xref: /aosp_15_r20/external/jazzer-api/tests/src/test/shell/crash_resistant_coverage_test.sh (revision 33edd6723662ea34453766bfdca85dbfdd5342b8) 
1#!/bin/bash
2# Copyright 2022 Code Intelligence GmbH
3#
4# Licensed under the Apache License, Version 2.0 (the "License");
5# you may not use this file except in compliance with the License.
6# You may obtain a copy of the License at
7#
8#      http://www.apache.org/licenses/LICENSE-2.0
9#
10# Unless required by applicable law or agreed to in writing, software
11# distributed under the License is distributed on an "AS IS" BASIS,
12# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13# See the License for the specific language governing permissions and
14# limitations under the License.
15
16# This test verifies that Jazzer's --nohook mode can be used to measure code coverage using the
17# JaCoCo agent.
18# It loosely follows the OSS-Fuzz merge logic, which is the most important user of this feature:
19# https://github.com/google/oss-fuzz/blob/b8ef6a216dc592f4f491daa35c815b14260315c0/infra/base-images/base-runner/coverage#L181
20# The use of libFuzzer's -merge feature should allow coverage collection to proceed through crashing
21# inputs, which is also verified by this test.
22
23# --- begin runfiles.bash initialization v2 ---
24# Copy-pasted from the Bazel Bash runfiles library v2.
25set -uo pipefail; f=bazel_tools/tools/bash/runfiles/runfiles.bash
26source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
27  source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
28  source "$0.runfiles/$f" 2>/dev/null || \
29  source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
30  source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
31  { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
32# --- end runfiles.bash initialization v2 ---
33
34function fail() {
35  echo "FAILED: $1"
36  exit 1
37}
38
39
40class_dump_dir=$TEST_TMPDIR/classes
41mkdir -p "$class_dump_dir"
42exec_file=$TEST_TMPDIR/jacoco.exec
43excludes='com.code_intelligence.jazzer.**\:com.sun.tools.attach.**\:sun.tools.attach.**\:sun.jvmstat.**'
44jacoco_args="destfile=$exec_file,classdumpdir=$class_dump_dir,excludes=$excludes"
45
46corpus_dummy=$TEST_TMPDIR/corpus
47mkdir -p "$corpus_dummy"
48"$(rlocation jazzer/launcher/jazzer)" \
49  --cp="$(rlocation jazzer/tests/CrashResistantCoverageTarget_deploy.jar)" \
50  --target_class=com.example.CrashResistantCoverageTarget \
51  -merge=1 -timeout=100 --nohooks \
52  "--additional_jvm_args=-javaagent\\:$(rlocation jacocoagent/file/jacocoagent.jar)=${jacoco_args}" \
53  "$corpus_dummy" \
54  "$(rlocation jazzer/tests/src/test/data/crash_resistant_coverage_test/crashing_seeds)" \
55  "$(rlocation jazzer/tests/src/test/data/crash_resistant_coverage_test/new_coverage_seeds)"
56
57[[ -e $exec_file ]] || fail "JaCoCo .exec file does not exist"
58[[ -s $exec_file ]] || fail "JaCoCo .exec file is empty"
59
60# Available under bazel-testlogs/tests/crash_resistant_coverage_test/test.outputs after the test.
61xml_report=$TEST_UNDECLARED_OUTPUTS_DIR/report.xml
62java -jar "$(rlocation jacococli/file/jacococli.jar)" report "$exec_file" \
63    --xml "$xml_report" \
64    --classfiles "$class_dump_dir"
65
66# Verify that no unexpected class is contained in the report.
67grep -o -P '<class name="(?!com\/example\/CrashResistantCoverageTarget)[^"]*"' "$xml_report" && fail "Unexpected class contained in coverage report"
68
69# Verify that fuzzerTestOneInput and someFunction are fully covered by matching the opening <method>
70# tag and a child <counter> tag - (?:[^<]|<[^\/]).* matches everything but </, so there can't be a
71# </method> between the two.
72# Similarly, verify that <init> isn't covered as the default constructor is never invoked.
73grep -q -P '\Q<method name="<init>" desc="()V" line="19">\E(?:[^<]|<[^\/])*\Q<counter type="LINE" missed="1" covered="0"/>\E' "$xml_report" && fail "<init> has been covered"
74grep -q -P '\Q<method name="fuzzerTestOneInput" desc="([B)V" line="21">\E(?:[^<]|<[^\/])*\Q<counter type="LINE" missed="0" covered="5"/>\E' "$xml_report" || fail "fuzzerTestOneInput hasn't been covered"
75grep -q -P '\Q<method name="someFunction" desc="()V" line="33">\E(?:[^<]|<[^\/])*\Q<counter type="LINE" missed="0" covered="3"/>\E' "$xml_report" || fail "someFunction hasn't been covered"
76