AFL stability fixes for objects (MPR#7725) and lazy values.#1754
AFL stability fixes for objects (MPR#7725) and lazy values.#1754gasche merged 5 commits intoocaml:trunkfrom
Conversation
When AFL instrumentation is enabled, the inlining of Lazy.force is disabled, so that the GC optimisation of removing Forward_tag blocks is no longer visible in the instrumentation output.
63296af to
07e20ab
Compare
gasche
left a comment
There was a problem hiding this comment.
I believe that the change is correct and an improvement for afl-fuzz user. Just like #1345, it also results in a performance degradation when using afl instrumentation -- an acceptable price for more robust bug-finding capabilities.
For the record (for other people than Stephen), I looked a bit at whether a more general solution to these stability problems would be possible, in stedolan/ocaml-afl-persistent#2; this was a prototype and my take-away was that a substantial rework of the afl-instrumentation layer would be required to do substantially better than the present work-arounds. (So: interesting, but requires more time than we have right now.)
bytecomp/matching.ml
Outdated
| if !Clflags.afl_instrument then | ||
| (* Disable inlining optimisation if AFL instrumentation active, | ||
| so that the GC forwarding optimisation is not visible in the | ||
| instrumentation output. (PR#???) *) |
There was a problem hiding this comment.
I think that stedolan/crowbar#14 would be a good pointer to give here, in addition to GPR#1754 itself.
There was a problem hiding this comment.
Thanks! I was looking for that issue, but I thought it was on Mantis.
|
(I'm planning to eventually merge this (in trunk only), but would like to leave a few days for people to chime in if they wish to.) |
|
I agree that the approach in stedolan/ocaml-afl-persistent#2 is promising-but-work. Using this approach as an alternative to #1345 is challenging. Since class initialisation imports an arbitrary amount of stuff from the current environment, it can't easily be pulled out to a library function (at least, not without allocating a new closure, which would defeat the point of the optimisation). For instance, compiling |
* Reduce the number of News in the Blog page I did an analysis and, on average, the smaller `Post` items have a height 1.2 times greater than the `News` items. So, I reduced the number of `News` items in the Blog page to 1.2 of the number of `Post` items. (featured + posts)
For AFL fuzzing to be useful, code that does the same thing twice should produce exactly the same instrumentation output both times, but this currently fails for objects (see MPR#7725) and lazy values.
For objects, the class initialisation logic in
camlinternalOO.mluses some global state as a cache. Since this is not visible outside this file, the fix is just to disable instrumentation for this file (even if instrumentation is otherwise globally enabled).For lazy values, the GC can silently replace
Forward_tagvalues (forced lazy thunks) with their contents, causing the inlinedLazy.forcetest to branch differently. The fix is to stop inlining this test if AFL instrumentation is enabled, and ensure thatcamlinternalLazy.mlis never instrumented.