Disable libFuzzer instrumentation in TSan builds
Categories
(Firefox Build System :: Toolchains, defect)
Tracking
(firefox72 fixed)
| Tracking | Status | |
|---|---|---|
| firefox72 | --- | fixed |
People
(Reporter: decoder, Assigned: decoder)
References
(Blocks 1 open bug)
Details
Attachments
(1 file)
|
(deleted),
text/x-phabricator-request
|
Details |
According to :kcc, the libFuzzer instrumentation (in particular the sanitizer coverage part) is not compatible with TSan. I reached out to him because I was seeing races on global counters (including unknown locations) and he confirmed that the current approach taken by Google here is to run fuzzing without TSan and then periodically run the resulting corpus through the TSan fuzzing build (without instrumentation).
We can do the same by disabling the sanitizer coverage flags when building with the combination of --enable-fuzzing and --enable-threadsanitizer. For the Rust code, we add the flags directly so we have to ifdef them out.
In the future, there might be work coming to make the instrumentation compatible with TSan, but it is not a priority for them right now.
Patch coming up which gives me (finally) a green fuzzing build for bug 1590162.
|
Assignee | |
Comment 1•5 years ago
|
||
|
||
Comment 3•5 years ago
|
||
| bugherder | ||
Description
•