refactor tracing options: run-input --trace=func/line/instr

Author: baflor

src/cli/mod.rs

@@ -10,7 +10,9 @@ use std::{
 use crate::{
     fuzzer::opts::{FlagBool, InstrumentationOpts},
     ir::ModuleSpec,
-    jit::{FeedbackOptions, JitFuzzingSession, Stats, TracingOptions, module::TrapKind},
+    jit::{
+        DebugTrace, FeedbackOptions, JitFuzzingSession, Stats, TracingOptions, module::TrapKind,
+    },
 };
 
 mod cmin;
@@ -47,8 +49,14 @@ pub(crate) enum Subcommand {
     RunInput {
         program: PathBuf,
         inputs: Vec<String>,
-        #[clap(long)]
-        trace: bool,
+        #[clap(
+            long,
+            value_enum,
+            require_equals = true,
+            num_args = 0..=1,
+            default_missing_value = "instr"
+        )]
+        trace: Option<DebugTrace>,
         #[clap(long)]
         verbose_jit: bool,
         #[clap(long, default_value = "true")]
@@ -161,6 +169,7 @@ pub(crate) enum Subcommand {
         #[clap(long, default_value = "10000")]
         iters: usize,
     },
+    /// Extract embedded sources from the debug info.
     #[clap(hide = true)]
     DumpEmbeddedSources {
         program: PathBuf,
@@ -246,13 +255,14 @@ pub(crate) fn main() {
             let mod_spec = parse_program(&program);
             let mut stats = Stats::default();
             let mut sess = JitFuzzingSession::builder(mod_spec)
+                .debug_trace(trace.unwrap_or(DebugTrace::Disabled))
                 // .feedback(i.to_feedback_opts())
                 .feedback(FeedbackOptions::nothing())
                 .tracing(TracingOptions {
                     stdout: *print_stdout,
                     ..TracingOptions::default()
                 })
-                .debug(trace, verbose_jit)
+                .verbose(verbose_jit)
                 .instruction_limit(Some(2_000_000_000))
                 .optimize_for_compilation_time(inputs.len() <= 10)
                 .run_from_snapshot(*run_from_snapshot)
@@ -315,13 +325,18 @@ pub(crate) fn main() {
             let mod_spec = parse_program(&program);
             let mut stats = Stats::default();
             let mut sess = JitFuzzingSession::builder(mod_spec)
+                .debug_trace(if trace {
+                    DebugTrace::Instruction
+                } else {
+                    DebugTrace::Disabled
+                })
                 .feedback(i.to_feedback_opts())
                 .feedback(FeedbackOptions::nothing())
                 .tracing(TracingOptions {
                     stdout: true,
                     ..TracingOptions::default()
                 })
-                .debug(trace, verbose)
+                .verbose(verbose)
                 .run_from_snapshot(*run_from_snapshot)
                 .build();
             sess.initialize(&mut stats);

src/fuzzer/orc.rs

@@ -319,7 +319,8 @@ pub(crate) struct Orchestrator {
 impl Orchestrator {
     fn new(module: Arc<ModuleSpec>, opts: CliOpts, corpus: Arc<RwLock<SharedCorpus>>) -> Self {
         let now = Instant::now();
-        let mut codecov_sess = JitFuzzingSessionBuilder::new(module.clone())
+        let mut codecov_sess =
+            JitFuzzingSessionBuilder::new(module.clone())
             .feedback(FeedbackOptions {
                 live_funcs: true,
                 live_bbs: true,

src/jit/control.rs

@@ -308,7 +308,7 @@ pub(crate) fn translate_control<'a, 'b, 's>(
                 rvals.extend_from_slice(&concolic_vars);
             }
 
-            if state.options.debug_trace {
+            if state.options.debug_trace.enabled() {
                 let s = format!("returning from {} by explicit return", state.fspec().symbol);
                 super::builtins::translate_debug_log(s, state, bcx);
             }

src/jit/function.rs

@@ -371,7 +371,7 @@ impl<'a, 's> FuncTranslator<'a, 's> {
     }
 
     pub(crate) fn undef(&mut self, ty: Type, bcx: &mut FunctionBuilder) -> ir::Value {
-        if self.options.debug_trace {
+        if self.options.debug_trace.enabled() {
             super::builtins::translate_debug_log(
                 "!!! using undefined value !!!".to_string(),
                 self,
@@ -458,16 +458,8 @@ impl<'a, 's> FuncTranslator<'a, 's> {
             }
         }
 
-        if self.options.debug_trace
-            && !std::env::var("JITTRACE")
-                .map(|s| s == "thin")
-                .unwrap_or(false)
-        {
-            let is_line = std::env::var("JITTRACE")
-                .map(|s| s == "line")
-                .unwrap_or(false);
-
-            if is_line {
+        if self.options.debug_trace.include_instructions() {
+            if self.options.debug_trace.include_source_line() {
                 let addr = self.fspec().operators_wasm_bin_offset_base as u64
                     + self.fspec().operator_offset_rel[self.ip.i()] as u64;
                 let line = crate::ir::debuginfo_helper::resolve_source_location(

src/jit/mod.rs

@@ -441,26 +441,61 @@ pub(crate) struct CompilationOptions {
     pub tracing: TracingOptions,
     pub swarm: SwarmConfig, // is `scope` a better name?
     pub verbose: bool,
-    pub debug_trace: bool,
+    pub debug_trace: DebugTrace,
     pub kind: CompilationKind,
     pub optimize_for_compilation_time: bool,
 }
 
+#[derive(Debug, Clone, Copy, Hash, PartialEq, Eq, Default, clap::ValueEnum)]
+pub(crate) enum DebugTrace {
+    #[default]
+    Disabled,
+    Function,
+    Instruction,
+    Line,
+}
+
+impl DebugTrace {
+    fn from_str(s: &str) -> Option<Self> {
+        match s {
+            "thin" | "func" | "function" => Some(Self::Function),
+            "full" | "instr" | "instruction" | "1" => Some(Self::Instruction),
+            "line" => Some(Self::Line),
+            _ => None,
+        }
+    }
+    fn from_env() -> Option<Self> {
+        match std::env::var("JITTRACE").ok().as_deref() {
+            Some(s) => Self::from_str(s),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn enabled(self) -> bool {
+        !matches!(self, Self::Disabled)
+    }
+
+    pub(crate) fn include_instructions(self) -> bool {
+        matches!(self, Self::Instruction | Self::Line)
+    }
+
+    pub(crate) fn include_source_line(self) -> bool {
+        matches!(self, Self::Line)
+    }
+}
+
 impl CompilationOptions {
     pub fn new(
         tracking: &TrackingOptions,
         tracing: &TracingOptions,
         swarm: &SwarmConfig,
         kind: CompilationKind,
-        debug_trace: bool,
+        debug_trace: DebugTrace,
         verbose: bool,
         optimize_for_compilation_time: bool,
     ) -> Self {
         Self {
-            debug_trace: debug_trace
-                || std::env::var("JITTRACE")
-                    .map(|el| el == "1" || el == "thin" || el == "line")
-                    .unwrap_or_default(),
+            debug_trace: DebugTrace::from_env().unwrap_or(debug_trace),
             verbose: verbose
                 || std::env::var("JITDEBUG")
                     .map(|el| el == "1")
@@ -708,8 +743,14 @@ impl JitStage {
         if let Some(instance) = &mut self.instance
             && instance.vmctx.tainted
         {
-            // eprintln!("resetting vmctx because it's tainted");
-            self.inp_ptr = None;
+            if self.run_from_snapshot {
+                // `snapshot()` after init sets `heap_snapshot_is_initial = false`, so `reset()`
+                // cannot run. Any trap (including OutOfFuel) marks tainted; restore to the
+                // post-init snapshot and keep `inp_ptr` — `run()` also restores before each exec.
+                instance.vmctx.restore();
+            } else {
+                self.inp_ptr = None;
+            }
         }
 
         if self.inp_ptr.is_none() {
@@ -774,9 +815,12 @@ impl JitStage {
                 .expect("malloc shouldn't trap");
             self.inp_ptr = Some(inp_ptr);
             instance.vmctx.fuel_init = opts.swarm.instruction_limit.unwrap_or(u32::MAX as u64);
-            instance.vmctx.heap_pages_limit_soft =
-                opts.swarm.memory_limit_pages.unwrap_or(u32::MAX);
-            instance.vmctx.heap_pages_limit_hard = crate::MEMORY_PAGES_LIMIT;
+            let mem_pages = opts.swarm.memory_limit_pages;
+            instance.vmctx.heap_pages_limit_soft = mem_pages.unwrap_or(u32::MAX);
+            // Honor `--memory-limit-pages` for the hard cap too (default remains MEMORY_PAGES_LIMIT).
+            instance.vmctx.heap_pages_limit_hard = mem_pages
+                .unwrap_or(crate::MEMORY_PAGES_LIMIT)
+                .max(crate::MEMORY_PAGES_LIMIT);
             if self.run_from_snapshot {
                 instance.vmctx.snapshot();
             }
@@ -833,7 +877,7 @@ impl JitStage {
 pub(crate) struct JitFuzzingSessionBuilder {
     mod_spec: Arc<ModuleSpec>,
     tracing: TracingOptions,
-    debug_trace: bool,
+    debug_trace: DebugTrace,
     verbose: bool,
     swarm: SwarmConfig,
     passes_generator: Arc<dyn PassesGen>,
@@ -852,7 +896,7 @@ impl JitFuzzingSessionBuilder {
         };
         Self {
             tracing: TracingOptions::default(),
-            debug_trace: false,
+            debug_trace: DebugTrace::Disabled,
             verbose: false,
             swarm,
             passes_generator: Arc::new(FullFeedbackPasses {
@@ -882,8 +926,12 @@ impl JitFuzzingSessionBuilder {
         self
     }
 
-    pub(crate) fn debug(mut self, debug_trace: bool, verbose: bool) -> Self {
+    pub(crate) fn debug_trace(mut self, debug_trace: DebugTrace) -> Self {
         self.debug_trace = debug_trace;
+        self
+    }
+
+    pub(crate) fn verbose(mut self, verbose: bool) -> Self {
         self.verbose = verbose;
         self
     }
@@ -933,7 +981,7 @@ pub(crate) struct JitFuzzingSession {
     pub(crate) tracing_stage: JitStage,
     reusable_exec_history: Vec<Vec<u8>>,
     run_from_snapshot: bool,
-    debug_trace: bool,
+    debug_trace: DebugTrace,
     verbose: bool,
     optimize_for_compilation_time: bool,
     pub(crate) swarm: SwarmConfig,

src/jit/module.rs

@@ -402,7 +402,7 @@ impl<'s> ModuleTranslator<'s> {
             println!("/ {}", func.symbol);
         }
 
-        if options.debug_trace {
+        if options.debug_trace.enabled() {
             super::builtins::translate_debug_log(
                 format!(
                     "entering {} ({})",
@@ -443,7 +443,7 @@ impl<'s> ModuleTranslator<'s> {
                 rvals.extend_from_slice(&concolic_vars);
             }
 
-            if options.debug_trace {
+            if options.debug_trace.enabled() {
                 super::builtins::translate_debug_log(
                     format!("returning from {} via function end", func.symbol),
                     &mut functrans,