Skip to content

AFL stability fixes for objects (MPR#7725) and lazy values.#1754

Merged
gasche merged 5 commits intoocaml:trunkfrom
stedolan:afl-stability-fixes
May 4, 2018
Merged

AFL stability fixes for objects (MPR#7725) and lazy values.#1754
gasche merged 5 commits intoocaml:trunkfrom
stedolan:afl-stability-fixes

Conversation

@stedolan
Copy link
Copy Markdown
Contributor

@stedolan stedolan commented May 2, 2018

For AFL fuzzing to be useful, code that does the same thing twice should produce exactly the same instrumentation output both times, but this currently fails for objects (see MPR#7725) and lazy values.

For objects, the class initialisation logic in camlinternalOO.ml uses some global state as a cache. Since this is not visible outside this file, the fix is just to disable instrumentation for this file (even if instrumentation is otherwise globally enabled).

For lazy values, the GC can silently replace Forward_tag values (forced lazy thunks) with their contents, causing the inlined Lazy.force test to branch differently. The fix is to stop inlining this test if AFL instrumentation is enabled, and ensure that camlinternalLazy.ml is never instrumented.

stedolan added 4 commits May 2, 2018 15:46
When AFL instrumentation is enabled, the inlining of Lazy.force
is disabled, so that the GC optimisation of removing Forward_tag
blocks is no longer visible in the instrumentation output.
@stedolan stedolan force-pushed the afl-stability-fixes branch from 63296af to 07e20ab Compare May 2, 2018 14:47
Copy link
Copy Markdown
Member

@gasche gasche left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe that the change is correct and an improvement for afl-fuzz user. Just like #1345, it also results in a performance degradation when using afl instrumentation -- an acceptable price for more robust bug-finding capabilities.

For the record (for other people than Stephen), I looked a bit at whether a more general solution to these stability problems would be possible, in stedolan/ocaml-afl-persistent#2; this was a prototype and my take-away was that a substantial rework of the afl-instrumentation layer would be required to do substantially better than the present work-arounds. (So: interesting, but requires more time than we have right now.)

if !Clflags.afl_instrument then
(* Disable inlining optimisation if AFL instrumentation active,
so that the GC forwarding optimisation is not visible in the
instrumentation output. (PR#???) *)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that stedolan/crowbar#14 would be a good pointer to give here, in addition to GPR#1754 itself.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I was looking for that issue, but I thought it was on Mantis.

@gasche
Copy link
Copy Markdown
Member

gasche commented May 3, 2018

@stedolan doesn't this PR suggest an alternative fix for #1345 that would degrade performances less? Instead of completely disabling the cache lookup (that is currently inlined within generated code), maybe you could define its logic as a function in CamlinternalOO?

@gasche
Copy link
Copy Markdown
Member

gasche commented May 3, 2018

(I'm planning to eventually merge this (in trunk only), but would like to leave a few days for people to chime in if they wish to.)

@stedolan
Copy link
Copy Markdown
Contributor Author

stedolan commented May 3, 2018

I agree that the approach in stedolan/ocaml-afl-persistent#2 is promising-but-work.

Using this approach as an alternative to #1345 is challenging. Since class initialisation imports an arbitrary amount of stuff from the current environment, it can't easily be pulled out to a library function (at least, not without allocating a new closure, which would defeat the point of the optimisation). For instance, compiling fun a b c -> object method a = a method b = b method c = c end results in the following lambda:

(let
  (shared/1326 =a [0: #"a" #"b" #"c"]
   shared/1319 =a [0: #"c" #"b" #"a"]
   class_tables/1307 =a (makemutable 0 0a 0a 0a))
  (function a/1290 b/1291 c/1292
    (funct-body //toplevel//(1):0-62
      (before //toplevel//(1):13-62
        (let (cached/1325 =a class_tables/1307)
          (seq
            (if (field 0 cached/1325) 0a
              (let
                (class/1311 =
                   (apply (field 15 (global CamlinternalOO!)) shared/1326)
                 env_init/1322 =
                   (... complicated code mentioning a, b, c ...))
                (seq (apply (field 16 (global CamlinternalOO!)) class/1311)
                  (setfield_ptr 0 cached/1325 env_init/1322))))
            (let (envs/1324 =a (makeblock 0 c/1292 b/1291 a/1290))
              (apply (field 0 cached/1325) envs/1324))))))))

@gasche gasche merged commit cfee1d8 into ocaml:trunk May 4, 2018
@vicuna vicuna mentioned this pull request Mar 14, 2019
EmileTrotignon pushed a commit to EmileTrotignon/ocaml that referenced this pull request Jan 12, 2024
* Reduce the number of News in the Blog page

I did an analysis and, on average, the smaller `Post` items have a
height 1.2 times greater than the `News` items. So, I reduced the number
of `News` items in the Blog page to 1.2 of the number of `Post`
items. (featured + posts)
sadiqj pushed a commit to sadiqj/ocaml that referenced this pull request Jun 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants