driver: Fix timeouts not being detected anymore

Since switching to libFuzzer-in-JVM, its timeout detection was broken
since the alarm callback ran on another thread and thus skipped its
logic. This is fixed by patching out the thread check.

Author: fmeum

bazel/tools/java/com/code_intelligence/jazzer/tools/FuzzTargetTestWrapper.java

@@ -153,9 +153,10 @@ public static void main(String[] args) {
         }
         System.exit(0);
       }
-      // Assert that we either found a crash in Java (exit code 77) or a sanitizer crash (exit code
-      // 76).
-      if (exitCode != 76 && exitCode != 77) {
+      // Assert that we either found a crash in Java (exit code 77), a sanitizer crash (exit code
+      // 76), or a timeout (exit code 70).
+      if (exitCode != 76 && exitCode != 77
+          && !(allowedFindings.contains("timeout") && exitCode == 70)) {
         System.err.printf("Did expect a crash, but Jazzer exited with exit code %d%n", exitCode);
         System.exit(1);
       }
@@ -167,7 +168,10 @@ public static void main(String[] args) {
       // Verify that libFuzzer dumped a crashing input.
       if (JAZZER_CI && shouldVerifyCrashInput
           && outputFiles.stream().noneMatch(
-              name -> name.getFileName().toString().startsWith("crash-"))) {
+              name -> name.getFileName().toString().startsWith("crash-"))
+          && !(allowedFindings.contains("timeout")
+              && outputFiles.stream().anyMatch(
+                  name -> name.getFileName().toString().startsWith("timeout-")))) {
         System.err.printf("No crashing input found in %s%n", outputDir);
         System.exit(1);
       }
@@ -222,9 +226,20 @@ private static void verifyFuzzerOutput(
         throw new IllegalStateException(
             "Expected stack traces for all threads, but did not get any");
       }
-      if (expectedFindings.size() == 1) {
-        return;
+      if (expectedFindings.size() != 1) {
+        throw new IllegalStateException("Cannot expect both a native and other findings");
       }
+      return;
+    }
+    if (expectedFindings.contains("timeout")) {
+      if (!stackTrace.contains(THREAD_DUMP_HEADER) || stackTrace.size() < 3) {
+        throw new IllegalStateException(
+            "Expected stack traces for all threads, but did not get any");
+      }
+      if (expectedFindings.size() != 1) {
+        throw new IllegalStateException("Cannot expect both a timeout and other findings");
+      }
+      return;
     }
     List<String> findings =
         stackTrace.stream()

repositories.bzl

@@ -132,7 +132,7 @@ def jazzer_dependencies():
         http_archive,
         name = "jazzer_libfuzzer",
         build_file = Label("//third_party:libFuzzer.BUILD"),
-        sha256 = "4dad21b6a07571c851b8b67cc8ad9172a3fee49ba10f7de03368796ae9494813",
-        strip_prefix = "llvm-project-jazzer-2022-09-09/compiler-rt/lib/fuzzer",
-        url = "https://github.com/CodeIntelligenceTesting/llvm-project-jazzer/archive/refs/tags/2022-09-09.tar.gz",
+        sha256 = "cfb91ee60ff03cec204e387f4af4fd4f031eb1257fd6481aa69ac748deecd1d1",
+        strip_prefix = "llvm-project-jazzer-2022-12-07/compiler-rt/lib/fuzzer",
+        url = "https://github.com/CodeIntelligenceTesting/llvm-project-jazzer/archive/refs/tags/2022-12-07.tar.gz",
     )

tests/BUILD.bazel

@@ -334,3 +334,15 @@ java_fuzz_target_test(
     target_class = "com.example.KotlinVarargFuzzer",
     deps = [":kotlin_vararg"],
 )
+
+java_fuzz_target_test(
+    name = "TimeoutFuzzer",
+    timeout = "short",
+    srcs = ["src/test/java/com/example/TimeoutFuzzer.java"],
+    allowed_findings = ["timeout"],
+    fuzzer_args = [
+        "-timeout=1",
+    ],
+    target_class = "com.example.TimeoutFuzzer",
+    verify_crash_reproducer = False,
+)

tests/src/test/java/com/example/TimeoutFuzzer.java

@@ -0,0 +1,24 @@
+/*
+ * Copyright 2022 Code Intelligence GmbH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.example;
+
+public class TimeoutFuzzer {
+  public static void fuzzerTestOneInput(byte[] b) {
+    while (true) {
+    }
+  }
+}