Make driver fuzzing more robust for clang flags (#5845)

I'm not sure the target in use here will reliably crash over time, but
it does right now, and that seems reasonable...?

Example crash:

```
file_test: external/+llvm_project+llvm-project/clang/lib/Driver/ToolChains/Darwin.h:505: bool clang::driver::toolchains::Darwin::isTargetWatchOSBased() const: Assertion `TargetInitialized && "Target not initialized!"' failed.
```

Stack fragment:

```
...
#10 0x0000562ba07dec33 isTargetWatchOSBased /proc/self/cwd/external/+llvm_project+llvm-project/clang/lib/Driver/ToolChains/Darwin.h:505:5
#11 0x0000562ba07dec33 clang::driver::toolchains::DarwinClang::addClangWarningOptions(llvm::SmallVector<char const*, 16u>&) const /proc/self/cwd/external/+llvm_project+llvm-project/clang/lib/Driver/ToolChains/Darwin.cpp:1188:7
#12 0x0000562ba072afc7 clang::driver::tools::Clang::ConstructJob(clang::driver::Compilation&, clang::driver::JobAction const&, clang::driver::InputInfo const&, llvm::SmallVector<clang::driver::InputInfo, 4u> const&, llvm::opt::ArgList const&, char const*) const /proc/self/cwd/external/+llvm_project+llvm-project/clang/lib/Driver/ToolChains/Clang.cpp:0:6
#13 0x0000562ba06306d8 clang::driver::Driver::BuildJobsForActionNoCache(clang::driver::Compilation&, clang::driver::Action const*, clang::driver::ToolChain const*, llvm::StringRef, bool, bool, char const*, std::__1::map<std::__1::pair<clang::driver::Action const*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, llvm::SmallVector<clang::driver::InputInfo, 4u>, std::__1::less<std::__1::pair<clang::driver::Action const*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>>, std::__1::allocator<std::__1::pair<std::__1::pair<clang::driver::Action const*, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>> const, llvm::SmallVector<clang::driver::InputInfo, 4u>>>>&, clang::driver::Action::OffloadKind) const /proc/self/cwd/external/+llvm_project+llvm-project/clang/lib/Driver/Driver.cpp:6083:10
...
#28 0x0000562b9e479d1f Carbon::BuildClangInvocation(Carbon::Diagnostics::Consumer&, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, llvm::ArrayRef<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>) /proc/self/cwd/toolchain/base/clang_invocation.cpp:103:21
...
```

---------

Co-authored-by: Chandler Carruth <chandlerc@gmail.com>
This commit is contained in:
Jon Ross-Perkins
2025-07-24 20:00:41 +00:00
committed by GitHub
co-authored by Chandler Carruth
parent a269c72e48
commit 59619fa8eb
10 changed files with 60 additions and 6 deletions
+18
View File
@@ -15,6 +15,7 @@
#include "common/vlog.h"
#include "llvm/ADT/STLExtras.h"
#include "llvm/ADT/ScopeExit.h"
#include "llvm/MC/TargetRegistry.h"
#include "toolchain/base/clang_invocation.h"
#include "toolchain/base/timings.h"
#include "toolchain/check/check.h"
@@ -844,6 +845,17 @@ auto CompileSubcommand::Run(DriverEnv& driver_env) -> DriverResult {
return {.success = false};
}
// Validate the target before passing it to Clang.
std::string target_error;
const llvm::Target* target = llvm::TargetRegistry::lookupTarget(
options_.codegen_options.target, target_error);
if (!target) {
CARBON_DIAGNOSTIC(CompileTargetInvalid, Error, "invalid target: {0}",
std::string);
driver_env.emitter.Emit(CompileTargetInvalid, target_error);
return {.success = false};
}
std::shared_ptr<clang::CompilerInvocation> clang_invocation;
// Build a clang invocation. We do this regardless of whether we're running
// check, because this is essentially performing further option validation,
@@ -862,6 +874,12 @@ auto CompileSubcommand::Run(DriverEnv& driver_env) -> DriverResult {
// TODO: Decide if we want this.
"-fPIE",
};
if (driver_env.fuzzing && !options_.clang_args.empty()) {
// Parsing specific Clang arguments can reach deep into
// external libraries that aren't fuzz clean.
DisableFuzzingExternalLibraries(driver_env, "compile");
return {.success = false};
}
for (auto str : options_.clang_args) {
clang_path_and_args.push_back(str.str());
}