |
| 497 | self.test_one(.fromSlice(@volatileCast(self.input.items[8..]))); |
| 343 | 498 | |
| 344 | | fuzzer_one(@volatileCast(f.input.items.ptr), f.input.items.len); |
| 345 | | |
| 346 | | f.n_runs += 1; |
| 499 | const header = mem.bytesAsValue( |
| 500 | abi.SeenPcsHeader, |
| 501 | exec.shared_seen_pcs.items[0..@sizeOf(abi.SeenPcsHeader)], |
| 502 | ); |
| 347 | 503 | _ = @atomicRmw(usize, &header.n_runs, .Add, 1, .monotonic); |
| 504 | } |
| 348 | 505 | |
| 349 | | // Track code coverage from all runs. |
| 350 | | comptime assert(SeenPcsHeader.trailing[0] == .pc_bits_usize); |
| 351 | | const header_end_ptr: [*]volatile usize = @ptrCast(f.seen_pcs.items[@sizeOf(SeenPcsHeader)..]); |
| 352 | | const remainder = f.pcs.len % @bitSizeOf(usize); |
| 353 | | const aligned_len = f.pcs.len - remainder; |
| 354 | | const seen_pcs = header_end_ptr[0..aligned_len]; |
| 355 | | const pc_counters = std.mem.bytesAsSlice([@bitSizeOf(usize)]u8, f.pc_counters[0..aligned_len]); |
| 356 | | const V = @Vector(@bitSizeOf(usize), u8); |
| 357 | | const zero_v: V = @splat(0); |
| 358 | | var fresh = false; |
| 359 | | var superset = true; |
| 360 | | |
| 361 | | for (header_end_ptr[0..pc_counters.len], pc_counters) |*elem, *array| { |
| 362 | | const v: V = array.*; |
| 363 | | const mask: usize = @bitCast(v != zero_v); |
| 364 | | const prev = @atomicRmw(usize, elem, .Or, mask, .monotonic); |
| 365 | | fresh = fresh or (prev | mask) != prev; |
| 366 | | superset = superset and (prev | mask) != mask; |
| 367 | | } |
| 368 | | if (remainder > 0) { |
| 369 | | const i = pc_counters.len; |
| 370 | | const elem = &seen_pcs[i]; |
| 371 | | var mask: usize = 0; |
| 372 | | for (f.pc_counters[i * @bitSizeOf(usize) ..][0..remainder], 0..) |byte, bit_index| { |
| 373 | | mask |= @as(usize, @intFromBool(byte != 0)) << @intCast(bit_index); |
| 506 | pub fn cycle(self: *Fuzzer) void { |
| 507 | const input = self.corpus.items[self.corpus_pos]; |
| 508 | self.corpus_pos += 1; |
| 509 | if (self.corpus_pos == self.corpus.items.len) |
| 510 | self.corpus_pos = 0; |
| 511 | |
| 512 | const rng = self.rng.random(); |
| 513 | while (true) { |
| 514 | const m = self.mutations.items[rng.uintLessThanBiased(usize, self.mutations.items.len)]; |
| 515 | if (!m.mutate( |
| 516 | rng, |
| 517 | input, |
| 518 | &self.input, |
| 519 | self.corpus.items, |
| 520 | inst.const_vals2.items, |
| 521 | inst.const_vals4.items, |
| 522 | inst.const_vals8.items, |
| 523 | inst.const_vals16.items, |
| 524 | )) continue; |
| 525 | |
| 526 | self.run(); |
| 527 | if (inst.isFresh()) { |
| 528 | @branchHint(.unlikely); |
| 529 | |
| 530 | const header = mem.bytesAsValue( |
| 531 | abi.SeenPcsHeader, |
| 532 | exec.shared_seen_pcs.items[0..@sizeOf(abi.SeenPcsHeader)], |
| 533 | ); |
| 534 | _ = @atomicRmw(usize, &header.unique_runs, .Add, 1, .monotonic); |
| 535 | |
| 536 | inst.setFresh(); |
| 537 | self.minimizeInput(); |
| 538 | inst.updateSeen(); |
| 539 | |
| 540 | // An empty-input has always been tried, so if an empty input is fresh then the |
| 541 | // test has to be non-deterministic. This has to be checked as duplicate empty |
| 542 | // entries are not allowed. |
| 543 | if (self.input.items.len - 8 == 0) { |
| 544 | std.log.warn("non-deterministic test (empty input produces different hits)", .{}); |
| 545 | _ = @atomicRmw(usize, &header.unique_runs, .Sub, 1, .monotonic); |
| 546 | return; |
| 547 | } |
| 548 | |
| 549 | const arena = self.arena_ctx.allocator(); |
| 550 | const bytes = arena.dupe(u8, @volatileCast(self.input.items[8..])) catch @panic("OOM"); |
| 551 | |
| 552 | self.corpus.append(gpa, bytes) catch @panic("OOM"); |
| 553 | self.mutations.appendNTimes(gpa, m, 6) catch @panic("OOM"); |
| 554 | |
| 555 | // Write new corpus to cache |
| 556 | var name_buf: [@sizeOf(usize) * 2]u8 = undefined; |
| 557 | self.corpus_dir.writeFile(.{ |
| 558 | .sub_path = std.fmt.bufPrint( |
| 559 | &name_buf, |
| 560 | "{x}", |
| 561 | .{self.corpus_dir_idx}, |
| 562 | ) catch unreachable, |
| 563 | .data = bytes, |
| 564 | }) catch |e| panic( |
| 565 | "failed to write corpus file '{x}': {t}", |
| 566 | .{ self.corpus_dir_idx, e }, |
| 567 | ); |
| 568 | self.corpus_dir_idx += 1; |
| 374 | 569 | } |
| 375 | | const prev = @atomicRmw(usize, elem, .Or, mask, .monotonic); |
| 376 | | fresh = fresh or (prev | mask) != prev; |
| 377 | | superset = superset and (prev | mask) != mask; |
| 378 | | } |
| 379 | 570 | |
| 380 | | // First check if this is a better version of an already existing |
| 381 | | // input, replacing that input. |
| 382 | | if (superset or f.traced_comparisons.entries.len >= f.corpus.items[corpus_index].last_traced_comparison) { |
| 383 | | const new_input = gpa.realloc(f.corpus.items[corpus_index].bytes, f.input.items.len) catch |err| oom(err); |
| 384 | | f.corpus.items[corpus_index] = .{ |
| 385 | | .bytes = new_input, |
| 386 | | .last_traced_comparison = f.traced_comparisons.count(), |
| 387 | | }; |
| 388 | | @memcpy(new_input, @volatileCast(f.input.items)); |
| 389 | | _ = @atomicRmw(usize, &header.unique_runs, .Add, 1, .monotonic); |
| 390 | | return; |
| 571 | break; |
| 391 | 572 | } |
| 573 | } |
| 574 | }; |
| 392 | 575 | |
| 393 | | if (!fresh) return; |
| 576 | /// Instrumentation must not be triggered before this function is called |
| 577 | export fn fuzzer_init(cache_dir_path: abi.Slice) void { |
| 578 | inst.depreinit(); |
| 579 | exec = .init(cache_dir_path.toSlice()); |
| 580 | inst = .init(); |
| 581 | } |
| 394 | 582 | |
| 395 | | // Input is already committed to the file system, we just need to open a new file |
| 396 | | // for the next input. |
| 397 | | // Pre-add it to the corpus list so that it does not get redundantly picked up. |
| 398 | | f.corpus.append(gpa, .{ |
| 399 | | .bytes = gpa.dupe(u8, @volatileCast(f.input.items)) catch |err| oom(err), |
| 400 | | .last_traced_comparison = f.traced_comparisons.entries.len, |
| 401 | | }) catch |err| oom(err); |
| 402 | | f.input.deinit(); |
| 403 | | initNextInput(f); |
| 583 | /// Invalid until `fuzzer_init` is called. |
| 584 | export fn fuzzer_coverage_id() u64 { |
| 585 | return exec.pc_digest; |
| 586 | } |
| 404 | 587 | |
| 405 | | // TODO: also mark input as "hot" so it gets prioritized for checking mutations above others. |
| 588 | /// fuzzer_init must be called beforehand |
| 589 | export fn fuzzer_init_test(test_one: abi.TestOne, unit_test_name: abi.Slice) void { |
| 590 | current_test_name = unit_test_name.toSlice(); |
| 591 | fuzzer = .init(test_one, unit_test_name.toSlice()); |
| 592 | } |
| 406 | 593 | |
| 407 | | _ = @atomicRmw(usize, &header.unique_runs, .Add, 1, .monotonic); |
| 408 | | } |
| 409 | | }; |
| 594 | /// fuzzer_init_test must be called beforehand |
| 595 | /// The callee owns the memory of bytes and must not free it until the fuzzer is finished. |
| 596 | export fn fuzzer_new_input(bytes: abi.Slice) void { |
| 597 | // An entry of length zero is always added and duplicates of it are not allowed. |
| 598 | if (bytes.len != 0) |
| 599 | fuzzer.addInput(bytes.toSlice()); |
| 600 | } |
| 410 | 601 | |
| 411 | | fn createFileBail(dir: std.fs.Dir, sub_path: []const u8, flags: std.fs.File.CreateFlags) std.fs.File { |
| 412 | | return dir.createFile(sub_path, flags) catch |err| switch (err) { |
| 413 | | error.FileNotFound => { |
| 414 | | const dir_name = std.fs.path.dirname(sub_path).?; |
| 415 | | dir.makePath(dir_name) catch |e| { |
| 416 | | fatal("unable to make path '{s}': {s}", .{ dir_name, @errorName(e) }); |
| 417 | | }; |
| 418 | | return dir.createFile(sub_path, flags) catch |e| { |
| 419 | | fatal("unable to create file '{s}': {s}", .{ sub_path, @errorName(e) }); |
| 420 | | }; |
| 421 | | }, |
| 422 | | else => fatal("unable to create file '{s}': {s}", .{ sub_path, @errorName(err) }), |
| 423 | | }; |
| 602 | /// fuzzer_init_test must be called first |
| 603 | export fn fuzzer_main() void { |
| 604 | while (true) { |
| 605 | fuzzer.cycle(); |
| 606 | } |
| 424 | 607 | } |
| 425 | 608 | |
| 426 | | fn oom(err: anytype) noreturn { |
| 427 | | switch (err) { |
| 428 | | error.OutOfMemory => @panic("out of memory"), |
| 609 | /// Helps determine run uniqueness in the face of recursion. |
| 610 | /// Currently not used by the fuzzer. |
| 611 | export threadlocal var __sancov_lowest_stack: usize = 0; |
| 612 | |
| 613 | /// Inline since the return address of the callee is required |
| 614 | inline fn genericConstCmp(T: anytype, val: T, comptime const_vals_field: []const u8) void { |
| 615 | if (!inst.constPcSeen(@returnAddress())) { |
| 616 | @branchHint(.unlikely); |
| 617 | @field(inst, const_vals_field).append(gpa, val) catch @panic("OOM"); |
| 429 | 618 | } |
| 430 | 619 | } |
| 431 | 620 | |
| 432 | | var debug_allocator: std.heap.GeneralPurposeAllocator(.{}) = .init; |
| 621 | export fn __sanitizer_cov_trace_const_cmp1(const_arg: u8, arg: u8) void { |
| 622 | _ = const_arg; |
| 623 | _ = arg; |
| 624 | } |
| 433 | 625 | |
| 434 | | const gpa = switch (builtin.mode) { |
| 435 | | .Debug => debug_allocator.allocator(), |
| 436 | | .ReleaseFast, .ReleaseSmall, .ReleaseSafe => std.heap.smp_allocator, |
| 437 | | }; |
| 626 | export fn __sanitizer_cov_trace_const_cmp2(const_arg: u16, arg: u16) void { |
| 627 | _ = arg; |
| 628 | genericConstCmp(u16, const_arg, "const_vals2"); |
| 629 | } |
| 438 | 630 | |
| 439 | | var fuzzer: Fuzzer = .{ |
| 440 | | .rng = std.Random.DefaultPrng.init(0), |
| 441 | | .input = undefined, |
| 442 | | .pcs = undefined, |
| 443 | | .pc_counters = undefined, |
| 444 | | .n_runs = 0, |
| 445 | | .cache_dir = undefined, |
| 446 | | .seen_pcs = undefined, |
| 447 | | .coverage_id = undefined, |
| 448 | | .unit_test_name = &.{}, |
| 449 | | .corpus = .empty, |
| 450 | | .corpus_directory = undefined, |
| 451 | | .traced_comparisons = .empty, |
| 452 | | }; |
| 631 | export fn __sanitizer_cov_trace_const_cmp4(const_arg: u32, arg: u32) void { |
| 632 | _ = arg; |
| 633 | genericConstCmp(u32, const_arg, "const_vals4"); |
| 634 | } |
| 453 | 635 | |
| 454 | | /// Invalid until `fuzzer_init` is called. |
| 455 | | export fn fuzzer_coverage_id() u64 { |
| 456 | | return fuzzer.coverage_id; |
| 636 | export fn __sanitizer_cov_trace_const_cmp8(const_arg: u64, arg: u64) void { |
| 637 | _ = arg; |
| 638 | genericConstCmp(u64, const_arg, "const_vals8"); |
| 457 | 639 | } |
| 458 | 640 | |
| 459 | | var fuzzer_one: *const fn (input_ptr: [*]const u8, input_len: usize) callconv(.c) void = undefined; |
| 641 | export fn __sanitizer_cov_trace_switch(val: u64, cases: [*]const u64) void { |
| 642 | _ = val; |
| 643 | if (!inst.constPcSeen(@returnAddress())) { |
| 644 | @branchHint(.unlikely); |
| 645 | const case_bits = cases[1]; |
| 646 | const cases_slice = cases[2..][0..cases[0]]; |
| 647 | switch (case_bits) { |
| 648 | // 8-bit cases are ignored because they are likely to be randomly generated |
| 649 | 0...8 => {}, |
| 650 | 9...16 => for (cases_slice) |c| |
| 651 | inst.const_vals2.append(gpa, @truncate(c)) catch @panic("OOM"), |
| 652 | 17...32 => for (cases_slice) |c| |
| 653 | inst.const_vals4.append(gpa, @truncate(c)) catch @panic("OOM"), |
| 654 | 33...64 => for (cases_slice) |c| |
| 655 | inst.const_vals8.append(gpa, @truncate(c)) catch @panic("OOM"), |
| 656 | else => {}, // Should be impossible |
| 657 | } |
| 658 | } |
| 659 | } |
| 460 | 660 | |
| 461 | | export fn fuzzer_start(testOne: @TypeOf(fuzzer_one)) void { |
| 462 | | fuzzer_one = testOne; |
| 463 | | fuzzer.start() catch |err| oom(err); |
| 661 | export fn __sanitizer_cov_trace_cmp1(arg1: u8, arg2: u8) void { |
| 662 | _ = arg1; |
| 663 | _ = arg2; |
| 464 | 664 | } |
| 465 | 665 | |
| 466 | | export fn fuzzer_set_name(name_ptr: [*]const u8, name_len: usize) void { |
| 467 | | fuzzer.unit_test_name = name_ptr[0..name_len]; |
| 666 | export fn __sanitizer_cov_trace_cmp2(arg1: u16, arg2: u16) void { |
| 667 | _ = arg1; |
| 668 | _ = arg2; |
| 468 | 669 | } |
| 469 | 670 | |
| 470 | | export fn fuzzer_init(cache_dir_struct: Fuzzer.Slice) void { |
| 471 | | // Linkers are expected to automatically add `__start_<section>` and |
| 472 | | // `__stop_<section>` symbols when section names are valid C identifiers. |
| 473 | | |
| 474 | | const ofmt = builtin.object_format; |
| 475 | | |
| 476 | | const start_symbol_prefix: []const u8 = if (ofmt == .macho) |
| 477 | | "\x01section$start$__DATA$__" |
| 478 | | else |
| 479 | | "__start___"; |
| 480 | | const end_symbol_prefix: []const u8 = if (ofmt == .macho) |
| 481 | | "\x01section$end$__DATA$__" |
| 482 | | else |
| 483 | | "__stop___"; |
| 484 | | |
| 485 | | const pc_counters_start_name = start_symbol_prefix ++ "sancov_cntrs"; |
| 486 | | const pc_counters_start = @extern([*]u8, .{ |
| 487 | | .name = pc_counters_start_name, |
| 488 | | .linkage = .weak, |
| 489 | | }) orelse fatal("missing {s} symbol", .{pc_counters_start_name}); |
| 490 | | |
| 491 | | const pc_counters_end_name = end_symbol_prefix ++ "sancov_cntrs"; |
| 492 | | const pc_counters_end = @extern([*]u8, .{ |
| 493 | | .name = pc_counters_end_name, |
| 494 | | .linkage = .weak, |
| 495 | | }) orelse fatal("missing {s} symbol", .{pc_counters_end_name}); |
| 496 | | |
| 497 | | const pc_counters = pc_counters_start[0 .. pc_counters_end - pc_counters_start]; |
| 498 | | |
| 499 | | const pcs_start_name = start_symbol_prefix ++ "sancov_pcs1"; |
| 500 | | const pcs_start = @extern([*]usize, .{ |
| 501 | | .name = pcs_start_name, |
| 502 | | .linkage = .weak, |
| 503 | | }) orelse fatal("missing {s} symbol", .{pcs_start_name}); |
| 504 | | |
| 505 | | const pcs_end_name = end_symbol_prefix ++ "sancov_pcs1"; |
| 506 | | const pcs_end = @extern([*]usize, .{ |
| 507 | | .name = pcs_end_name, |
| 508 | | .linkage = .weak, |
| 509 | | }) orelse fatal("missing {s} symbol", .{pcs_end_name}); |
| 510 | | |
| 511 | | const pcs = pcs_start[0 .. pcs_end - pcs_start]; |
| 512 | | |
| 513 | | const cache_dir_path = cache_dir_struct.toZig(); |
| 514 | | const cache_dir = if (cache_dir_path.len == 0) |
| 515 | | std.fs.cwd() |
| 516 | | else |
| 517 | | std.fs.cwd().makeOpenPath(cache_dir_path, .{ .iterate = true }) catch |err| { |
| 518 | | fatal("unable to open fuzz directory '{s}': {s}", .{ cache_dir_path, @errorName(err) }); |
| 519 | | }; |
| 671 | export fn __sanitizer_cov_trace_cmp4(arg1: u32, arg2: u32) void { |
| 672 | _ = arg1; |
| 673 | _ = arg2; |
| 674 | } |
| 675 | |
| 676 | export fn __sanitizer_cov_trace_cmp8(arg1: u64, arg2: u64) void { |
| 677 | _ = arg1; |
| 678 | _ = arg2; |
| 679 | } |
| 680 | |
| 681 | export fn __sanitizer_cov_trace_pc_indir(callee: usize) void { |
| 682 | // Not valuable because we already have pc tracing via 8bit counters. |
| 683 | _ = callee; |
| 684 | } |
| 685 | export fn __sanitizer_cov_8bit_counters_init(start: usize, end: usize) void { |
| 686 | // clang will emit a call to this function when compiling with code coverage instrumentation. |
| 687 | // however, fuzzer_init() does not need this information since it directly reads from the |
| 688 | // symbol table. |
| 689 | _ = start; |
| 690 | _ = end; |
| 691 | } |
| 692 | export fn __sanitizer_cov_pcs_init(start: usize, end: usize) void { |
| 693 | // clang will emit a call to this function when compiling with code coverage instrumentation. |
| 694 | // however, fuzzer_init() does not need this information since it directly reads from the |
| 695 | // symbol table. |
| 696 | _ = start; |
| 697 | _ = end; |
| 698 | } |
| 520 | 699 | |
| 521 | | fuzzer.init(cache_dir, pc_counters, pcs) catch |err| |
| 522 | | fatal("unable to init fuzzer: {s}", .{@errorName(err)}); |
| 700 | /// Copy all of source into dest at position 0. |
| 701 | /// If the slices overlap, dest.ptr must be <= src.ptr. |
| 702 | fn volatileCopyForwards(comptime T: type, dest: []volatile T, source: []const volatile T) void { |
| 703 | for (dest, source) |*d, s| d.* = s; |
| 523 | 704 | } |
| 524 | 705 | |
| 525 | | export fn fuzzer_init_corpus_elem(input_ptr: [*]const u8, input_len: usize) void { |
| 526 | | fuzzer.addCorpusElem(input_ptr[0..input_len]) catch |err| |
| 527 | | fatal("failed to add corpus element: {s}", .{@errorName(err)}); |
| 706 | /// Copy all of source into dest at position 0. |
| 707 | /// If the slices overlap, dest.ptr must be >= src.ptr. |
| 708 | fn volatileCopyBackwards(comptime T: type, dest: []volatile T, source: []const volatile T) void { |
| 709 | var i = source.len; |
| 710 | while (i > 0) { |
| 711 | i -= 1; |
| 712 | dest[i] = source[i]; |
| 713 | } |
| 528 | 714 | } |
| 529 | 715 | |
| 716 | const Mutation = enum { |
| 717 | /// Applies .insert_*_span, .push_*_span |
| 718 | /// For wtf-8, this limits code units, not code points |
| 719 | const max_insert_len = 12; |
| 720 | /// Applies to .insert_large_*_span and .push_large_*_span |
| 721 | /// 4096 is used as it is a common sector size |
| 722 | const max_large_insert_len = 4096; |
| 723 | /// Applies to .delete_span and .pop_span |
| 724 | const max_delete_len = 16; |
| 725 | /// Applies to .set_*span, .move_span, .set_existing_span |
| 726 | const max_set_len = 12; |
| 727 | const max_replicate_len = 64; |
| 728 | const AddValue = i6; |
| 729 | const SmallValue = i10; |
| 730 | |
| 731 | delete_byte, |
| 732 | delete_span, |
| 733 | /// Removes the last byte from the input |
| 734 | pop_byte, |
| 735 | pop_span, |
| 736 | /// Inserts a group of bytes which is already in the input and removes the original copy. |
| 737 | move_span, |
| 738 | /// Replaces a group of bytes in the input with another group of bytes in the input |
| 739 | set_existing_span, |
| 740 | insert_existing_span, |
| 741 | push_existing_span, |
| 742 | set_rng_byte, |
| 743 | set_rng_span, |
| 744 | insert_rng_byte, |
| 745 | insert_rng_span, |
| 746 | /// Adds a byte to the end of the input |
| 747 | push_rng_byte, |
| 748 | push_rng_span, |
| 749 | set_zero_byte, |
| 750 | set_zero_span, |
| 751 | insert_zero_byte, |
| 752 | insert_zero_span, |
| 753 | push_zero_byte, |
| 754 | push_zero_span, |
| 755 | /// Inserts a lot of zeros to the end of the input |
| 756 | /// This is intended to work with fuzz tests that require data in (large) blocks |
| 757 | push_large_zero_span, |
| 758 | /// Inserts a group of ascii printable character |
| 759 | insert_print_span, |
| 760 | /// Inserts a group of character from a...z, A...Z, 0...9, _, and ' ' |
| 761 | insert_common_span, |
| 762 | /// Inserts a group of ascii digits possibly preceded by a `-` |
| 763 | insert_integer, |
| 764 | /// Code units are evenly distributed between one to four |
| 765 | insert_wtf8_char, |
| 766 | insert_wtf8_span, |
| 767 | /// Inserts a group of bytes from another input |
| 768 | insert_splice_span, |
| 769 | // utf16 is not yet included since insertion of random bytes should adaquetly check |
| 770 | // BMP character, surrogate handling, and occasionally chacters outside of the BMP. |
| 771 | set_print_span, |
| 772 | set_common_span, |
| 773 | set_splice_span, |
| 774 | /// Similar to set_splice_span, but the bytes are copied to the same index instead of a random |
| 775 | replicate_splice_span, |
| 776 | push_print_span, |
| 777 | push_common_span, |
| 778 | push_integer, |
| 779 | push_wtf8_char, |
| 780 | push_wtf8_span, |
| 781 | push_splice_span, |
| 782 | /// Clears a random amount of high bits of a byte |
| 783 | truncate_8, |
| 784 | truncate_16le, |
| 785 | truncate_16be, |
| 786 | truncate_32le, |
| 787 | truncate_32be, |
| 788 | truncate_64le, |
| 789 | truncate_64be, |
| 790 | /// Flips a random bit |
| 791 | xor_1, |
| 792 | /// Swaps up to three bits of a byte biased to less bits |
| 793 | xor_few_8, |
| 794 | /// Swaps up to six bits of a 16-bit value biased to less bits |
| 795 | xor_few_16, |
| 796 | /// Swaps up to nine bits of a 32-bit value biased to less bits |
| 797 | xor_few_32, |
| 798 | /// Swaps up to twelve bits of 64-bit value biased to less bits |
| 799 | xor_few_64, |
| 800 | /// Adds to a byte a value of type AddValue |
| 801 | add_8, |
| 802 | add_16le, |
| 803 | add_16be, |
| 804 | add_32le, |
| 805 | add_32be, |
| 806 | add_64le, |
| 807 | add_64be, |
| 808 | /// Sets a 16-bit little-endian value to a value of type SmallValue |
| 809 | set_small_16le, |
| 810 | set_small_16be, |
| 811 | set_small_32le, |
| 812 | set_small_32be, |
| 813 | set_small_64le, |
| 814 | set_small_64be, |
| 815 | insert_small_16le, |
| 816 | insert_small_16be, |
| 817 | insert_small_32le, |
| 818 | insert_small_32be, |
| 819 | insert_small_64le, |
| 820 | insert_small_64be, |
| 821 | push_small_16le, |
| 822 | push_small_16be, |
| 823 | push_small_32le, |
| 824 | push_small_32be, |
| 825 | push_small_64le, |
| 826 | push_small_64be, |
| 827 | set_const_16, |
| 828 | set_const_32, |
| 829 | set_const_64, |
| 830 | set_const_128, |
| 831 | insert_const_16, |
| 832 | insert_const_32, |
| 833 | insert_const_64, |
| 834 | insert_const_128, |
| 835 | push_const_16, |
| 836 | push_const_32, |
| 837 | push_const_64, |
| 838 | push_const_128, |
| 839 | /// Sets a byte with up to three bits set biased to less bits |
| 840 | set_few_8, |
| 841 | /// Sets a 16-bit value with up to six bits set biased to less bits |
| 842 | set_few_16, |
| 843 | /// Sets a 32-bit value with up to nine bits set biased to less bits |
| 844 | set_few_32, |
| 845 | /// Sets a 64-bit value with up to twelve bits set biased to less bits |
| 846 | set_few_64, |
| 847 | insert_few_8, |
| 848 | insert_few_16, |
| 849 | insert_few_32, |
| 850 | insert_few_64, |
| 851 | push_few_8, |
| 852 | push_few_16, |
| 853 | push_few_32, |
| 854 | push_few_64, |
| 855 | /// Randomizes a random contigous group of bits in a byte |
| 856 | packed_set_rng_8, |
| 857 | packed_set_rng_16le, |
| 858 | packed_set_rng_16be, |
| 859 | packed_set_rng_32le, |
| 860 | packed_set_rng_32be, |
| 861 | packed_set_rng_64le, |
| 862 | packed_set_rng_64be, |
| 863 | |
| 864 | fn fewValue(rng: std.Random, T: type, comptime bits: u16) T { |
| 865 | var result: T = 0; |
| 866 | var remaining_bits = rng.intRangeAtMostBiased(u16, 1, bits); |
| 867 | while (remaining_bits > 0) { |
| 868 | result |= @shlExact(@as(T, 1), rng.int(math.Log2Int(T))); |
| 869 | remaining_bits -= 1; |
| 870 | } |
| 871 | return result; |
| 872 | } |
| 873 | |
| 874 | /// Returns if the mutation was applicable to the input |
| 875 | pub fn mutate( |
| 876 | mutation: Mutation, |
| 877 | rng: std.Random, |
| 878 | in: []const u8, |
| 879 | out: *MemoryMappedList, |
| 880 | corpus: []const []const u8, |
| 881 | const_vals2: []const u16, |
| 882 | const_vals4: []const u32, |
| 883 | const_vals8: []const u64, |
| 884 | const_vals16: []const u128, |
| 885 | ) bool { |
| 886 | out.clearRetainingCapacity(); |
| 887 | const new_capacity = 8 + in.len + @max( |
| 888 | 16, // builtin 128 value |
| 889 | Mutation.max_insert_len, |
| 890 | Mutation.max_large_insert_len, |
| 891 | ); |
| 892 | out.ensureTotalCapacity(new_capacity) catch |e| |
| 893 | panic("could not resize shared input file: {t}", .{e}); |
| 894 | out.items.len = 8; // Length field |
| 895 | |
| 896 | const applied = switch (mutation) { |
| 897 | inline else => |m| m.comptimeMutate( |
| 898 | rng, |
| 899 | in, |
| 900 | out, |
| 901 | corpus, |
| 902 | const_vals2, |
| 903 | const_vals4, |
| 904 | const_vals8, |
| 905 | const_vals16, |
| 906 | ), |
| 907 | }; |
| 908 | if (!applied) |
| 909 | assert(out.items.len == 8) |
| 910 | else |
| 911 | assert(out.items.len <= new_capacity); |
| 912 | return applied; |
| 913 | } |
| 914 | |
| 915 | /// Assumes out has already been cleared |
| 916 | fn comptimeMutate( |
| 917 | comptime mutation: Mutation, |
| 918 | rng: std.Random, |
| 919 | in: []const u8, |
| 920 | out: *MemoryMappedList, |
| 921 | corpus: []const []const u8, |
| 922 | const_vals2: []const u16, |
| 923 | const_vals4: []const u32, |
| 924 | const_vals8: []const u64, |
| 925 | const_vals16: []const u128, |
| 926 | ) bool { |
| 927 | const Class = enum { new, remove, rmw, move_span, replicate_splice_span }; |
| 928 | const class: Class, const class_ctx = switch (mutation) { |
| 929 | // zig fmt: off |
| 930 | .move_span => .{ .move_span, null }, |
| 931 | .replicate_splice_span => .{ .replicate_splice_span, null }, |
| 932 | |
| 933 | .delete_byte => .{ .remove, .{ .delete, 1 } }, |
| 934 | .delete_span => .{ .remove, .{ .delete, max_delete_len } }, |
| 935 | |
| 936 | .pop_byte => .{ .remove, .{ .pop, 1 } }, |
| 937 | .pop_span => .{ .remove, .{ .pop, max_delete_len } }, |
| 938 | |
| 939 | .set_rng_byte => .{ .new, .{ .set , 1, .rng , .one } }, |
| 940 | .set_zero_byte => .{ .new, .{ .set , 1, .zero , .one } }, |
| 941 | .set_rng_span => .{ .new, .{ .set , 1, .rng , .many } }, |
| 942 | .set_zero_span => .{ .new, .{ .set , 1, .zero , .many } }, |
| 943 | .set_common_span => .{ .new, .{ .set , 1, .common , .many } }, |
| 944 | .set_print_span => .{ .new, .{ .set , 1, .print , .many } }, |
| 945 | .set_existing_span => .{ .new, .{ .set , 2, .existing, .many } }, |
| 946 | .set_splice_span => .{ .new, .{ .set , 1, .splice , .many } }, |
| 947 | .set_const_16 => .{ .new, .{ .set , 2, .@"const", const_vals2 } }, |
| 948 | .set_const_32 => .{ .new, .{ .set , 4, .@"const", const_vals4 } }, |
| 949 | .set_const_64 => .{ .new, .{ .set , 8, .@"const", const_vals8 } }, |
| 950 | .set_const_128 => .{ .new, .{ .set , 16, .@"const", const_vals16 } }, |
| 951 | .set_small_16le => .{ .new, .{ .set , 2, .small , .{ i16, .little } } }, |
| 952 | .set_small_32le => .{ .new, .{ .set , 4, .small , .{ i32, .little } } }, |
| 953 | .set_small_64le => .{ .new, .{ .set , 8, .small , .{ i64, .little } } }, |
| 954 | .set_small_16be => .{ .new, .{ .set , 2, .small , .{ i16, .big } } }, |
| 955 | .set_small_32be => .{ .new, .{ .set , 4, .small , .{ i32, .big } } }, |
| 956 | .set_small_64be => .{ .new, .{ .set , 8, .small , .{ i64, .big } } }, |
| 957 | .set_few_8 => .{ .new, .{ .set , 1, .few , .{ u8 , 3 } } }, |
| 958 | .set_few_16 => .{ .new, .{ .set , 2, .few , .{ u16, 6 } } }, |
| 959 | .set_few_32 => .{ .new, .{ .set , 4, .few , .{ u32, 9 } } }, |
| 960 | .set_few_64 => .{ .new, .{ .set , 8, .few , .{ u64, 12 } } }, |
| 961 | |
| 962 | .insert_rng_byte => .{ .new, .{ .insert, 0, .rng , .one } }, |
| 963 | .insert_zero_byte => .{ .new, .{ .insert, 0, .zero , .one } }, |
| 964 | .insert_rng_span => .{ .new, .{ .insert, 0, .rng , .many } }, |
| 965 | .insert_zero_span => .{ .new, .{ .insert, 0, .zero , .many } }, |
| 966 | .insert_print_span => .{ .new, .{ .insert, 0, .print , .many } }, |
| 967 | .insert_common_span => .{ .new, .{ .insert, 0, .common , .many } }, |
| 968 | .insert_integer => .{ .new, .{ .insert, 0, .integer , .many } }, |
| 969 | .insert_wtf8_char => .{ .new, .{ .insert, 0, .wtf8 , .one } }, |
| 970 | .insert_wtf8_span => .{ .new, .{ .insert, 0, .wtf8 , .many } }, |
| 971 | .insert_existing_span => .{ .new, .{ .insert, 1, .existing, .many } }, |
| 972 | .insert_splice_span => .{ .new, .{ .insert, 0, .splice , .many } }, |
| 973 | .insert_const_16 => .{ .new, .{ .insert, 0, .@"const", const_vals2 } }, |
| 974 | .insert_const_32 => .{ .new, .{ .insert, 0, .@"const", const_vals4 } }, |
| 975 | .insert_const_64 => .{ .new, .{ .insert, 0, .@"const", const_vals8 } }, |
| 976 | .insert_const_128 => .{ .new, .{ .insert, 0, .@"const", const_vals16 } }, |
| 977 | .insert_small_16le => .{ .new, .{ .insert, 0, .small , .{ i16, .little } } }, |
| 978 | .insert_small_32le => .{ .new, .{ .insert, 0, .small , .{ i32, .little } } }, |
| 979 | .insert_small_64le => .{ .new, .{ .insert, 0, .small , .{ i64, .little } } }, |
| 980 | .insert_small_16be => .{ .new, .{ .insert, 0, .small , .{ i16, .big } } }, |
| 981 | .insert_small_32be => .{ .new, .{ .insert, 0, .small , .{ i32, .big } } }, |
| 982 | .insert_small_64be => .{ .new, .{ .insert, 0, .small , .{ i64, .big } } }, |
| 983 | .insert_few_8 => .{ .new, .{ .insert, 0, .few , .{ u8 , 3 } } }, |
| 984 | .insert_few_16 => .{ .new, .{ .insert, 0, .few , .{ u16, 6 } } }, |
| 985 | .insert_few_32 => .{ .new, .{ .insert, 0, .few , .{ u32, 9 } } }, |
| 986 | .insert_few_64 => .{ .new, .{ .insert, 0, .few , .{ u64, 12 } } }, |
| 987 | |
| 988 | .push_rng_byte => .{ .new, .{ .push , 0, .rng , .one } }, |
| 989 | .push_zero_byte => .{ .new, .{ .push , 0, .zero , .one } }, |
| 990 | .push_rng_span => .{ .new, .{ .push , 0, .rng , .many } }, |
| 991 | .push_zero_span => .{ .new, .{ .push , 0, .zero , .many } }, |
| 992 | .push_print_span => .{ .new, .{ .push , 0, .print , .many } }, |
| 993 | .push_common_span => .{ .new, .{ .push , 0, .common , .many } }, |
| 994 | .push_integer => .{ .new, .{ .push , 0, .integer , .many } }, |
| 995 | .push_large_zero_span => .{ .new, .{ .push , 0, .zero , .large } }, |
| 996 | .push_wtf8_char => .{ .new, .{ .push , 0, .wtf8 , .one } }, |
| 997 | .push_wtf8_span => .{ .new, .{ .push , 0, .wtf8 , .many } }, |
| 998 | .push_existing_span => .{ .new, .{ .push , 1, .existing, .many } }, |
| 999 | .push_splice_span => .{ .new, .{ .push , 0, .splice , .many } }, |
| 1000 | .push_const_16 => .{ .new, .{ .push , 0, .@"const", const_vals2 } }, |
| 1001 | .push_const_32 => .{ .new, .{ .push , 0, .@"const", const_vals4 } }, |
| 1002 | .push_const_64 => .{ .new, .{ .push , 0, .@"const", const_vals8 } }, |
| 1003 | .push_const_128 => .{ .new, .{ .push , 0, .@"const", const_vals16 } }, |
| 1004 | .push_small_16le => .{ .new, .{ .push , 0, .small , .{ i16, .little } } }, |
| 1005 | .push_small_32le => .{ .new, .{ .push , 0, .small , .{ i32, .little } } }, |
| 1006 | .push_small_64le => .{ .new, .{ .push , 0, .small , .{ i64, .little } } }, |
| 1007 | .push_small_16be => .{ .new, .{ .push , 0, .small , .{ i16, .big } } }, |
| 1008 | .push_small_32be => .{ .new, .{ .push , 0, .small , .{ i32, .big } } }, |
| 1009 | .push_small_64be => .{ .new, .{ .push , 0, .small , .{ i64, .big } } }, |
| 1010 | .push_few_8 => .{ .new, .{ .push , 0, .few , .{ u8 , 3 } } }, |
| 1011 | .push_few_16 => .{ .new, .{ .push , 0, .few , .{ u16, 6 } } }, |
| 1012 | .push_few_32 => .{ .new, .{ .push , 0, .few , .{ u32, 9 } } }, |
| 1013 | .push_few_64 => .{ .new, .{ .push , 0, .few , .{ u64, 12 } } }, |
| 1014 | |
| 1015 | .xor_1 => .{ .rmw, .{ .xor , u8 , native_endian, 1 } }, |
| 1016 | .xor_few_8 => .{ .rmw, .{ .xor , u8 , native_endian, 3 } }, |
| 1017 | .xor_few_16 => .{ .rmw, .{ .xor , u16, native_endian, 6 } }, |
| 1018 | .xor_few_32 => .{ .rmw, .{ .xor , u32, native_endian, 9 } }, |
| 1019 | .xor_few_64 => .{ .rmw, .{ .xor , u64, native_endian, 12 } }, |
| 1020 | |
| 1021 | .truncate_8 => .{ .rmw, .{ .truncate , u8 , native_endian, {} } }, |
| 1022 | .truncate_16le => .{ .rmw, .{ .truncate , u16, .little , {} } }, |
| 1023 | .truncate_32le => .{ .rmw, .{ .truncate , u32, .little , {} } }, |
| 1024 | .truncate_64le => .{ .rmw, .{ .truncate , u64, .little , {} } }, |
| 1025 | .truncate_16be => .{ .rmw, .{ .truncate , u16, .big , {} } }, |
| 1026 | .truncate_32be => .{ .rmw, .{ .truncate , u32, .big , {} } }, |
| 1027 | .truncate_64be => .{ .rmw, .{ .truncate , u64, .big , {} } }, |
| 1028 | |
| 1029 | .add_8 => .{ .rmw, .{ .add , i8 , native_endian, {} } }, |
| 1030 | .add_16le => .{ .rmw, .{ .add , i16, .little , {} } }, |
| 1031 | .add_32le => .{ .rmw, .{ .add , i32, .little , {} } }, |
| 1032 | .add_64le => .{ .rmw, .{ .add , i64, .little , {} } }, |
| 1033 | .add_16be => .{ .rmw, .{ .add , i16, .big , {} } }, |
| 1034 | .add_32be => .{ .rmw, .{ .add , i32, .big , {} } }, |
| 1035 | .add_64be => .{ .rmw, .{ .add , i64, .big , {} } }, |
| 1036 | |
| 1037 | .packed_set_rng_8 => .{ .rmw, .{ .packed_rng, u8 , native_endian, {} } }, |
| 1038 | .packed_set_rng_16le => .{ .rmw, .{ .packed_rng, u16, .little , {} } }, |
| 1039 | .packed_set_rng_32le => .{ .rmw, .{ .packed_rng, u32, .little , {} } }, |
| 1040 | .packed_set_rng_64le => .{ .rmw, .{ .packed_rng, u64, .little , {} } }, |
| 1041 | .packed_set_rng_16be => .{ .rmw, .{ .packed_rng, u16, .big , {} } }, |
| 1042 | .packed_set_rng_32be => .{ .rmw, .{ .packed_rng, u32, .big , {} } }, |
| 1043 | .packed_set_rng_64be => .{ .rmw, .{ .packed_rng, u64, .big , {} } }, |
| 1044 | // zig fmt: on |
| 1045 | }; |
| 1046 | |
| 1047 | switch (class) { |
| 1048 | .new => { |
| 1049 | const op: enum { |
| 1050 | set, |
| 1051 | insert, |
| 1052 | push, |
| 1053 | |
| 1054 | pub fn maxLen(comptime op: @This(), in_len: usize) usize { |
| 1055 | return switch (op) { |
| 1056 | .set => @min(in_len, max_set_len), |
| 1057 | .insert, .push => max_insert_len, |
| 1058 | }; |
| 1059 | } |
| 1060 | }, const min_in_len, const data: enum { |
| 1061 | rng, |
| 1062 | zero, |
| 1063 | common, |
| 1064 | print, |
| 1065 | integer, |
| 1066 | wtf8, |
| 1067 | existing, |
| 1068 | splice, |
| 1069 | @"const", |
| 1070 | small, |
| 1071 | few, |
| 1072 | }, const data_ctx = class_ctx; |
| 1073 | const Size = enum { one, many, large }; |
| 1074 | if (in.len < min_in_len) return false; |
| 1075 | if (data == .@"const" and data_ctx.len == 0) return false; |
| 1076 | |
| 1077 | const splice_i = if (data == .splice) blk: { |
| 1078 | // Element zero always holds an empty input, so we do not select it |
| 1079 | if (corpus.len == 1) return false; |
| 1080 | break :blk rng.intRangeLessThanBiased(usize, 1, corpus.len); |
| 1081 | } else undefined; |
| 1082 | |
| 1083 | // Only needs to be followed for set |
| 1084 | const len = switch (data) { |
| 1085 | else => switch (@as(Size, data_ctx)) { |
| 1086 | .one => 1, |
| 1087 | .many => rng.intRangeAtMostBiased(usize, 1, op.maxLen(in.len)), |
| 1088 | .large => rng.intRangeAtMostBiased(usize, 1, max_large_insert_len), |
| 1089 | }, |
| 1090 | .wtf8 => undefined, // varies by size of each code unit |
| 1091 | .splice => rng.intRangeAtMostBiased(usize, 1, @min( |
| 1092 | corpus[splice_i].len, |
| 1093 | op.maxLen(in.len), |
| 1094 | )), |
| 1095 | .existing => rng.intRangeAtMostBiased(usize, 1, @min( |
| 1096 | in.len, |
| 1097 | op.maxLen(in.len), |
| 1098 | )), |
| 1099 | .@"const" => @sizeOf(@typeInfo(@TypeOf(data_ctx)).pointer.child), |
| 1100 | .small, .few => @sizeOf(data_ctx[0]), |
| 1101 | }; |
| 1102 | |
| 1103 | const i = switch (op) { |
| 1104 | .set => rng.uintAtMostBiased(usize, in.len - len), |
| 1105 | .insert => rng.uintAtMostBiased(usize, in.len), |
| 1106 | .push => in.len, |
| 1107 | }; |
| 1108 | |
| 1109 | out.appendSliceAssumeCapacity(in[0..i]); |
| 1110 | switch (data) { |
| 1111 | .rng => { |
| 1112 | var bytes: [@max(max_insert_len, max_set_len)]u8 = undefined; |
| 1113 | rng.bytes(bytes[0..len]); |
| 1114 | out.appendSliceAssumeCapacity(bytes[0..len]); |
| 1115 | }, |
| 1116 | .zero => out.appendNTimesAssumeCapacity(0, len), |
| 1117 | .common => for (out.addManyAsSliceAssumeCapacity(len)) |*c| { |
| 1118 | c.* = switch (rng.int(u6)) { |
| 1119 | 0 => ' ', |
| 1120 | 1...10 => |x| '0' + (@as(u8, x) - 1), |
| 1121 | 11...36 => |x| 'A' + (@as(u8, x) - 11), |
| 1122 | 37 => '_', |
| 1123 | 38...63 => |x| 'a' + (@as(u8, x) - 38), |
| 1124 | }; |
| 1125 | }, |
| 1126 | .print => for (out.addManyAsSliceAssumeCapacity(len)) |*c| { |
| 1127 | c.* = rng.intRangeAtMostBiased(u8, 0x20, 0x7E); |
| 1128 | }, |
| 1129 | .integer => { |
| 1130 | const negative = len != 0 and rng.boolean(); |
| 1131 | if (negative) { |
| 1132 | out.appendAssumeCapacity('-'); |
| 1133 | } |
| 1134 | |
| 1135 | for (out.addManyAsSliceAssumeCapacity(len - @intFromBool(negative))) |*c| { |
| 1136 | c.* = rng.intRangeAtMostBiased(u8, '0', '9'); |
| 1137 | } |
| 1138 | }, |
| 1139 | .wtf8 => { |
| 1140 | comptime assert(op != .set); |
| 1141 | var codepoints: usize = if (data_ctx == .one) |
| 1142 | 1 |
| 1143 | else |
| 1144 | rng.intRangeAtMostBiased(usize, 1, Mutation.max_insert_len / 4); |
| 1145 | |
| 1146 | while (true) { |
| 1147 | const units1 = rng.int(u2); |
| 1148 | const value = switch (units1) { |
| 1149 | 0 => rng.int(u7), |
| 1150 | 1 => rng.intRangeAtMostBiased(u11, 0x000080, 0x0007FF), |
| 1151 | 2 => rng.intRangeAtMostBiased(u16, 0x000800, 0x00FFFF), |
| 1152 | 3 => rng.intRangeAtMostBiased(u21, 0x010000, 0x10FFFF), |
| 1153 | }; |
| 1154 | const units = @as(u3, units1) + 1; |
| 1155 | |
| 1156 | var buf: [4]u8 = undefined; |
| 1157 | assert(std.unicode.wtf8Encode(value, &buf) catch unreachable == units); |
| 1158 | out.appendSliceAssumeCapacity(buf[0..units]); |
| 1159 | |
| 1160 | codepoints -= 1; |
| 1161 | if (codepoints == 0) break; |
| 1162 | } |
| 1163 | }, |
| 1164 | .existing => { |
| 1165 | const j = rng.uintAtMostBiased(usize, in.len - len); |
| 1166 | out.appendSliceAssumeCapacity(in[j..][0..len]); |
| 1167 | }, |
| 1168 | .splice => { |
| 1169 | const j = rng.uintAtMostBiased(usize, corpus[splice_i].len - len); |
| 1170 | out.appendSliceAssumeCapacity(corpus[splice_i][j..][0..len]); |
| 1171 | }, |
| 1172 | .@"const" => out.appendSliceAssumeCapacity(mem.asBytes( |
| 1173 | &data_ctx[rng.uintLessThanBiased(usize, data_ctx.len)], |
| 1174 | )), |
| 1175 | .small => out.appendSliceAssumeCapacity(mem.asBytes( |
| 1176 | &mem.nativeTo(data_ctx[0], rng.int(SmallValue), data_ctx[1]), |
| 1177 | )), |
| 1178 | .few => out.appendSliceAssumeCapacity(mem.asBytes( |
| 1179 | &fewValue(rng, data_ctx[0], data_ctx[1]), |
| 1180 | )), |
| 1181 | } |
| 1182 | switch (op) { |
| 1183 | .set => out.appendSliceAssumeCapacity(in[i + len ..]), |
| 1184 | .insert => out.appendSliceAssumeCapacity(in[i..]), |
| 1185 | .push => {}, |
| 1186 | } |
| 1187 | }, |
| 1188 | .remove => { |
| 1189 | if (in.len == 0) return false; |
| 1190 | const Op = enum { delete, pop }; |
| 1191 | const op: Op, const max_len = class_ctx; |
| 1192 | // LessThan is used so we don't delete the entire span (which is unproductive since |
| 1193 | // an empty input has always been tried) |
| 1194 | const len = if (max_len == 1) 1 else rng.uintLessThanBiased( |
| 1195 | usize, |
| 1196 | @min(max_len + 1, in.len), |
| 1197 | ); |
| 1198 | switch (op) { |
| 1199 | .delete => { |
| 1200 | const i = rng.uintAtMostBiased(usize, in.len - len); |
| 1201 | out.appendSliceAssumeCapacity(in[0..i]); |
| 1202 | out.appendSliceAssumeCapacity(in[i + len ..]); |
| 1203 | }, |
| 1204 | .pop => out.appendSliceAssumeCapacity(in[0 .. in.len - len]), |
| 1205 | } |
| 1206 | }, |
| 1207 | .rmw => { |
| 1208 | const Op = enum { xor, truncate, add, packed_rng }; |
| 1209 | const op: Op, const T, const endian, const xor_bits = class_ctx; |
| 1210 | if (in.len < @sizeOf(T)) return false; |
| 1211 | const Log2T = math.Log2Int(T); |
| 1212 | |
| 1213 | const idx = rng.uintAtMostBiased(usize, in.len - @sizeOf(T)); |
| 1214 | const old = mem.readInt(T, in[idx..][0..@sizeOf(T)], endian); |
| 1215 | const new = switch (op) { |
| 1216 | .xor => old ^ fewValue(rng, T, xor_bits), |
| 1217 | .truncate => old & (@as(T, math.maxInt(T)) >> rng.int(Log2T)), |
| 1218 | .add => old +% addend: { |
| 1219 | const val = rng.int(Mutation.AddValue); |
| 1220 | break :addend if (val == 0) 1 else val; |
| 1221 | }, |
| 1222 | .packed_rng => blk: { |
| 1223 | const bits = rng.int(math.Log2Int(T)) +| 1; |
| 1224 | break :blk old ^ (rng.int(T) >> bits << rng.uintAtMostBiased(Log2T, bits)); |
| 1225 | }, |
| 1226 | }; |
| 1227 | out.appendSliceAssumeCapacity(in); |
| 1228 | mem.bytesAsValue(T, out.items[8..][idx..][0..@sizeOf(T)]).* = |
| 1229 | mem.nativeTo(T, new, endian); |
| 1230 | }, |
| 1231 | .move_span => { |
| 1232 | if (in.len < 2) return false; |
| 1233 | // One less since moving whole output will never change anything |
| 1234 | const len = rng.intRangeAtMostBiased(usize, 1, @min( |
| 1235 | in.len - 1, |
| 1236 | Mutation.max_set_len, |
| 1237 | )); |
| 1238 | |
| 1239 | const src = rng.uintAtMostBiased(usize, in.len - len); |
| 1240 | // This indexes into the final input |
| 1241 | const dst = blk: { |
| 1242 | const res = rng.uintAtMostBiased(usize, in.len - len - 1); |
| 1243 | break :blk res + @intFromBool(res >= src); |
| 1244 | }; |
| 1245 | |
| 1246 | if (src < dst) { |
| 1247 | out.appendSliceAssumeCapacity(in[0..src]); |
| 1248 | out.appendSliceAssumeCapacity(in[src + len .. dst + len]); |
| 1249 | out.appendSliceAssumeCapacity(in[src..][0..len]); |
| 1250 | out.appendSliceAssumeCapacity(in[dst + len ..]); |
| 1251 | } else { |
| 1252 | out.appendSliceAssumeCapacity(in[0..dst]); |
| 1253 | out.appendSliceAssumeCapacity(in[src..][0..len]); |
| 1254 | out.appendSliceAssumeCapacity(in[dst..src]); |
| 1255 | out.appendSliceAssumeCapacity(in[src + len ..]); |
| 1256 | } |
| 1257 | }, |
| 1258 | .replicate_splice_span => { |
| 1259 | if (in.len == 0) return false; |
| 1260 | if (corpus.len == 1) return false; |
| 1261 | const from = corpus[rng.intRangeLessThanBiased(usize, 1, corpus.len)]; |
| 1262 | const len = rng.uintLessThanBiased(usize, @min(in.len, from.len, max_replicate_len)); |
| 1263 | const i = rng.uintAtMostBiased(usize, @min(in.len, from.len) - len); |
| 1264 | out.appendSliceAssumeCapacity(in[0..i]); |
| 1265 | out.appendSliceAssumeCapacity(from[i..][0..len]); |
| 1266 | out.appendSliceAssumeCapacity(in[i + len ..]); |
| 1267 | }, |
| 1268 | } |
| 1269 | return true; |
| 1270 | } |
| 1271 | }; |
| 1272 | |
| 530 | 1273 | /// Like `std.ArrayListUnmanaged(u8)` but backed by memory mapping. |
| 531 | 1274 | pub const MemoryMappedList = struct { |
| 532 | 1275 | /// Contents of the list. |
| ... | ... | @@ -654,8 +1397,23 @@ pub const MemoryMappedList = struct { |
| 654 | 1397 | fn growCapacity(current: usize, minimum: usize) usize { |
| 655 | 1398 | var new = current; |
| 656 | 1399 | while (true) { |
| 657 | | new = std.mem.alignForward(usize, new + new / 2, std.heap.page_size_max); |
| 1400 | new = mem.alignForward(usize, new + new / 2, std.heap.page_size_max); |
| 658 | 1401 | if (new >= minimum) return new; |
| 659 | 1402 | } |
| 660 | 1403 | } |
| 1404 | |
| 1405 | pub fn insertAssumeCapacity(l: *MemoryMappedList, i: usize, item: u8) void { |
| 1406 | assert(l.items.len + 1 <= l.capacity); |
| 1407 | l.items.len += 1; |
| 1408 | volatileCopyBackwards(u8, l.items[i + 1 ..], l.items[i .. l.items.len - 1]); |
| 1409 | l.items[i] = item; |
| 1410 | } |
| 1411 | |
| 1412 | pub fn orderedRemove(l: *MemoryMappedList, i: usize) u8 { |
| 1413 | assert(l.items.len + 1 <= l.capacity); |
| 1414 | const old = l.items[i]; |
| 1415 | volatileCopyForwards(u8, l.items[i .. l.items.len - 1], l.items[i + 1 ..]); |
| 1416 | l.items.len -= 1; |
| 1417 | return old; |
| 1418 | } |
| 661 | 1419 | }; |
Andrew Kelley <andrew@ziglang.org> 2025-09-19 09:27:25-07:00
GitHub <noreply@github.com> 2025-09-19 09:27:25-07:00
Signed by PGP key B5690EEEBB952194
lib