nss fuzzers seem broken

[oliverchang]

Looking at fuzzing logs for nss fuzzers, e.g. gs://nss-logs.clusterfuzz-external.appspot.com/libFuzzer_nss_asn1_algorithmid_fuzzer/libfuzzer_asan_nss/2016-11-03/19:13:46:418169.txt

#0	READ units: 1
#1	INITED cov: 5 bits: 5 corp: 1/1b exec/s: 0 rss: 16Mb
#262144	pulse  cov: 5 bits: 5 corp: 1/1b exec/s: 87381 rss: 32Mb
#524288	pulse  cov: 5 bits: 5 corp: 1/1b exec/s: 87381 rss: 32Mb
#1048576	pulse  cov: 5 bits: 5 corp: 1/1b exec/s: 80659 rss: 32Mb
#2097152	pulse  cov: 5 bits: 5 corp: 1/1b exec/s: 74898 rss: 32Mb
#4194304	pulse  cov: 5 bits: 5 corp: 1/1b exec/s: 74898 rss: 32Mb
#8388608	pulse  cov: 5 bits: 5 corp: 1/1b exec/s: 75573 rss: 32Mb
#16777216	pulse  cov: 5 bits: 5 corp: 1/1b exec/s: 74565 rss: 32Mb
#33554432	pulse  cov: 5 bits: 5 corp: 1/1b exec/s: 72160 rss: 32Mb
#67108864	pulse  cov: 5 bits: 5 corp: 1/1b exec/s: 71468 rss: 32Mb
#134217728	pulse  cov: 5 bits: 5 corp: 1/1b exec/s: 71468 rss: 32Mb
#210138166	DONE   cov: 5 bits: 5 corp: 1/1b exec/s: 71209 rss: 32Mb
Done 210138166 runs in 2951 second(s)
stat::number_of_executed_units: 210138166
stat::average_exec_per_sec:     71209
stat::new_units_added:          0
stat::slowest_unit_time_sec:    0
stat::peak_rss_mb:              32

cov and bits seems to be stuck at 5. This appears to be the case for all other nss fuzzers.

[oliverchang]

@Dor1s @mikea any idea what's going on?

[mikea]

This is usually a sign of broken coverage instrumentation. I'll take a look.

[Dor1s]

Looks like they don't use values of CFLAGS and CXXFLAGS variables. Doing CC="$CC $CFLAGS" (as we did previously), also doesn't work :/

[Dor1s]

There is a way to provide custom CFLAGS:

ifdef SANITIZER_CFLAGS
ifdef BUILD_OPT
NSPR_CONFIGURE_OPTS += --enable-debug-symbols
endif
NSPR_CONFIGURE_ENV += CFLAGS='$(SANITIZER_CFLAGS)' \
                      CXXFLAGS='$(SANITIZER_CFLAGS)' \
                      LDFLAGS='$(SANITIZER_LDFLAGS)'
endif

That should work, but I'm getting linking errors:

...
../../../dist/Linux3.13_x86_64_clang-4.0_glibc_PTH_64_OPT.OBJ/lib/libnspr4.so: undefined reference to `__asan_report_store_n'
../../../dist/Linux3.13_x86_64_clang-4.0_glibc_PTH_64_OPT.OBJ/lib/libplc4.so: undefined reference to `__asan_report_load8'
../../../dist/Linux3.13_x86_64_clang-4.0_glibc_PTH_64_OPT.OBJ/lib/libnspr4.so: undefined reference to `__asan_report_load2'
...

Trying to get rid of them.

[Dor1s]

The following change works for NSPR, but when it comes to compilation of NSS, flags are not being passed:

diff --git a/targets/nss/build.sh b/targets/nss/build.sh
index 23c2bac..719a35b 100755
--- a/targets/nss/build.sh
+++ b/targets/nss/build.sh
@@ -17,8 +17,10 @@

 # Build the library.
 cd /src/nss
-make clean
-make BUILD_OPT=1 USE_64=1 NSS_DISABLE_GTESTS=1 ZDEFS_FLAG= nss_build_all
+#make nss_clean_all
+make CCC="$CXX" SANITIZER_CFLAGS="$CXXFLAGS" \
+    SANITIZER_LDFLAGS="$SANITIZER_FLAGS" BUILD_OPT=1 USE_64=1 \
+    NSS_DISABLE_GTESTS=1 ZDEFS_FLAG= nss_clean_all nss_build_all
 cd ..

[Dor1s]

Got it. Now I understand why we don't build NSS in Chromium. Usage of XXX OMG WTF CCC env variables doesn't seem to be a user-friendly experience.