fuzzer failing to link

[johannkoenig]

libvpx currently builds asan, msan, and another fuzzer. The first two are still building, but the last one just started having a linking error and I'm not sure what's going on. The part that is failing to link has not been changed recently and I'm not sure how it could be changed to induce the error I'm seeing.

Because the other fuzzer configurations are building, this looks like a toolchain issue to me.

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11437

Step #21: CC=clang
Step #21: CXX=clang++
Step #21: CFLAGS=-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=bool,array-bounds,float-divide-by-zero,function,integer-divide-by-zero,return,shift,signed-integer-overflow,unsigned-integer-overflow,vla-bound,vptr -fno-sanitize-recover=bool,array-bounds,float-divide-by-zero,function,integer-divide-by-zero,return,shift,signed-integer-overflow,vla-bound,vptr -fsanitize=fuzzer-no-link
Step #21: CXXFLAGS=-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=bool,array-bounds,float-divide-by-zero,function,integer-divide-by-zero,return,shift,signed-integer-overflow,unsigned-integer-overflow,vla-bound,vptr -fno-sanitize-recover=bool,array-bounds,float-divide-by-zero,function,integer-divide-by-zero,return,shift,signed-integer-overflow,vla-bound,vptr -fsanitize=fuzzer-no-link -stdlib=libc++
<...>
Step #21: + LDFLAGS='-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=bool,array-bounds,float-divide-by-zero,function,integer-divide-by-zero,return,shift,signed-integer-overflow,unsigned-integer-overflow,vla-bound,vptr -fno-sanitize-recover=bool,array-bounds,float-divide-by-zero,function,integer-divide-by-zero,return,shift,signed-integer-overflow,vla-bound,vptr -fsanitize=fuzzer-no-link -stdlib=libc++'
Step #21: + LD=clang
Step #21: + /src/libvpx/configure --disable-unit-tests --size-limit=12288x12288 --extra-cflags=-DVPX_MAX_ALLOCABLE_MEMORY=1073741824 --disable-webm-io --enable-debug
<...>
Step #21: [LD] vpxenc
Step #21: third_party/libyuv/source/cpu_id.cc.o:(.rodata._ZTIFviiPiE[_ZTIFviiPiE]+0x0): undefined reference to vtable for __cxxabiv1::__function_type_info' Step #21: third_party/libyuv/source/cpu_id.cc.o:(.rodata._ZTIFivE[_ZTIFivE]+0x0): undefined reference to vtable for __cxxabiv1::__function_type_info'
Step #21: third_party/libyuv/source/cpu_id.cc.o:(.rodata._ZTIFiPKcE[_ZTIFiPKcE]+0x0): undefined reference to vtable for __cxxabiv1::__function_type_info' Step #21: third_party/libyuv/source/cpu_id.cc.o:(.rodata._ZTIFiPKcS0_E[_ZTIFiPKcS0_E]+0x0): undefined reference to vtable for __cxxabiv1::__function_type_info'
Step #21: third_party/libyuv/source/cpu_id.cc.o:(.rodata._ZTIFiiE[_ZTIFiiE]+0x0): undefined reference to vtable for __cxxabiv1::__function_type_info' Step #21: third_party/libyuv/source/planar_functions.cc.o:(.rodata._ZTIFvPKhiPhiiiE[_ZTIFvPKhiPhiiiE]+0x0): more undefined references to vtable for __cxxabiv1::__function_type_info' follow
Step #21: third_party/libyuv/source/cpu_id.cc.o:(.rodata._ZTIFviiPiE[_ZTIFviiPiE]+0x0): undefined reference to vtable for __cxxabiv1::__function_type_info' Step #21: third_party/libyuv/source/cpu_id.cc.o:(.rodata._ZTIFivE[_ZTIFivE]+0x0): undefined reference to vtable for __cxxabiv1::__function_type_info'
Step #21: third_party/libyuv/source/cpu_id.cc.o:(.rodata._ZTIFiPKcE[_ZTIFiPKcE]+0x0): undefined reference to vtable for __cxxabiv1::__function_type_info' Step #21: third_party/libyuv/source/cpu_id.cc.o:(.rodata._ZTIFiPKcS0_E[_ZTIFiPKcS0_E]+0x0): undefined reference to vtable for __cxxabiv1::__function_type_info'
Step #21: third_party/libyuv/source/cpu_id.cc.o:(.rodata._ZTIFiiE[_ZTIFiiE]+0x0): undefined reference to vtable for __cxxabiv1::__function_type_info' Step #21: third_party/libyuv/source/planar_functions.cc.o:(.rodata._ZTIFvPKhiPhiiiE[_ZTIFvPKhiPhiiiE]+0x0): more undefined references to vtable for __cxxabiv1::__function_type_info' follow
Step #21: clang-8: error: linker command failed with exit code 1 (use -v to see invocation)
Step #21: make[1]: *** [vpxdec] Error 1

[johannkoenig]

@harishdm @oliverchang from:
#1914

[Dor1s]

Looks like this is from UBSan build (--sanitizer=undefined) which is also enabled in https://github.com/google/oss-fuzz/blob/master/projects/libvpx/project.yaml

[johannkoenig]

Can you tell if there were any successful builds before it started failing?

[Dor1s]

Yes, I can. There were no successful builds so far. Does libvpx use -fno-rtti? UBSan's vptr is not compatible with that flag. You can either remove -fno-rtti (if possible, of course), or disable vptr check like it's being done here

oss-fuzz/projects/harfbuzz/build.sh

Line 20 in 22dd200

export CFLAGS="$CFLAGS -fno-sanitize=vptr"

[johannkoenig]

libvpx itself should not. The only reference to it I see in our codebase is third_party/googletest but that is not built for these fuzzing tests. I'll see if I can send a PR.

[johannkoenig]

I can't find any instances of rtti in oss-fuzz/projects/libvpx

Where does it need to be removed from?

[johannkoenig]

I don't see it anywhere in the log either:
https://oss-fuzz-build-logs.storage.googleapis.com/log-8b7ede11-b38c-4748-a746-aacf29cc8465.txt

[johannkoenig]

We also build ubsan with every commit (and run a few tests) but that is with clang 6.0.1:
https://build.webmproject.org/jenkins/job/libvpx__per-commit_sanitizer_compile/arch=x86_64,bitdepth=low,sanitizer=undefined/2457/console

[Dor1s]

Hm. Another guess: looks like you link using clang, not clang++. See #406 (comment) and https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html#available-checks for more info.

[Dor1s]

Also updated the docs to be explicit about this: 4e3be11

[johannkoenig]

Excellent catch. We do indeed use LD=clang++ upstream.
#1962

[Dor1s]

Woohoo, the latest build succeeded.