Undefined symbols from libfuzzer when fuzzing a module that uses LZ4 #31412

tondik commented 2026年03月07日 00:23:08 +01:00

Zig Version

0.16.0-dev.2694+74f361a5c

Steps to Reproduce and Observed Behavior

I wasn't able to reproduce the issue when using a simple C file instead of LZ4.

zig fetch --save=lz4 "git+https://github.com/lz4/lz4#v1.10.0"

build.zig

conststd=@import("std");pubfnbuild(b:*std.Build)void{consttarget=b.standardTargetOptions(.{});constoptimize=b.standardOptimizeOption(.{});consttest_step=b.step("test","Run tests.");constmodule=b.createModule(.{.root_source_file=b.path("src/main.zig"),.target=target,.optimize=optimize,.link_libc=true,});constlz4_src=b.dependency("lz4",.{});module.addIncludePath(lz4_src.path("lib"));module.addCSourceFile(.{.file=lz4_src.path("lib/lz4.c")});consttest_artifact=b.addRunArtifact(b.addTest(.{.root_module=module}));test_step.dependOn(&test_artifact.step);}

src/main.zig

conststd=@import("std");constc=@cImport(@cInclude("lz4.h"));pubfnmain()!void{}test"fuzz example"{trystd.testing.fuzz({},testOne,.{});}fntestOne(context:void,smith:*std.testing.Smith)!void{_=context;_=smith;consthello="Hello Zig";varaaaaa:[10]u8=undefined;_=c.LZ4_decompress_safe(hello.ptr,&aaaaa,hello.len,aaaaa.len);}

> zig build test --fuzz
info(web_server): web interface listening at http://[::1]:33599/
info(web_server): hint: pass '--webui=[::1]:33599' to use the same port next time
Build Summary: 3/3 steps succeeded; 1/1 tests passed
test
└─ run test
 └─ compile test Debug native 6 errors
error: undefined symbol: __sanitizer_cov_trace_const_cmp4
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compressBound
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compressBound
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced 2666 more times
error: undefined symbol: __sanitizer_cov_trace_const_cmp8
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced 6999 more times
error: undefined symbol: __sanitizer_cov_trace_cmp4
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced 474 more times
error: undefined symbol: __sanitizer_cov_trace_cmp1
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced 4189 more times
error: undefined symbol: __sanitizer_cov_trace_cmp8
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced 6505 more times
error: undefined symbol: __sanitizer_cov_trace_switch
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState
 note: referenced 107 more times
error: 6 compilation errors
...

Using LLVM and LLD for the test didn't help, changing the optimization mode for the module and fuzzer (using --debug-rt flag or with b.graph.debug_compiler_runtime_libs = optimize;) also didn't.

Expected Behavior

Code compiles and fuzzing is run.

### Zig Version 0.16.0-dev.2694+74f361a5c ### Steps to Reproduce and Observed Behavior I wasn't able to reproduce the issue when using a simple C file instead of LZ4. ``` zig fetch --save=lz4 "git+https://github.com/lz4/lz4#v1.10.0" ``` ### build.zig ```zig const std = @import("std"); pub fn build(b: *std.Build) void { const target = b.standardTargetOptions(.{}); const optimize = b.standardOptimizeOption(.{}); const test_step = b.step("test", "Run tests."); const module = b.createModule(.{ .root_source_file = b.path("src/main.zig"), .target = target, .optimize = optimize, .link_libc = true, }); const lz4_src = b.dependency("lz4", .{}); module.addIncludePath(lz4_src.path("lib")); module.addCSourceFile(.{ .file = lz4_src.path("lib/lz4.c") }); const test_artifact = b.addRunArtifact(b.addTest(.{ .root_module = module })); test_step.dependOn(&test_artifact.step); } ``` ### src/main.zig ```zig const std = @import("std"); const c = @cImport(@cInclude("lz4.h")); pub fn main() !void {} test "fuzz example" { try std.testing.fuzz({}, testOne, .{}); } fn testOne(context: void, smith: *std.testing.Smith) !void { _ = context; _ = smith; const hello = "Hello Zig"; var aaaaa: [10]u8 = undefined; _ = c.LZ4_decompress_safe(hello.ptr, &aaaaa, hello.len, aaaaa.len); } ``` ``` > zig build test --fuzz info(web_server): web interface listening at http://[::1]:33599/ info(web_server): hint: pass '--webui=[::1]:33599' to use the same port next time Build Summary: 3/3 steps succeeded; 1/1 tests passed test └─ run test └─ compile test Debug native 6 errors error: undefined symbol: __sanitizer_cov_trace_const_cmp4 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compressBound note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compressBound note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced 2666 more times error: undefined symbol: __sanitizer_cov_trace_const_cmp8 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced 6999 more times error: undefined symbol: __sanitizer_cov_trace_cmp4 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced 474 more times error: undefined symbol: __sanitizer_cov_trace_cmp1 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced 4189 more times error: undefined symbol: __sanitizer_cov_trace_cmp8 note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced 6505 more times error: undefined symbol: __sanitizer_cov_trace_switch note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced by .zig-cache/o/8b2e772c078a1be55e93b8f29553abbb/lz4.o:.text.LZ4_compress_fast_extState note: referenced 107 more times error: 6 compilation errors ... ``` Using LLVM and LLD for the test didn't help, changing the optimization mode for the module and fuzzer (using `--debug-rt` flag or with `b.graph.debug_compiler_runtime_libs = optimize;`) also didn't. ### Expected Behavior Code compiles and fuzzing is run.

justusk commented 2026年03月07日 13:59:46 +01:00

The immediate problem here is that -fsanitize=fuzzer-no-link (which zig passes to clang if fuzzing is enabled) implies -fsanitize-coverage=trace-cmp which the zig fuzzer doesn't implement (yet?).
https://llvm.org/docs/LibFuzzer.html#tracing-cmp-instructions
https://clang.llvm.org/docs/SanitizerCoverage.html#tracing-data-flow

The immediate problem here is that `-fsanitize=fuzzer-no-link` (which zig passes to clang if fuzzing is enabled) implies `-fsanitize-coverage=trace-cmp` which the zig fuzzer doesn't implement (yet?). https://llvm.org/docs/LibFuzzer.html#tracing-cmp-instructions https://clang.llvm.org/docs/SanitizerCoverage.html#tracing-data-flow

gooncreeper commented 2026年03月07日 19:20:33 +01:00

The fuzzer used to use -fsanitize-coverage=trace-cmp but was removed in #31205 since it is not useful for a smith-based approach and is expensive.

The fuzzer used to use `-fsanitize-coverage=trace-cmp` but was removed in #31205 since it is not useful for a smith-based approach and is expensive.

archaistvolts commented 2026年05月22日 03:30:55 +02:00

Is there any workaround to get these symbols included? I'm getting a similar error in my zroaring project trying to fuzz against CRoaring which appears to need them.

I'm seeing these symbol names where N=8,4,2,1.

__sanitizer_cov_trace_const_cmp$N
__sanitizer_cov_trace_cmp$N
__sanitizer_cov_trace_switch

Is there any workaround to get these symbols included? I'm getting a similar error in my zroaring project trying to fuzz against CRoaring which appears to need them. I'm seeing these symbol names where N=8,4,2,1. ``` __sanitizer_cov_trace_const_cmp$N __sanitizer_cov_trace_cmp$N __sanitizer_cov_trace_switch ```

justusk commented 2026年05月22日 10:25:56 +02:00

I have a diff to get it working from some time ago which I didn't end up PRing as it buys into the instrumentation emitted by LLVM fully and that might not be the best/most flexible way to go for the instrumentation emitted by Zig. Feel free to use it though, but note that I wrote it on top of 10256e1b81 so it might need some tweaks to work.

diff

From 3aa9948345ce2c396585cdded7f80c7f98a2ce30 Mon Sep 17 00:00:00 2001
From: Justus Klausecker <justus@klausecker.de>
Date: 2026年3月19日 11:55:40 +0100
Subject: [PATCH] fuzz: make instrumentation emitted by zig compatible with the
 one emitted by clang
The LLVM backend now emits its instrumentation into the same sections as
clang and emits an LLVM `PCTableEntry` per POI instead of just a pc.
The difference is that there's an additional `PCFlags` field (which is
always zeroed by the LLVM backend).
This change only affects the instrumentation emitted by the LLVM backend,
libfuzzer still behaves exactly the same and just ignores the additional
instrumentation. The only difference is that libfuzzer is now also able to
fuzz objects emitted by clang.
---
 lib/fuzzer.zig | 46 +++++++++++++++++++++++++-------------------
 src/Compilation.zig | 8 ++++----
 src/codegen/llvm.zig | 46 ++++++++++++++++++++++++--------------------
 3 files changed, 55 insertions(+), 45 deletions(-)
diff --git a/lib/fuzzer.zig b/lib/fuzzer.zig
index 742bf39125..5c99ce4948 100644
--- a/lib/fuzzer.zig
+++ b/lib/fuzzer.zig
@@ -55,6 +55,12 @@ fn bitsetUsizes(elems: usize) usize {
 return math.divCeil(usize, elems, @bitSizeOf(usize)) catch unreachable;
 }
 
+/// https://github.com/llvm/llvm-project/blob/6121df77a781d2e6f9a8e569aa45ccfffd6c7e0e/compiler-rt/lib/fuzzer/FuzzerTracePC.h#L122
+const PCTableEntry = extern struct {
+ PC: usize,
+ PCFlags: usize,
+};
+
 const Executable = struct {
 /// Tracks the hit count for each pc as updated by the test's instrumentation.
 pc_counters: []u8,
@@ -68,7 +74,7 @@ const Executable = struct {
 
 fn getCoverageMap(
 cache_dir: Io.Dir,
- pcs: []const usize,
+ pc_table: []const PCTableEntry,
 pc_digest: u64,
 ) []align(std.heap.page_size_min) volatile u8 {
 const file_name = std.fmt.hex(pc_digest);
@@ -97,10 +103,10 @@ const Executable = struct {
 
 comptime assert(abi.SeenPcsHeader.trailing[0] == .pc_bits_usize);
 comptime assert(abi.SeenPcsHeader.trailing[1] == .pc_addr);
- const pc_bitset_usizes = bitsetUsizes(pcs.len);
+ const pc_bitset_usizes = bitsetUsizes(pc_table.len);
 const coverage_file_len = @sizeOf(abi.SeenPcsHeader) +
 pc_bitset_usizes * @sizeOf(usize) +
- pcs.len * @sizeOf(usize);
+ pc_table.len * @sizeOf(usize);
 
 if (populate) {
 coverage_file.setLength(io, coverage_file_len) catch |e|
@@ -128,11 +134,11 @@ const Executable = struct {
 header.* = .{
 .n_runs = 0,
 .unique_runs = 0,
- .pcs_len = pcs.len,
+ .pcs_len = pc_table.len,
 };
 @memset(trailing_bitset, 0);
- for (trailing_addresses, pcs) |*cov_pc, slided_pc| {
- cov_pc.* = fuzzer_unslide_address(slided_pc);
+ for (trailing_addresses, pc_table) |*cov_pc, entry| {
+ cov_pc.* = fuzzer_unslide_address(entry.PC);
 }
 io_map.write(io) catch |e|
 panic("failed to write memory map of '{s}': {t}", .{ &file_name, e });
@@ -142,12 +148,12 @@ const Executable = struct {
 .{ &file_name, e },
 );
 } else { // Check expected contents
- if (header.pcs_len != pcs.len) panic(
+ if (header.pcs_len != pc_table.len) panic(
 "incompatible existing coverage file '{s}' (differing pcs length: {} != {})",
- .{ &file_name, header.pcs_len, pcs.len },
+ .{ &file_name, header.pcs_len, pc_table.len },
 );
- for (0.., header.pcAddrs(), pcs) |i, cov_pc, slided_pc| {
- const pc = fuzzer_unslide_address(slided_pc);
+ for (0.., header.pcAddrs(), pc_table) |i, cov_pc, entry| {
+ const pc = fuzzer_unslide_address(entry.PC);
 if (cov_pc != pc) panic(
 "incompatible existing coverage file '{s}' (differing pc at index {d}: {x} != {x})",
 .{ &file_name, i, cov_pc, pc },
@@ -192,15 +198,15 @@ const Executable = struct {
 break :blk pc_counters_start[0 .. pc_counters_end - pc_counters_start];
 };
 
- const pcs = blk: {
- const pcs_start_name = section_start_prefix ++ "__sancov_pcs1";
- const pcs_start = @extern([*]usize, .{
+ const pc_table = blk: {
+ const pcs_start_name = section_start_prefix ++ "__sancov_pcs";
+ const pcs_start = @extern([*]PCTableEntry, .{
 .name = pcs_start_name,
 .linkage = .weak,
 }) orelse panic("missing {s} symbol", .{pcs_start_name});
 
- const pcs_end_name = section_end_prefix ++ "__sancov_pcs1";
- const pcs_end = @extern([*]usize, .{
+ const pcs_end_name = section_end_prefix ++ "__sancov_pcs";
+ const pcs_end = @extern([*]PCTableEntry, .{
 .name = pcs_end_name,
 .linkage = .weak,
 }) orelse panic("missing {s} symbol", .{pcs_end_name});
@@ -208,22 +214,22 @@ const Executable = struct {
 break :blk pcs_start[0 .. pcs_end - pcs_start];
 };
 
- if (self.pc_counters.len != pcs.len) panic(
+ if (self.pc_counters.len != pc_table.len) panic(
 "pc counters length and pcs length do not match ({} != {})",
- .{ self.pc_counters.len, pcs.len },
+ .{ self.pc_counters.len, pc_table.len },
 );
 
 self.pc_digest = digest: {
 // Relocations have been applied to `pcs` so it contains runtime addresses (with slide
 // applied). We need to translate these to the virtual addresses as on disk.
 var h: std.hash.Wyhash = .init(0);
- for (pcs) |pc| {
- const pc_vaddr = fuzzer_unslide_address(pc);
+ for (pc_table) |entry| {
+ const pc_vaddr = fuzzer_unslide_address(entry.PC);
 h.update(@ptrCast(&pc_vaddr));
 }
 break :digest h.final();
 };
- self.shared_seen_pcs = getCoverageMap(cache_dir, pcs, self.pc_digest);
+ self.shared_seen_pcs = getCoverageMap(cache_dir, pc_table, self.pc_digest);
 
 return self;
 }
diff --git a/src/Compilation.zig b/src/Compilation.zig
index 53a2874990..b4d6c54499 100644
--- a/src/Compilation.zig
+++ b/src/Compilation.zig
@@ -6582,10 +6582,6 @@ fn addCommonCCArgs(
 if (san_arg.items.len == 0) try san_arg.appendSlice(arena, prefix);
 try san_arg.appendSlice(arena, "thread,");
 }
- if (mod.fuzz) {
- if (san_arg.items.len == 0) try san_arg.appendSlice(arena, prefix);
- try san_arg.appendSlice(arena, "fuzzer-no-link,");
- }
 // Chop off the trailing comma and append to argv.
 if (san_arg.pop()) |_| {
 try argv.append(san_arg.items);
@@ -6620,8 +6616,12 @@ fn addCommonCCArgs(
 }
 }
 
+ // This logic must be kept in sync with the coverage emitted by the LLVM backend.
+
 if (comp.config.san_cov_trace_pc_guard) {
 try argv.append("-fsanitize-coverage=trace-pc-guard");
+ } else if (mod.fuzz) {
+ try argv.append("-fsanitize-coverage=edge,inline-8bit-counters,pc-table");
 }
 }
 
diff --git a/src/codegen/llvm.zig b/src/codegen/llvm.zig
index ec9d176fe5..1a4ee3d2d3 100644
--- a/src/codegen/llvm.zig
+++ b/src/codegen/llvm.zig
@@ -1124,7 +1124,10 @@ pub const Object = struct {
 .bitcode_filename = null,
 
 // `.coverage` value is only used when `.sancov` is enabled.
- .sancov = options.fuzz or comp.config.san_cov_trace_pc_guard,
+ .sancov = comp.config.san_cov_trace_pc_guard,
+ // At least one of these values has to be non-default if `sancov` is
+ // set, otherwise LLVM will implicitly set `TracePCGuard`!
+ // https://github.com/llvm/llvm-project/pull/106464
 .coverage = .{
 .CoverageType = .Edge,
 // Works in tandem with Inline8bitCounters or InlineBoolFlag.
@@ -1144,8 +1147,7 @@ pub const Object = struct {
 // Zig emits its own PC table instrumentation.
 .PCTable = false,
 .NoPrune = false,
- // Workaround for https://github.com/llvm/llvm-project/pull/106464
- .StackDepth = true,
+ .StackDepth = false,
 .TraceLoads = false,
 .TraceStores = false,
 .CollectControlFlow = false,
@@ -1537,7 +1539,7 @@ pub const Object = struct {
 
 break :f .{
 .counters_variable = counters_variable,
- .pcs = .empty,
+ .pc_table = .empty,
 };
 };
 
@@ -1589,26 +1591,28 @@ pub const Object = struct {
 function_index.setAttributes(try attributes.finish(&o.builder), &o.builder);
 
 if (fg.fuzz) |*f| {
- {
- const array_llvm_ty = try o.builder.arrayType(f.pcs.items.len, .i8);
- f.counters_variable.ptrConst(&o.builder).global.ptr(&o.builder).type = array_llvm_ty;
- const zero_init = try o.builder.zeroInitConst(array_llvm_ty);
- try f.counters_variable.setInitializer(zero_init, &o.builder);
- }
-
- const array_llvm_ty = try o.builder.arrayType(f.pcs.items.len, .ptr);
- const init_val = try o.builder.arrayConst(array_llvm_ty, f.pcs.items);
+ const cntrs_array_llvm_ty = try o.builder.arrayType(f.pc_table.items.len / 2, .i8);
+ f.counters_variable.ptrConst(&o.builder).global.ptr(&o.builder).type = cntrs_array_llvm_ty;
+ const zero_init = try o.builder.zeroInitConst(cntrs_array_llvm_ty);
+ try f.counters_variable.setInitializer(zero_init, &o.builder);
+
+ // https://github.com/llvm/llvm-project/blob/6121df77a781d2e6f9a8e569aa45ccfffd6c7e0e/compiler-rt/lib/fuzzer/FuzzerTracePC.h#L122
+ // struct PCTableEntry {
+ // uintptr_t PC, PCFlags;
+ // };
+ const pc_table_llvm_ty = try o.builder.arrayType(f.pc_table.items.len, .ptr);
+ const init_val = try o.builder.arrayConst(pc_table_llvm_ty, f.pc_table.items);
 // Due to error "members of llvm.compiler.used must be named", this global needs a name.
 const anon_name = try o.builder.strtabStringFmt("__sancov_gen_.{d}", .{o.used.items.len});
- const pcs_variable = try o.builder.addVariable(anon_name, array_llvm_ty, .default);
+ const pcs_variable = try o.builder.addVariable(anon_name, pc_table_llvm_ty, .default);
 try o.used.append(gpa, pcs_variable.toConst(&o.builder));
 pcs_variable.setLinkage(.private, &o.builder);
 pcs_variable.setMutability(.constant, &o.builder);
 pcs_variable.setAlignment(Type.usize.abiAlignment(zcu).toLlvm(), &o.builder);
 if (target.ofmt == .macho) {
- pcs_variable.setSection(try o.builder.string("__DATA,__sancov_pcs1"), &o.builder);
+ pcs_variable.setSection(try o.builder.string("__DATA,__sancov_pcs"), &o.builder);
 } else {
- pcs_variable.setSection(try o.builder.string("__sancov_pcs1"), &o.builder);
+ pcs_variable.setSection(try o.builder.string("__sancov_pcs"), &o.builder);
 }
 try pcs_variable.setInitializer(init_val, &o.builder);
 }
@@ -4639,10 +4643,10 @@ pub const FuncGen = struct {
 
 const Fuzz = struct {
 counters_variable: Builder.Variable.Index,
- pcs: std.ArrayList(Builder.Constant),
+ pc_table: std.ArrayList(Builder.Constant),
 
 fn deinit(f: *Fuzz, gpa: Allocator) void {
- f.pcs.deinit(gpa);
+ f.pc_table.deinit(gpa);
 f.* = undefined;
 }
 };
@@ -4746,7 +4750,7 @@ pub const FuncGen = struct {
 switch (coverage_point) {
 .none => {},
 .poi => if (self.fuzz) |*fuzz| {
- const poi_index = fuzz.pcs.items.len;
+ const poi_index = fuzz.pc_table.items.len / 2;
 const base_ptr = fuzz.counters_variable.toValue(&o.builder);
 const ptr = if (poi_index == 0) base_ptr else try self.wip.gep(.inbounds, .i8, base_ptr, &.{
 try o.builder.intValue(.i32, poi_index),
@@ -4759,8 +4763,8 @@ pub const FuncGen = struct {
 self.wip.function.toConst(&o.builder)
 else
 try o.builder.blockAddrConst(self.wip.function, self.wip.cursor.block);
- const gpa = self.gpa;
- try fuzz.pcs.append(gpa, pc);
+ const flags = try o.builder.nullConst(.ptr);
+ try fuzz.pc_table.appendSlice(self.gpa, &.{ pc, flags });
 },
 }
 for (body, 0..) |inst, i| {
-- 
2.52.0

I have a diff to get it working from some time ago which I didn't end up PRing as it buys into the instrumentation emitted by LLVM fully and that might not be the best/most flexible way to go for the instrumentation emitted by Zig. Feel free to use it though, but note that I wrote it on top of 10256e1b81a52b62581dfe643618aba8dfc64b9e so it might need some tweaks to work. <details> <summary>diff</summary> ```diff From 3aa9948345ce2c396585cdded7f80c7f98a2ce30 Mon Sep 17 00:00:00 2001 From: Justus Klausecker <justus@klausecker.de> Date: 2026年3月19日 11:55:40 +0100 Subject: [PATCH] fuzz: make instrumentation emitted by zig compatible with the one emitted by clang The LLVM backend now emits its instrumentation into the same sections as clang and emits an LLVM `PCTableEntry` per POI instead of just a pc. The difference is that there's an additional `PCFlags` field (which is always zeroed by the LLVM backend). This change only affects the instrumentation emitted by the LLVM backend, libfuzzer still behaves exactly the same and just ignores the additional instrumentation. The only difference is that libfuzzer is now also able to fuzz objects emitted by clang. --- lib/fuzzer.zig | 46 +++++++++++++++++++++++++------------------- src/Compilation.zig | 8 ++++---- src/codegen/llvm.zig | 46 ++++++++++++++++++++++++-------------------- 3 files changed, 55 insertions(+), 45 deletions(-) diff --git a/lib/fuzzer.zig b/lib/fuzzer.zig index 742bf39125..5c99ce4948 100644 --- a/lib/fuzzer.zig +++ b/lib/fuzzer.zig @@ -55,6 +55,12 @@ fn bitsetUsizes(elems: usize) usize { return math.divCeil(usize, elems, @bitSizeOf(usize)) catch unreachable; } +/// https://github.com/llvm/llvm-project/blob/6121df77a781d2e6f9a8e569aa45ccfffd6c7e0e/compiler-rt/lib/fuzzer/FuzzerTracePC.h#L122 +const PCTableEntry = extern struct { + PC: usize, + PCFlags: usize, +}; + const Executable = struct { /// Tracks the hit count for each pc as updated by the test's instrumentation. pc_counters: []u8, @@ -68,7 +74,7 @@ const Executable = struct { fn getCoverageMap( cache_dir: Io.Dir, - pcs: []const usize, + pc_table: []const PCTableEntry, pc_digest: u64, ) []align(std.heap.page_size_min) volatile u8 { const file_name = std.fmt.hex(pc_digest); @@ -97,10 +103,10 @@ const Executable = struct { comptime assert(abi.SeenPcsHeader.trailing[0] == .pc_bits_usize); comptime assert(abi.SeenPcsHeader.trailing[1] == .pc_addr); - const pc_bitset_usizes = bitsetUsizes(pcs.len); + const pc_bitset_usizes = bitsetUsizes(pc_table.len); const coverage_file_len = @sizeOf(abi.SeenPcsHeader) + pc_bitset_usizes * @sizeOf(usize) + - pcs.len * @sizeOf(usize); + pc_table.len * @sizeOf(usize); if (populate) { coverage_file.setLength(io, coverage_file_len) catch |e| @@ -128,11 +134,11 @@ const Executable = struct { header.* = .{ .n_runs = 0, .unique_runs = 0, - .pcs_len = pcs.len, + .pcs_len = pc_table.len, }; @memset(trailing_bitset, 0); - for (trailing_addresses, pcs) |*cov_pc, slided_pc| { - cov_pc.* = fuzzer_unslide_address(slided_pc); + for (trailing_addresses, pc_table) |*cov_pc, entry| { + cov_pc.* = fuzzer_unslide_address(entry.PC); } io_map.write(io) catch |e| panic("failed to write memory map of '{s}': {t}", .{ &file_name, e }); @@ -142,12 +148,12 @@ const Executable = struct { .{ &file_name, e }, ); } else { // Check expected contents - if (header.pcs_len != pcs.len) panic( + if (header.pcs_len != pc_table.len) panic( "incompatible existing coverage file '{s}' (differing pcs length: {} != {})", - .{ &file_name, header.pcs_len, pcs.len }, + .{ &file_name, header.pcs_len, pc_table.len }, ); - for (0.., header.pcAddrs(), pcs) |i, cov_pc, slided_pc| { - const pc = fuzzer_unslide_address(slided_pc); + for (0.., header.pcAddrs(), pc_table) |i, cov_pc, entry| { + const pc = fuzzer_unslide_address(entry.PC); if (cov_pc != pc) panic( "incompatible existing coverage file '{s}' (differing pc at index {d}: {x} != {x})", .{ &file_name, i, cov_pc, pc }, @@ -192,15 +198,15 @@ const Executable = struct { break :blk pc_counters_start[0 .. pc_counters_end - pc_counters_start]; }; - const pcs = blk: { - const pcs_start_name = section_start_prefix ++ "__sancov_pcs1"; - const pcs_start = @extern([*]usize, .{ + const pc_table = blk: { + const pcs_start_name = section_start_prefix ++ "__sancov_pcs"; + const pcs_start = @extern([*]PCTableEntry, .{ .name = pcs_start_name, .linkage = .weak, }) orelse panic("missing {s} symbol", .{pcs_start_name}); - const pcs_end_name = section_end_prefix ++ "__sancov_pcs1"; - const pcs_end = @extern([*]usize, .{ + const pcs_end_name = section_end_prefix ++ "__sancov_pcs"; + const pcs_end = @extern([*]PCTableEntry, .{ .name = pcs_end_name, .linkage = .weak, }) orelse panic("missing {s} symbol", .{pcs_end_name}); @@ -208,22 +214,22 @@ const Executable = struct { break :blk pcs_start[0 .. pcs_end - pcs_start]; }; - if (self.pc_counters.len != pcs.len) panic( + if (self.pc_counters.len != pc_table.len) panic( "pc counters length and pcs length do not match ({} != {})", - .{ self.pc_counters.len, pcs.len }, + .{ self.pc_counters.len, pc_table.len }, ); self.pc_digest = digest: { // Relocations have been applied to `pcs` so it contains runtime addresses (with slide // applied). We need to translate these to the virtual addresses as on disk. var h: std.hash.Wyhash = .init(0); - for (pcs) |pc| { - const pc_vaddr = fuzzer_unslide_address(pc); + for (pc_table) |entry| { + const pc_vaddr = fuzzer_unslide_address(entry.PC); h.update(@ptrCast(&pc_vaddr)); } break :digest h.final(); }; - self.shared_seen_pcs = getCoverageMap(cache_dir, pcs, self.pc_digest); + self.shared_seen_pcs = getCoverageMap(cache_dir, pc_table, self.pc_digest); return self; } diff --git a/src/Compilation.zig b/src/Compilation.zig index 53a2874990..b4d6c54499 100644 --- a/src/Compilation.zig +++ b/src/Compilation.zig @@ -6582,10 +6582,6 @@ fn addCommonCCArgs( if (san_arg.items.len == 0) try san_arg.appendSlice(arena, prefix); try san_arg.appendSlice(arena, "thread,"); } - if (mod.fuzz) { - if (san_arg.items.len == 0) try san_arg.appendSlice(arena, prefix); - try san_arg.appendSlice(arena, "fuzzer-no-link,"); - } // Chop off the trailing comma and append to argv. if (san_arg.pop()) |_| { try argv.append(san_arg.items); @@ -6620,8 +6616,12 @@ fn addCommonCCArgs( } } + // This logic must be kept in sync with the coverage emitted by the LLVM backend. + if (comp.config.san_cov_trace_pc_guard) { try argv.append("-fsanitize-coverage=trace-pc-guard"); + } else if (mod.fuzz) { + try argv.append("-fsanitize-coverage=edge,inline-8bit-counters,pc-table"); } } diff --git a/src/codegen/llvm.zig b/src/codegen/llvm.zig index ec9d176fe5..1a4ee3d2d3 100644 --- a/src/codegen/llvm.zig +++ b/src/codegen/llvm.zig @@ -1124,7 +1124,10 @@ pub const Object = struct { .bitcode_filename = null, // `.coverage` value is only used when `.sancov` is enabled. - .sancov = options.fuzz or comp.config.san_cov_trace_pc_guard, + .sancov = comp.config.san_cov_trace_pc_guard, + // At least one of these values has to be non-default if `sancov` is + // set, otherwise LLVM will implicitly set `TracePCGuard`! + // https://github.com/llvm/llvm-project/pull/106464 .coverage = .{ .CoverageType = .Edge, // Works in tandem with Inline8bitCounters or InlineBoolFlag. @@ -1144,8 +1147,7 @@ pub const Object = struct { // Zig emits its own PC table instrumentation. .PCTable = false, .NoPrune = false, - // Workaround for https://github.com/llvm/llvm-project/pull/106464 - .StackDepth = true, + .StackDepth = false, .TraceLoads = false, .TraceStores = false, .CollectControlFlow = false, @@ -1537,7 +1539,7 @@ pub const Object = struct { break :f .{ .counters_variable = counters_variable, - .pcs = .empty, + .pc_table = .empty, }; }; @@ -1589,26 +1591,28 @@ pub const Object = struct { function_index.setAttributes(try attributes.finish(&o.builder), &o.builder); if (fg.fuzz) |*f| { - { - const array_llvm_ty = try o.builder.arrayType(f.pcs.items.len, .i8); - f.counters_variable.ptrConst(&o.builder).global.ptr(&o.builder).type = array_llvm_ty; - const zero_init = try o.builder.zeroInitConst(array_llvm_ty); - try f.counters_variable.setInitializer(zero_init, &o.builder); - } - - const array_llvm_ty = try o.builder.arrayType(f.pcs.items.len, .ptr); - const init_val = try o.builder.arrayConst(array_llvm_ty, f.pcs.items); + const cntrs_array_llvm_ty = try o.builder.arrayType(f.pc_table.items.len / 2, .i8); + f.counters_variable.ptrConst(&o.builder).global.ptr(&o.builder).type = cntrs_array_llvm_ty; + const zero_init = try o.builder.zeroInitConst(cntrs_array_llvm_ty); + try f.counters_variable.setInitializer(zero_init, &o.builder); + + // https://github.com/llvm/llvm-project/blob/6121df77a781d2e6f9a8e569aa45ccfffd6c7e0e/compiler-rt/lib/fuzzer/FuzzerTracePC.h#L122 + // struct PCTableEntry { + // uintptr_t PC, PCFlags; + // }; + const pc_table_llvm_ty = try o.builder.arrayType(f.pc_table.items.len, .ptr); + const init_val = try o.builder.arrayConst(pc_table_llvm_ty, f.pc_table.items); // Due to error "members of llvm.compiler.used must be named", this global needs a name. const anon_name = try o.builder.strtabStringFmt("__sancov_gen_.{d}", .{o.used.items.len}); - const pcs_variable = try o.builder.addVariable(anon_name, array_llvm_ty, .default); + const pcs_variable = try o.builder.addVariable(anon_name, pc_table_llvm_ty, .default); try o.used.append(gpa, pcs_variable.toConst(&o.builder)); pcs_variable.setLinkage(.private, &o.builder); pcs_variable.setMutability(.constant, &o.builder); pcs_variable.setAlignment(Type.usize.abiAlignment(zcu).toLlvm(), &o.builder); if (target.ofmt == .macho) { - pcs_variable.setSection(try o.builder.string("__DATA,__sancov_pcs1"), &o.builder); + pcs_variable.setSection(try o.builder.string("__DATA,__sancov_pcs"), &o.builder); } else { - pcs_variable.setSection(try o.builder.string("__sancov_pcs1"), &o.builder); + pcs_variable.setSection(try o.builder.string("__sancov_pcs"), &o.builder); } try pcs_variable.setInitializer(init_val, &o.builder); } @@ -4639,10 +4643,10 @@ pub const FuncGen = struct { const Fuzz = struct { counters_variable: Builder.Variable.Index, - pcs: std.ArrayList(Builder.Constant), + pc_table: std.ArrayList(Builder.Constant), fn deinit(f: *Fuzz, gpa: Allocator) void { - f.pcs.deinit(gpa); + f.pc_table.deinit(gpa); f.* = undefined; } }; @@ -4746,7 +4750,7 @@ pub const FuncGen = struct { switch (coverage_point) { .none => {}, .poi => if (self.fuzz) |*fuzz| { - const poi_index = fuzz.pcs.items.len; + const poi_index = fuzz.pc_table.items.len / 2; const base_ptr = fuzz.counters_variable.toValue(&o.builder); const ptr = if (poi_index == 0) base_ptr else try self.wip.gep(.inbounds, .i8, base_ptr, &.{ try o.builder.intValue(.i32, poi_index), @@ -4759,8 +4763,8 @@ pub const FuncGen = struct { self.wip.function.toConst(&o.builder) else try o.builder.blockAddrConst(self.wip.function, self.wip.cursor.block); - const gpa = self.gpa; - try fuzz.pcs.append(gpa, pc); + const flags = try o.builder.nullConst(.ptr); + try fuzz.pc_table.appendSlice(self.gpa, &.{ pc, flags }); }, } for (body, 0..) |inst, i| { -- 2.52.0 ``` </details>

archaistvolts commented 2026年05月23日 02:31:19 +02:00

Thanks @justusk. Nice to know its possible. But I don't think I'll use that diff it in my project as I don't want to require a patch. I'll just use oracles which don't depend on those symbols such as std.AutoHashMap(u32, void). And maybe look into building CRoaring without them somehow.

Too bad though. I'd prefer to fuzz against CRoaring with zig. I'll have to use AFL instead for that.

Thanks @justusk. Nice to know its possible. But I don't think I'll use that diff it in my project as I don't want to require a patch. I'll just use oracles which don't depend on those symbols such as `std.AutoHashMap(u32, void)`. And maybe look into building CRoaring without them somehow. Too bad though. I'd prefer to fuzz against CRoaring with zig. I'll have to use AFL instead for that.