rust/src/libfuzzer/fuzzer.rc

667 lines
21 KiB
Plaintext

// Copyright 2012-2013 The Rust Project Developers. See the COPYRIGHT
// file at the top-level directory of this distribution and at
// http://rust-lang.org/COPYRIGHT.
//
// Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
// http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
// <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your
// option. This file may not be copied, modified, or distributed
// except according to those terms.
#[link(name = "fuzzer",
vers = "0.7-pre",
uuid = "d6418797-2736-4833-bd82-d3c684b7c1b0",
url = "https://github.com/mozilla/rust/tree/master/src/libfuzzer")];
#[comment = "The Rust fuzzer library"];
#[license = "MIT/ASL2"];
#[crate_type = "lib"];
#[no_core];
#[legacy_modes];
#[allow(vecs_implicitly_copyable)];
#[allow(non_camel_case_types)];
#[allow(deprecated_mode)];
#[allow(deprecated_pattern)];
extern mod core(vers = "0.7-pre");
extern mod std(vers = "0.7-pre");
extern mod syntax(vers = "0.7-pre");
use core::*;
use core::io::WriterUtil;
use syntax::{ast, fold, visit, codemap};
use syntax::parse;
use syntax::print::pprust;
use syntax::diagnostic;
#[deriving(Eq)]
pub enum test_mode { tm_converge, tm_run, }
pub struct Context { mode: test_mode } // + rng
pub fn write_file(filename: &Path, content: ~str) {
result::get(
&io::file_writer(filename, ~[io::Create, io::Truncate]))
.write_str(content);
}
pub fn contains(haystack: ~str, needle: ~str) -> bool {
str::contains(haystack, needle)
}
pub fn find_rust_files(files: &mut ~[Path], path: &Path) {
if path.filetype() == Some(~".rs") && !contains(path.to_str(), ~"utf8") {
// ignoring "utf8" tests because something is broken
files.push(*path);
} else if os::path_is_dir(path)
&& !contains(path.to_str(), ~"compile-fail")
&& !contains(path.to_str(), ~"build") {
for os::list_dir_path(path).each |p| {
find_rust_files(&mut *files, *p);
}
}
}
pub fn common_exprs() -> ~[ast::expr] {
fn dse(e: ast::expr_) -> ast::expr {
ast::expr {
id: 0,
callee_id: -1,
node: e,
span: codemap::dummy_sp(),
}
}
fn dsl(l: ast::lit_) -> ast::lit {
codemap::spanned { node: l, span: codemap::dummy_sp() }
}
~[dse(ast::expr_break(option::None)),
dse(ast::expr_again(option::None)),
dse(ast::expr_ret(option::None)),
dse(ast::expr_lit(@dsl(ast::lit_nil))),
dse(ast::expr_lit(@dsl(ast::lit_bool(false)))),
dse(ast::expr_lit(@dsl(ast::lit_bool(true)))),
dse(ast::expr_unary(ast::box(ast::m_imm),
@dse(ast::expr_lit(@dsl(ast::lit_bool(true)))))),
dse(ast::expr_unary(ast::uniq(ast::m_imm),
@dse(ast::expr_lit(@dsl(ast::lit_bool(true))))))
]
}
pub fn safe_to_steal_expr(e: @ast::expr, tm: test_mode) -> bool {
safe_to_use_expr(*e, tm)
}
pub fn safe_to_use_expr(e: ast::expr, tm: test_mode) -> bool {
match tm {
tm_converge => {
match e.node {
// If the fuzzer moves a block-ending-in-semicolon into callee
// position, the pretty-printer can't preserve this even by
// parenthesizing!! See email to marijn.
ast::expr_if(*) | ast::expr_block(*)
| ast::expr_match(*) | ast::expr_while(*) => { false }
// https://github.com/mozilla/rust/issues/929
ast::expr_cast(*) | ast::expr_binary(*) | ast::expr_assign(*) |
ast::expr_assign_op(*) => { false }
ast::expr_ret(option::None) => { false }
// https://github.com/mozilla/rust/issues/953
//ast::expr_fail(option::Some(_)) => { false }
// https://github.com/mozilla/rust/issues/928
//ast::expr_cast(_, _) { false }
// https://github.com/mozilla/rust/issues/1458
ast::expr_call(_, _, _) => { false }
_ => { true }
}
}
tm_run => { true }
}
}
pub fn safe_to_steal_ty(t: @ast::Ty, tm: test_mode) -> bool {
// Restrictions happen to be the same.
safe_to_replace_ty(&t.node, tm)
}
// Not type-parameterized: https://github.com/mozilla/rust/issues/898 (FIXED)
pub fn stash_expr_if(c: @fn(@ast::expr, test_mode)->bool,
es: @mut ~[ast::expr],
e: @ast::expr,
tm: test_mode) {
if c(e, tm) {
*es += ~[*e];
} else {
/* now my indices are wrong :( */
}
}
pub fn stash_ty_if(c: @fn(@ast::Ty, test_mode)->bool,
es: @mut ~[ast::Ty],
e: @ast::Ty,
tm: test_mode) {
if c(e, tm) {
es.push(*e);
} else {
/* now my indices are wrong :( */
}
}
pub struct StolenStuff {exprs: ~[ast::expr], tys: ~[ast::Ty]}
pub fn steal(crate: @ast::crate, tm: test_mode) -> StolenStuff {
let exprs = @mut ~[];
let tys = @mut ~[];
let v = visit::mk_simple_visitor(@visit::SimpleVisitor {
visit_expr: |a| stash_expr_if(safe_to_steal_expr, exprs, a, tm),
visit_ty: |a| stash_ty_if(safe_to_steal_ty, tys, a, tm),
.. *visit::default_simple_visitor()
});
visit::visit_crate(crate, (), v);
StolenStuff {exprs: *exprs, tys: *tys}
}
pub fn safe_to_replace_expr(e: &ast::expr_, _tm: test_mode) -> bool {
match *e {
// https://github.com/mozilla/rust/issues/652
ast::expr_if(*) => { false }
ast::expr_block(_) => { false }
// expr_call is also missing a constraint
ast::expr_fn_block(*) => { false }
_ => { true }
}
}
pub fn safe_to_replace_ty(t: &ast::ty_, _tm: test_mode) -> bool {
match *t {
ast::ty_infer => { false } // always implicit, always top level
ast::ty_bot => { false } // in source, can only appear
// as the out type of a function
ast::ty_mac(_) => { false }
_ => { true }
}
}
// Replace the |i|th expr (in fold order) of |crate| with |newexpr|.
pub fn replace_expr_in_crate(crate: @ast::crate, i: uint,
newexpr: ast::expr, tm: test_mode) ->
ast::crate {
let j: @mut uint = @mut 0u;
fn fold_expr_rep(j_: @mut uint,
i_: uint,
newexpr_: ast::expr_,
original: &ast::expr_,
fld: @fold::ast_fold,
tm_: test_mode)
-> ast::expr_ {
*j_ += 1u;
if i_ + 1u == *j_ && safe_to_replace_expr(original, tm_) {
newexpr_
} else {
fold::noop_fold_expr(original, fld)
}
}
let afp = @fold::AstFoldFns {
fold_expr: fold::wrap(|a,b| {
fold_expr_rep(j, i, newexpr.node, a, b, tm)
}),
.. *fold::default_ast_fold()
};
let af = fold::make_fold(afp);
let crate2: @ast::crate = @af.fold_crate(crate);
*crate2
}
// Replace the |i|th ty (in fold order) of |crate| with |newty|.
pub fn replace_ty_in_crate(crate: @ast::crate, i: uint, newty: ast::Ty,
tm: test_mode) -> ast::crate {
let j: @mut uint = @mut 0u;
fn fold_ty_rep(j_: @mut uint,
i_: uint,
newty_: ast::ty_,
original: &ast::ty_,
fld: @fold::ast_fold,
tm_: test_mode)
-> ast::ty_ {
*j_ += 1u;
if i_ + 1u == *j_ && safe_to_replace_ty(original, tm_) {
newty_
} else { fold::noop_fold_ty(original, fld) }
}
let afp = @fold::AstFoldFns {
fold_ty: fold::wrap(|a,b| fold_ty_rep(j, i, newty.node, a, b, tm) ),
.. *fold::default_ast_fold()
};
let af = fold::make_fold(afp);
let crate2: @ast::crate = @af.fold_crate(crate);
*crate2
}
pub fn under(n: uint, it: &fn(uint)) {
let mut i: uint = 0u;
while i < n { it(i); i += 1u; }
}
pub fn as_str(f: @fn(+x: @io::Writer)) -> ~str {
io::with_str_writer(f)
}
pub fn check_variants_of_ast(crate: @ast::crate, codemap: @codemap::CodeMap,
filename: &Path, cx: Context) {
let stolen = steal(crate, cx.mode);
let extra_exprs = do common_exprs().filtered |a| {
safe_to_use_expr(*a, cx.mode)
};
check_variants_T(crate, codemap, filename, ~"expr",
extra_exprs + stolen.exprs, pprust::expr_to_str,
replace_expr_in_crate, cx);
check_variants_T(crate, codemap, filename, ~"ty", stolen.tys,
pprust::ty_to_str, replace_ty_in_crate, cx);
}
pub fn check_variants_T<T: Copy>(
crate: @ast::crate,
codemap: @codemap::CodeMap,
filename: &Path,
thing_label: ~str,
things: ~[T],
stringifier: @fn(@T, @syntax::parse::token::ident_interner) -> ~str,
replacer: @fn(@ast::crate, uint, T, test_mode) -> ast::crate,
cx: Context
) {
error!("%s contains %u %s objects", filename.to_str(),
things.len(), thing_label);
// Assuming we're not generating any token_trees
let intr = syntax::parse::token::mk_fake_ident_interner();
let L = things.len();
if L < 100 {
do under(uint::min(L, 20)) |i| {
error!("Replacing... #%?", uint::to_str(i));
let fname = str::from_slice(filename.to_str());
do under(uint::min(L, 30)) |j| {
error!("With... %?", stringifier(@things[j], intr));
let crate2 = @replacer(crate, i, things[j], cx.mode);
// It would be best to test the *crate* for stability, but
// testing the string for stability is easier and ok for now.
let handler = diagnostic::mk_handler(None);
let str3 = do io::with_str_reader("") |rdr| {
@as_str(|a|pprust::print_crate(
codemap,
intr,
diagnostic::mk_span_handler(handler, codemap),
crate2,
fname,
rdr,
a,
pprust::no_ann(),
false))
};
match cx.mode {
tm_converge => {
check_roundtrip_convergence(str3, 1u);
}
tm_run => {
let file_label = fmt!("rusttmp/%s_%s_%u_%u",
last_part(filename.to_str()),
thing_label, i, j);
let safe_to_run = !(content_is_dangerous_to_run(*str3)
|| has_raw_pointers(crate2));
check_whole_compiler(*str3, &Path(file_label),
safe_to_run);
}
}
}
}
}
}
pub fn last_part(filename: ~str) -> ~str {
let ix = str::rfind_char(filename, '/').get();
str::slice(filename, ix + 1u, str::len(filename) - 3u).to_owned()
}
pub enum happiness {
passed,
cleanly_rejected(~str),
known_bug(~str),
failed(~str),
}
// We'd find more bugs if we could take an AST here, but
// - that would find many "false positives" or unimportant bugs
// - that would be tricky, requiring use of tasks or serialization
// or randomness.
// This seems to find plenty of bugs as it is :)
pub fn check_whole_compiler(code: ~str, suggested_filename_prefix: &Path,
allow_running: bool) {
let filename = &suggested_filename_prefix.with_filetype("rs");
write_file(filename, code);
let compile_result = check_compiling(filename);
let run_result = match (compile_result, allow_running) {
(passed, true) => { check_running(suggested_filename_prefix) }
(h, _) => { h }
};
match run_result {
passed | cleanly_rejected(_) | known_bug(_) => {
removeIfExists(suggested_filename_prefix);
removeIfExists(&suggested_filename_prefix.with_filetype("rs"));
removeDirIfExists(&suggested_filename_prefix.with_filetype("dSYM"));
}
failed(s) => {
error!("check_whole_compiler failure: %?", s);
error!("Saved as: %?", filename.to_str());
}
}
}
pub fn removeIfExists(filename: &Path) {
// So sketchy!
assert!(!contains(filename.to_str(), ~" "));
run::program_output(~"bash", ~[~"-c", ~"rm " + filename.to_str()]);
}
pub fn removeDirIfExists(filename: &Path) {
// So sketchy!
assert!(!contains(filename.to_str(), ~" "));
run::program_output(~"bash", ~[~"-c", ~"rm -r " + filename.to_str()]);
}
pub fn check_running(exe_filename: &Path) -> happiness {
let p = run::program_output(
~"/Users/jruderman/scripts/timed_run_rust_program.py",
~[exe_filename.to_str()]);
let comb = p.out + ~"\n" + p.err;
if str::len(comb) > 1u {
error!("comb comb comb: %?", comb);
}
if contains(comb, ~"Assertion failed:") {
failed(~"C++ assertion failure")
} else if contains(comb, ~"leaked memory in rust main loop") {
// might also use exit code 134
//failed("Leaked")
known_bug(~"https://github.com/mozilla/rust/issues/910")
} else if contains(comb, ~"src/rt/") {
failed(~"Mentioned src/rt/")
} else if contains(comb, ~"malloc") {
failed(~"Mentioned malloc")
} else {
match p.status {
0 => { passed }
100 => { cleanly_rejected(~"running: explicit fail") }
101 | 247 => { cleanly_rejected(~"running: timed out") }
245 | 246 | 138 | 252 => {
known_bug(~"https://github.com/mozilla/rust/issues/1466")
}
136 | 248 => {
known_bug(
~"SIGFPE - https://github.com/mozilla/rust/issues/944")
}
rc => {
failed(~"Rust program ran but exited with status " +
int::to_str(rc))
}
}
}
}
pub fn check_compiling(filename: &Path) -> happiness {
let p = run::program_output(
~"/Users/jruderman/code/rust/build/x86_64-apple-darwin/\
stage1/bin/rustc",
~[filename.to_str()]);
//error!("Status: %d", p.status);
if p.status == 0 {
passed
} else if p.err != ~"" {
if contains(p.err, ~"error:") {
cleanly_rejected(~"rejected with span_error")
} else {
error!("Stderr: %?", p.err);
failed(~"Unfamiliar error message")
}
} else if contains(p.out, ~"Assertion") && contains(p.out, ~"failed") {
error!("Stdout: %?", p.out);
failed(~"Looks like an llvm assertion failure")
} else if contains(p.out, ~"internal compiler error unimplemented") {
known_bug(~"Something unimplemented")
} else if contains(p.out, ~"internal compiler error") {
error!("Stdout: %?", p.out);
failed(~"internal compiler error")
} else {
error!("%?", p.status);
error!("!Stdout: %?", p.out);
failed(~"What happened?")
}
}
pub fn parse_and_print(code: @~str) -> ~str {
let filename = Path("tmp.rs");
let sess = parse::new_parse_sess(option::None);
write_file(&filename, *code);
let crate = parse::parse_crate_from_source_str(
filename.to_str(), code, ~[], sess);
do io::with_str_reader(*code) |rdr| {
as_str(|a|
pprust::print_crate(
sess.cm,
// Assuming there are no token_trees
syntax::parse::token::mk_fake_ident_interner(),
copy sess.span_diagnostic,
crate,
filename.to_str(),
rdr, a,
pprust::no_ann(),
false) )
}
}
pub fn has_raw_pointers(c: @ast::crate) -> bool {
let has_rp = @mut false;
fn visit_ty(flag: @mut bool, t: @ast::Ty) {
match t.node {
ast::ty_ptr(_) => { *flag = true; }
_ => { }
}
}
let v =
visit::mk_simple_visitor(@visit::SimpleVisitor {
visit_ty: |a| visit_ty(has_rp, a),
.. *visit::default_simple_visitor()});
visit::visit_crate(c, (), v);
return *has_rp;
}
pub fn content_is_dangerous_to_run(code: ~str) -> bool {
let dangerous_patterns =
~[~"xfail-test",
~"import", // espeically fs, run
~"extern",
~"unsafe",
~"log"]; // python --> rust pipe deadlock?
for dangerous_patterns.each |p| { if contains(code, *p) { return true; } }
return false;
}
pub fn content_is_dangerous_to_compile(code: ~str) -> bool {
let dangerous_patterns =
~[~"xfail-test"];
for dangerous_patterns.each |p| { if contains(code, *p) { return true; } }
return false;
}
pub fn content_might_not_converge(code: ~str) -> bool {
let confusing_patterns =
~[~"xfail-test",
~"xfail-pretty",
~"self", // crazy rules enforced by parser not typechecker?
~"spawn", // precedence issues?
~"bind", // precedence issues?
~" be ", // don't want to replace its child with a non-call:
// "Non-call expression in tail call"
~"\n\n\n\n\n" // https://github.com/mozilla/rust/issues/850
];
for confusing_patterns.each |p| { if contains(code, *p) { return true; } }
return false;
}
pub fn file_might_not_converge(filename: &Path) -> bool {
let confusing_files = ~[
~"expr-alt.rs", // pretty-printing "(a = b) = c"
// vs "a = b = c" and wrapping
~"block-arg-in-ternary.rs", // wrapping
~"move-3-unique.rs", // 0 becomes (0), but both seem reasonable. wtf?
~"move-3.rs" // 0 becomes (0), but both seem reasonable. wtf?
];
for confusing_files.each |f| {
if contains(filename.to_str(), *f) {
return true;
}
}
return false;
}
pub fn check_roundtrip_convergence(code: @~str, maxIters: uint) {
let mut i = 0u;
let mut newv = code;
let mut oldv = code;
while i < maxIters {
oldv = newv;
if content_might_not_converge(*oldv) { return; }
newv = @parse_and_print(oldv);
if oldv == newv { break; }
i += 1u;
}
if oldv == newv {
error!("Converged after %u iterations", i);
} else {
error!("Did not converge after %u iterations!", i);
write_file(&Path("round-trip-a.rs"), *oldv);
write_file(&Path("round-trip-b.rs"), *newv);
run::run_program(~"diff",
~[~"-w", ~"-u", ~"round-trip-a.rs",
~"round-trip-b.rs"]);
fail!(~"Mismatch");
}
}
pub fn check_convergence(files: &[Path]) {
error!("pp convergence tests: %u files", vec::len(files));
for files.each |file| {
if !file_might_not_converge(file) {
let s = @result::get(&io::read_whole_file_str(file));
if !content_might_not_converge(*s) {
error!("pp converge: %s", file.to_str());
// Change from 7u to 2u once
// https://github.com/mozilla/rust/issues/850 is fixed
check_roundtrip_convergence(s, 7u);
}
}
}
}
pub fn check_variants(files: &[Path], cx: Context) {
for files.each |file| {
if cx.mode == tm_converge &&
file_might_not_converge(file) {
error!("Skipping convergence test based on\
file_might_not_converge");
loop;
}
let s = @result::get(&io::read_whole_file_str(file));
if contains(*s, ~"#") {
loop; // Macros are confusing
}
if cx.mode == tm_converge && content_might_not_converge(*s) {
loop;
}
if cx.mode == tm_run && content_is_dangerous_to_compile(*s) {
loop;
}
let file_str = file.to_str();
error!("check_variants: %?", file_str);
let sess = parse::new_parse_sess(option::None);
let crate =
parse::parse_crate_from_source_str(
file_str,
s, ~[], sess);
io::with_str_reader(*s, |rdr| {
error!("%s",
as_str(|a| pprust::print_crate(
sess.cm,
// Assuming no token_trees
syntax::parse::token::mk_fake_ident_interner(),
copy sess.span_diagnostic,
crate,
file_str,
rdr, a,
pprust::no_ann(),
false)))
});
check_variants_of_ast(crate, sess.cm, file, cx);
}
}
pub fn main() {
let args = os::args();
if vec::len(args) != 2u {
error!("usage: %s <testdir>", args[0]);
return;
}
let mut files = ~[];
let root = Path(args[1]);
find_rust_files(&mut files, &root);
error!("== check_convergence ==");
check_convergence(files);
error!("== check_variants: converge ==");
check_variants(files, Context { mode: tm_converge });
error!("== check_variants: run ==");
check_variants(files, Context { mode: tm_run });
error!("Fuzzer done");
}
// Local Variables:
// fill-column: 78;
// indent-tabs-mode: nil
// c-basic-offset: 4
// buffer-file-coding-system: utf-8-unix
// End: