Merge faf298b6da865e57a4fb3992938e3f0f25e3b767 into 5f4422d68dc3530c353af1f87499de1c864b60ad

This commit is contained in:
maflcko 2025-03-17 09:50:15 +07:00 committed by GitHub
commit 68c485df3f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 167 additions and 115 deletions

View File

@ -8,7 +8,7 @@ deterministic-fuzz-coverage
A tool to check for non-determinism in fuzz coverage. To get the help, run: A tool to check for non-determinism in fuzz coverage. To get the help, run:
``` ```
RUST_BACKTRACE=1 cargo run --manifest-path ./contrib/devtools/deterministic-fuzz-coverage/Cargo.toml -- --help cargo run --manifest-path ./contrib/devtools/deterministic-fuzz-coverage/Cargo.toml -- --help
``` ```
To execute the tool, compilation has to be done with the build options: To execute the tool, compilation has to be done with the build options:
@ -22,7 +22,7 @@ repository must have been cloned. Finally, a fuzz target has to be picked
before running the tool: before running the tool:
``` ```
RUST_BACKTRACE=1 cargo run --manifest-path ./contrib/devtools/deterministic-fuzz-coverage/Cargo.toml -- $PWD/build_dir $PWD/qa-assets/fuzz_corpora fuzz_target_name cargo run --manifest-path ./contrib/devtools/deterministic-fuzz-coverage/Cargo.toml -- $PWD/build_dir $PWD/qa-assets/fuzz_corpora fuzz_target_name
``` ```
deterministic-unittest-coverage deterministic-unittest-coverage
@ -31,7 +31,7 @@ deterministic-unittest-coverage
A tool to check for non-determinism in unit-test coverage. To get the help, run: A tool to check for non-determinism in unit-test coverage. To get the help, run:
``` ```
RUST_BACKTRACE=1 cargo run --manifest-path ./contrib/devtools/deterministic-unittest-coverage/Cargo.toml -- --help cargo run --manifest-path ./contrib/devtools/deterministic-unittest-coverage/Cargo.toml -- --help
``` ```
To execute the tool, compilation has to be done with the build options: To execute the tool, compilation has to be done with the build options:
@ -43,7 +43,7 @@ To execute the tool, compilation has to be done with the build options:
Both llvm-profdata and llvm-cov must be installed. Both llvm-profdata and llvm-cov must be installed.
``` ```
RUST_BACKTRACE=1 cargo run --manifest-path ./contrib/devtools/deterministic-unittest-coverage/Cargo.toml -- $PWD/build_dir <boost unittest filter> cargo run --manifest-path ./contrib/devtools/deterministic-unittest-coverage/Cargo.toml -- $PWD/build_dir <boost unittest filter>
``` ```
clang-format-diff.py clang-format-diff.py

View File

@ -4,87 +4,99 @@
use std::env; use std::env;
use std::fs::{read_dir, File}; use std::fs::{read_dir, File};
use std::path::Path; use std::path::{Path, PathBuf};
use std::process::{exit, Command}; use std::process::{Command, ExitCode};
use std::str; use std::str;
/// A type for a complete and readable error message.
type AppError = String;
type AppResult = Result<(), AppError>;
fn main() -> ExitCode {
match app() {
Ok(()) => ExitCode::SUCCESS,
Err(err) => {
eprintln!("{}", err);
ExitCode::FAILURE
}
}
}
const LLVM_PROFDATA: &str = "llvm-profdata"; const LLVM_PROFDATA: &str = "llvm-profdata";
const LLVM_COV: &str = "llvm-cov"; const LLVM_COV: &str = "llvm-cov";
const GIT: &str = "git"; const GIT: &str = "git";
fn exit_help(err: &str) -> ! { fn exit_help(err: &str) -> AppError {
eprintln!("Error: {}", err); format!(
eprintln!(); r#"
eprintln!("Usage: program ./build_dir ./qa-assets/fuzz_corpora fuzz_target_name"); Error: {err}
eprintln!();
eprintln!("Refer to the devtools/README.md for more details."); Usage: program ./build_dir ./qa-assets/fuzz_corpora fuzz_target_name
exit(1)
Refer to the devtools/README.md for more details."#
)
} }
fn sanity_check(corpora_dir: &Path, fuzz_exe: &Path) { fn sanity_check(corpora_dir: &Path, fuzz_exe: &Path) -> AppResult {
for tool in [LLVM_PROFDATA, LLVM_COV, GIT] { for tool in [LLVM_PROFDATA, LLVM_COV, GIT] {
let output = Command::new(tool).arg("--help").output(); let output = Command::new(tool).arg("--help").output();
match output { match output {
Ok(output) if output.status.success() => {} Ok(output) if output.status.success() => {}
_ => { _ => Err(exit_help(&format!("The tool {} is not installed", tool)))?,
exit_help(&format!("The tool {} is not installed", tool));
}
} }
} }
if !corpora_dir.is_dir() { if !corpora_dir.is_dir() {
exit_help(&format!( Err(exit_help(&format!(
"Fuzz corpora path ({}) must be a directory", "Fuzz corpora path ({}) must be a directory",
corpora_dir.display() corpora_dir.display()
)); )))?;
} }
if !fuzz_exe.exists() { if !fuzz_exe.exists() {
exit_help(&format!( Err(exit_help(&format!(
"Fuzz executable ({}) not found", "Fuzz executable ({}) not found",
fuzz_exe.display() fuzz_exe.display()
)); )))?;
} }
Ok(())
} }
fn main() { fn app() -> AppResult {
// Parse args // Parse args
let args = env::args().collect::<Vec<_>>(); let args = env::args().collect::<Vec<_>>();
let build_dir = args let build_dir = args.get(1).ok_or(exit_help("Must set build dir"))?;
.get(1)
.unwrap_or_else(|| exit_help("Must set build dir"));
if build_dir == "--help" { if build_dir == "--help" {
exit_help("--help requested") Err(exit_help("--help requested"))?;
} }
let corpora_dir = args let corpora_dir = args.get(2).ok_or(exit_help("Must set fuzz corpora dir"))?;
.get(2)
.unwrap_or_else(|| exit_help("Must set fuzz corpora dir"));
let fuzz_target = args let fuzz_target = args
.get(3) .get(3)
// Require fuzz target for now. In the future it could be optional and the tool could // Require fuzz target for now. In the future it could be optional and the tool could
// iterate over all compiled fuzz targets // iterate over all compiled fuzz targets
.unwrap_or_else(|| exit_help("Must set fuzz target")); .ok_or(exit_help("Must set fuzz target"))?;
if args.get(4).is_some() { if args.get(4).is_some() {
exit_help("Too many args") Err(exit_help("Too many args"))?;
} }
let build_dir = Path::new(build_dir); let build_dir = Path::new(build_dir);
let corpora_dir = Path::new(corpora_dir); let corpora_dir = Path::new(corpora_dir);
let fuzz_exe = build_dir.join("bin/fuzz"); let fuzz_exe = build_dir.join("bin/fuzz");
sanity_check(corpora_dir, &fuzz_exe); sanity_check(corpora_dir, &fuzz_exe)?;
deterministic_coverage(build_dir, corpora_dir, &fuzz_exe, fuzz_target); deterministic_coverage(build_dir, corpora_dir, &fuzz_exe, fuzz_target)
} }
fn using_libfuzzer(fuzz_exe: &Path) -> bool { fn using_libfuzzer(fuzz_exe: &Path) -> Result<bool, AppError> {
println!("Check if using libFuzzer ..."); println!("Check if using libFuzzer ...");
let stderr = Command::new(fuzz_exe) let stderr = Command::new(fuzz_exe)
.arg("-help=1") // Will be interpreted as option (libfuzzer) or as input file .arg("-help=1") // Will be interpreted as option (libfuzzer) or as input file
.env("FUZZ", "addition_overflow") // Any valid target .env("FUZZ", "addition_overflow") // Any valid target
.output() .output()
.expect("fuzz failed") .map_err(|e| format!("fuzz failed with {e}"))?
.stderr; .stderr;
let help_output = str::from_utf8(&stderr).expect("The -help=1 output must be valid text"); let help_output = str::from_utf8(&stderr)
help_output.contains("libFuzzer") .map_err(|e| format!("The libFuzzer -help=1 output must be valid text ({e})"))?;
Ok(help_output.contains("libFuzzer"))
} }
fn deterministic_coverage( fn deterministic_coverage(
@ -92,25 +104,25 @@ fn deterministic_coverage(
corpora_dir: &Path, corpora_dir: &Path,
fuzz_exe: &Path, fuzz_exe: &Path,
fuzz_target: &str, fuzz_target: &str,
) { ) -> AppResult {
let using_libfuzzer = using_libfuzzer(fuzz_exe); let using_libfuzzer = using_libfuzzer(fuzz_exe)?;
let profraw_file = build_dir.join("fuzz_det_cov.profraw"); let profraw_file = build_dir.join("fuzz_det_cov.profraw");
let profdata_file = build_dir.join("fuzz_det_cov.profdata"); let profdata_file = build_dir.join("fuzz_det_cov.profdata");
let corpus_dir = corpora_dir.join(fuzz_target); let corpus_dir = corpora_dir.join(fuzz_target);
let mut entries = read_dir(&corpus_dir) let mut entries = read_dir(&corpus_dir)
.unwrap_or_else(|err| { .map_err(|err| {
exit_help(&format!( exit_help(&format!(
"The fuzz target's input directory must exist! ({}; {})", "The fuzz target's input directory must exist! ({}; {})",
corpus_dir.display(), corpus_dir.display(),
err err
)) ))
}) })?
.map(|entry| entry.expect("IO error")) .map(|entry| entry.expect("IO error"))
.collect::<Vec<_>>(); .collect::<Vec<_>>();
entries.sort_by_key(|entry| entry.file_name()); entries.sort_by_key(|entry| entry.file_name());
let run_single = |run_id: u8, entry: &Path| { let run_single = |run_id: u8, entry: &Path| -> Result<PathBuf, AppError> {
let cov_txt_path = build_dir.join(format!("fuzz_det_cov.show.{run_id}.txt")); let cov_txt_path = build_dir.join(format!("fuzz_det_cov.show.{run_id}.txt"));
assert!({ if !{
{ {
let mut cmd = Command::new(fuzz_exe); let mut cmd = Command::new(fuzz_exe);
if using_libfuzzer { if using_libfuzzer {
@ -122,20 +134,26 @@ fn deterministic_coverage(
.env("FUZZ", fuzz_target) .env("FUZZ", fuzz_target)
.arg(entry) .arg(entry)
.status() .status()
.expect("fuzz failed") .map_err(|e| format!("fuzz failed with {e}"))?
.success() .success()
}); } {
assert!(Command::new(LLVM_PROFDATA) Err("fuzz failed".to_string())?;
}
if !Command::new(LLVM_PROFDATA)
.arg("merge") .arg("merge")
.arg("--sparse") .arg("--sparse")
.arg(&profraw_file) .arg(&profraw_file)
.arg("-o") .arg("-o")
.arg(&profdata_file) .arg(&profdata_file)
.status() .status()
.expect("merge failed") .map_err(|e| format!("{LLVM_PROFDATA} merge failed with {e}"))?
.success()); .success()
let cov_file = File::create(&cov_txt_path).expect("Failed to create coverage txt file"); {
assert!(Command::new(LLVM_COV) Err(format!("{LLVM_PROFDATA} merge failed"))?;
}
let cov_file = File::create(&cov_txt_path)
.map_err(|e| format!("Failed to create coverage txt file ({e})"))?;
if !Command::new(LLVM_COV)
.args([ .args([
"show", "show",
"--show-line-counts-or-regions", "--show-line-counts-or-regions",
@ -146,27 +164,31 @@ fn deterministic_coverage(
.arg(fuzz_exe) .arg(fuzz_exe)
.stdout(cov_file) .stdout(cov_file)
.spawn() .spawn()
.expect("Failed to execute llvm-cov") .map_err(|e| format!("{LLVM_COV} show failed with {e}"))?
.wait() .wait()
.expect("Failed to execute llvm-cov") .map_err(|e| format!("{LLVM_COV} show failed with {e}"))?
.success()); .success()
cov_txt_path {
Err(format!("{LLVM_COV} show failed"))?;
};
Ok(cov_txt_path)
}; };
let check_diff = |a: &Path, b: &Path, err: &str| { let check_diff = |a: &Path, b: &Path, err: &str| -> AppResult {
let same = Command::new(GIT) let same = Command::new(GIT)
.args(["--no-pager", "diff", "--no-index"]) .args(["--no-pager", "diff", "--no-index"])
.arg(a) .arg(a)
.arg(b) .arg(b)
.status() .status()
.expect("Failed to execute git command") .map_err(|e| format!("{GIT} diff failed with {e}"))?
.success(); .success();
if !same { if !same {
eprintln!(); Err(format!(
eprintln!("The coverage was not deterministic between runs."); r#"
eprintln!("{}", err); The coverage was not deterministic between runs.
eprintln!("Exiting."); {err}"#
exit(1); ))?;
} }
Ok(())
}; };
// First, check that each fuzz input is deterministic running by itself in a process. // First, check that each fuzz input is deterministic running by itself in a process.
// //
@ -175,29 +197,36 @@ fn deterministic_coverage(
// //
// Also, This can catch issues where several fuzz inputs are non-deterministic, but the sum of // Also, This can catch issues where several fuzz inputs are non-deterministic, but the sum of
// their overall coverage trace remains the same across runs and thus remains undetected. // their overall coverage trace remains the same across runs and thus remains undetected.
println!("Check each fuzz input individually ...");
for entry in entries { for entry in entries {
let entry = entry.path(); let entry = entry.path();
assert!(entry.is_file()); if !entry.is_file() {
let cov_txt_base = run_single(0, &entry); Err(format!("{} should be a file", entry.display()))?;
let cov_txt_repeat = run_single(1, &entry); }
let cov_txt_base = run_single(0, &entry)?;
let cov_txt_repeat = run_single(1, &entry)?;
check_diff( check_diff(
&cov_txt_base, &cov_txt_base,
&cov_txt_repeat, &cov_txt_repeat,
&format!("The fuzz target input was {}.", entry.display()), &format!("The fuzz target input was {}.", entry.display()),
); )?;
} }
// Finally, check that running over all fuzz inputs in one process is deterministic as well. // Finally, check that running over all fuzz inputs in one process is deterministic as well.
// This can catch issues where mutable global state is leaked from one fuzz input execution to // This can catch issues where mutable global state is leaked from one fuzz input execution to
// the next. // the next.
println!("Check all fuzz inputs in one go ...");
{ {
assert!(corpus_dir.is_dir()); if !corpus_dir.is_dir() {
let cov_txt_base = run_single(0, &corpus_dir); Err(format!("{} should be a folder", corpus_dir.display()))?;
let cov_txt_repeat = run_single(1, &corpus_dir); }
let cov_txt_base = run_single(0, &corpus_dir)?;
let cov_txt_repeat = run_single(1, &corpus_dir)?;
check_diff( check_diff(
&cov_txt_base, &cov_txt_base,
&cov_txt_repeat, &cov_txt_repeat,
&format!("All fuzz inputs in {} were used.", corpus_dir.display()), &format!("All fuzz inputs in {} were used.", corpus_dir.display()),
); )?;
} }
println!("Coverage test passed for {fuzz_target}."); println!("Coverage test passed for {fuzz_target}.");
Ok(())
} }

View File

@ -4,90 +4,111 @@
use std::env; use std::env;
use std::fs::File; use std::fs::File;
use std::path::Path; use std::path::{Path, PathBuf};
use std::process::{exit, Command}; use std::process::{Command, ExitCode};
use std::str; use std::str;
const LLVM_PROFDATA: &str = "llvm-profdata"; const LLVM_PROFDATA: &str = "llvm-profdata";
const LLVM_COV: &str = "llvm-cov"; const LLVM_COV: &str = "llvm-cov";
const GIT: &str = "git"; const GIT: &str = "git";
fn exit_help(err: &str) -> ! { /// A type for a complete and readable error message.
eprintln!("Error: {}", err); type AppError = String;
eprintln!(); type AppResult = Result<(), AppError>;
eprintln!("Usage: program ./build_dir boost_unittest_filter");
eprintln!(); fn main() -> ExitCode {
eprintln!("Refer to the devtools/README.md for more details."); match app() {
exit(1) Ok(()) => ExitCode::SUCCESS,
Err(err) => {
eprintln!("{}", err);
ExitCode::FAILURE
}
}
} }
fn sanity_check(test_exe: &Path) { fn exit_help(err: &str) -> AppError {
format!(
r#"
Error: {err}
Usage: program ./build_dir boost_unittest_filter
Refer to the devtools/README.md for more details."#
)
}
fn sanity_check(test_exe: &Path) -> AppResult {
for tool in [LLVM_PROFDATA, LLVM_COV, GIT] { for tool in [LLVM_PROFDATA, LLVM_COV, GIT] {
let output = Command::new(tool).arg("--help").output(); let output = Command::new(tool).arg("--help").output();
match output { match output {
Ok(output) if output.status.success() => {} Ok(output) if output.status.success() => {}
_ => { _ => Err(exit_help(&format!("The tool {} is not installed", tool)))?,
exit_help(&format!("The tool {} is not installed", tool));
}
} }
} }
if !test_exe.exists() { if !test_exe.exists() {
exit_help(&format!( Err(exit_help(&format!(
"Test executable ({}) not found", "Test executable ({}) not found",
test_exe.display() test_exe.display()
)); )))?;
} }
Ok(())
} }
fn main() { fn app() -> AppResult {
// Parse args // Parse args
let args = env::args().collect::<Vec<_>>(); let args = env::args().collect::<Vec<_>>();
let build_dir = args let build_dir = args.get(1).ok_or(exit_help("Must set build dir"))?;
.get(1)
.unwrap_or_else(|| exit_help("Must set build dir"));
if build_dir == "--help" { if build_dir == "--help" {
exit_help("--help requested") Err(exit_help("--help requested"))?;
} }
let filter = args let filter = args
.get(2) .get(2)
// Require filter for now. In the future it could be optional and the tool could provide a // Require filter for now. In the future it could be optional and the tool could provide a
// default filter. // default filter.
.unwrap_or_else(|| exit_help("Must set boost test filter")); .ok_or(exit_help("Must set boost test filter"))?;
if args.get(3).is_some() { if args.get(3).is_some() {
exit_help("Too many args") Err(exit_help("Too many args"))?;
} }
let build_dir = Path::new(build_dir); let build_dir = Path::new(build_dir);
let test_exe = build_dir.join("bin/test_bitcoin"); let test_exe = build_dir.join("bin/test_bitcoin");
sanity_check(&test_exe); sanity_check(&test_exe)?;
deterministic_coverage(build_dir, &test_exe, filter); deterministic_coverage(build_dir, &test_exe, filter)
} }
fn deterministic_coverage(build_dir: &Path, test_exe: &Path, filter: &str) { fn deterministic_coverage(build_dir: &Path, test_exe: &Path, filter: &str) -> AppResult {
let profraw_file = build_dir.join("test_det_cov.profraw"); let profraw_file = build_dir.join("test_det_cov.profraw");
let profdata_file = build_dir.join("test_det_cov.profdata"); let profdata_file = build_dir.join("test_det_cov.profdata");
let run_single = |run_id: u8| { let run_single = |run_id: u8| -> Result<PathBuf, AppError> {
println!("Run with id {run_id}");
let cov_txt_path = build_dir.join(format!("test_det_cov.show.{run_id}.txt")); let cov_txt_path = build_dir.join(format!("test_det_cov.show.{run_id}.txt"));
assert!(Command::new(test_exe) if !Command::new(test_exe)
.env("LLVM_PROFILE_FILE", &profraw_file) .env("LLVM_PROFILE_FILE", &profraw_file)
.env("BOOST_TEST_RUN_FILTERS", filter) .env("BOOST_TEST_RUN_FILTERS", filter)
.env("RANDOM_CTX_SEED", "21") .env("RANDOM_CTX_SEED", "21")
.status() .status()
.expect("test failed") .map_err(|e| format!("test failed with {e}"))?
.success()); .success()
assert!(Command::new(LLVM_PROFDATA) {
Err("test failed".to_string())?;
}
if !Command::new(LLVM_PROFDATA)
.arg("merge") .arg("merge")
.arg("--sparse") .arg("--sparse")
.arg(&profraw_file) .arg(&profraw_file)
.arg("-o") .arg("-o")
.arg(&profdata_file) .arg(&profdata_file)
.status() .status()
.expect("merge failed") .map_err(|e| format!("{LLVM_PROFDATA} merge failed with {e}"))?
.success()); .success()
let cov_file = File::create(&cov_txt_path).expect("Failed to create coverage txt file"); {
assert!(Command::new(LLVM_COV) Err(format!("{LLVM_PROFDATA} merge failed"))?;
}
let cov_file = File::create(&cov_txt_path)
.map_err(|e| format!("Failed to create coverage txt file ({e})"))?;
if !Command::new(LLVM_COV)
.args([ .args([
"show", "show",
"--show-line-counts-or-regions", "--show-line-counts-or-regions",
@ -98,27 +119,29 @@ fn deterministic_coverage(build_dir: &Path, test_exe: &Path, filter: &str) {
.arg(test_exe) .arg(test_exe)
.stdout(cov_file) .stdout(cov_file)
.status() .status()
.expect("llvm-cov failed") .map_err(|e| format!("{LLVM_COV} show failed with {e}"))?
.success()); .success()
cov_txt_path {
Err(format!("{LLVM_COV} show failed"))?;
}
Ok(cov_txt_path)
}; };
let check_diff = |a: &Path, b: &Path| { let check_diff = |a: &Path, b: &Path| -> AppResult {
let same = Command::new(GIT) let same = Command::new(GIT)
.args(["--no-pager", "diff", "--no-index"]) .args(["--no-pager", "diff", "--no-index"])
.arg(a) .arg(a)
.arg(b) .arg(b)
.status() .status()
.expect("Failed to execute git command") .map_err(|e| format!("{GIT} diff failed with {e}"))?
.success(); .success();
if !same { if !same {
eprintln!(); Err("The coverage was not deterministic between runs.".to_string())?;
eprintln!("The coverage was not deterministic between runs.");
eprintln!("Exiting.");
exit(1);
} }
Ok(())
}; };
let r0 = run_single(0); let r0 = run_single(0)?;
let r1 = run_single(1); let r1 = run_single(1)?;
check_diff(&r0, &r1); check_diff(&r0, &r1)?;
println!("The coverage was deterministic across two runs."); println!("The coverage was deterministic across two runs.");
Ok(())
} }