New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 843898 link

Starred by 2 users

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 1
Type: Bug



Sign in to add a comment

Cannot compile libfuzzer-based targets for android

Project Member Reported by clemensh@chromium.org, May 17 2018

Issue description

Building libfuzzer-based fuzzers for android currently does not work.

Gn args (minimized):
target_os = "android"
use_libfuzzer = true

This gives gn errors for a lot of targets:

===========================================================================
$ gn gen out/tmp
ERROR at //build/config/android/rules.gni:1909:9: Assertion failed.
        assert(
        ^-----
Possible manifest-generating dep found in deps. Use android_manifest_dep for this instead. Found: [":payment_method_manifest_fuzzer_seed_corpus", ":payment_method_manifest_fuzzer_dict_copy", ":payment_method_manifest_fuzzer.options", ":payment_method_manifest_fuzzer.owners", ":payment_method_manifest_fuzzer_apk__runtime_deps", ":payment_method_manifest_fuzzer_apk__secondary_abi_runtime_deps"]
See //build/config/android/rules.gni:1910:13: 
            false,
            ^----
This is where it was set.
See //build/config/android/rules.gni:2905:5: whence it was called.
    android_apk(target_name) {
    ^-------------------------
See //testing/test.gni:140:7: whence it was called.
      unittest_apk(_apk_target) {
      ^--------------------------
See //testing/libfuzzer/fuzzer_test.gni:154:5: whence it was called.
    test(target_name) {
    ^------------------
See //components/payments/content/utility/BUILD.gn:39:1: whence it was called.
fuzzer_test("payment_method_manifest_fuzzer") {
^----------------------------------------------
See //components/BUILD.gn:219:7: which caused the file to be included.
      "//components/payments/content/utility:unit_tests",
      ^-------------------------------------------------
===========================================================================


If I just remove all "fuzzer_test"s which cause these problem, I can generate the build files, but the target I want to compile is not there:

===========================================================================
$ ninja -C out/tmp v8_wasm_compile_fuzzer
ninja: Entering directory `out/tmp'
ninja: error: unknown target 'v8_wasm_compile_fuzzer', did you mean 'v8:wasm_compile_fuzzer'?
===========================================================================

Any gn expert who can help on this?
 

Comment 1 by mmoroz@chromium.org, May 17 2018

Cc: ahaas@chromium.org
Components: Tools>Stability>ClusterFuzz
Cc: george.w...@arm.com
Components: -Tools>Stability>ClusterFuzz
Labels: -Pri-2 Pri-1
Owner: infe...@chromium.org
Status: Assigned (was: Available)
+George, who is implementing the Liftoff compiler for arm32, and would like to get some fuzzer coverage.

Raising priority. Abhishek or Max, can one of you investigate how hard it would be to compile libfuzzer-based fuzzers for native arm?
Cc: ekarpen...@apple.com
I suspect that it should compile, at least, but in Chromium you may need to remove some of the assertions.

Another Chromium specific change which might be necessary: we would have to either use old instrumentation on Android (like we do for AFL: https://cs.chromium.org/chromium/src/build/config/sanitizers/sanitizers.gni?l=101) OR we would have to add clang runtime library for Android to LLVM bundle (https://cs.chromium.org/chromium/src/tools/clang/scripts/package.py?type=cs&q=%22fuzzer_no_main%22+file:%5C.py&sq=package:chromium&g=0&l=256).

+George from Apple who was fixing some libFuzzer code / tests for AArch64, just in case it's anyhow relevant.

Owner: ----
Status: Available (was: Assigned)

Sign in to add a comment