#Centipede Improve thread termination detection to handle pthread_exit.

PiperOrigin-RevId: 574999308

centipede/puzzles/BUILD

@@ -43,4 +43,5 @@ package(default_visibility = ["@com_google_fuzztest//centipede/puzzles:__subpack
     "autodictionary_stress",
     "paths",
     "thread_uint32_cmp_1",
+    "pthread_exit_uint32_cmp_1",
 ]]

centipede/puzzles/pthread_exit_uint32_cmp_1.cc

@@ -0,0 +1,52 @@
+// Copyright 2023 The Centipede Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Centipede puzzle: one 4-byte cmp, in a separate thread using pthread
+// interface. We should be able to solve it w/o cmp features *or* w/o auto
+// dictionary.
+//
+// RUN: Run && SolutionIs Fuzz
+// RUN: Run --use_auto_dictionary=0 && SolutionIs Fuzz
+// RUN: Run --use_cmp_features=0 && SolutionIs Fuzz
+
+#include <pthread.h>
+
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+
+// non-const, to avoid compiler optimization.
+static char expected_data[] = "Fuzz";
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  pthread_t pt;
+  struct ThreadArg {
+    const uint8_t *data;
+    size_t size;
+  } arg = {.data = data, .size = size};
+  auto pt_entry = +[](const ThreadArg *thread_arg) {
+    uint32_t value, expected_value;
+    if (thread_arg->size == sizeof(value)) {
+      memcpy(&value, thread_arg->data, sizeof(value));
+      memcpy(&expected_value, expected_data, sizeof(expected_value));
+      if (value == expected_value) abort();
+      pthread_exit(nullptr);
+    }
+  };
+  if (pthread_create(&pt, nullptr,
+                     reinterpret_cast<void *(*)(void *)>(pt_entry), &arg) != 0)
+    return 1;
+  if (pthread_join(pt, nullptr) != 0) return 1;
+  return 0;
+}

centipede/runner.cc

@@ -75,6 +75,17 @@ size_t LengthOfCommonPrefix(const void *s1, const void *s2, size_t n) {
   return n;
 }
 
+class ThreadTerminationDetector {
+ public:
+  // A dummy method to trigger the construction and make sure that the
+  // destructor will be called on the thread termination.
+  __attribute__((optnone)) void EnsureAlive() {}
+
+  ~ThreadTerminationDetector() { tls.OnThreadStop(); }
+};
+
+thread_local ThreadTerminationDetector termination_detector;
+
 }  // namespace
 
 // Use of the fixed init priority allows to call CentipedeRunnerMain
@@ -126,6 +137,7 @@ void ThreadLocalRunnerState::TraceMemCmp(uintptr_t caller_pc, const uint8_t *s1,
 }
 
 void ThreadLocalRunnerState::OnThreadStart() {
+  termination_detector.EnsureAlive();
   tls.lowest_sp = tls.top_frame_sp =
       reinterpret_cast<uintptr_t>(__builtin_frame_address(0));
   tls.call_stack.Reset(state.run_time_flags.callstack_level);

centipede/runner.h

@@ -83,9 +83,9 @@ struct ThreadLocalRunnerState {
   // Guarded by state.tls_list_mu.
   ThreadLocalRunnerState *next, *prev;
 
-  // The pthread_create() interceptor calls OnThreadStart()/OnThreadStop()
-  // before/after the thread callback.
-  // The main thread calls OnThreadStart().
+  // The pthread_create() interceptor calls OnThreadStart() before the thread
+  // callback. The main thread also calls OnThreadStart(). OnThreadStop() will
+  // be called when thread termination is detected internally - see runner.cc.
   void OnThreadStart();
   void OnThreadStop();
 

centipede/runner_interceptors.cc

@@ -58,7 +58,6 @@ void *MyThreadStart(void *arg) {
   auto *args = static_cast<ThreadCreateArgs *>(arg);
   tls.OnThreadStart();
   void *retval = args->start_routine(args->arg);
-  tls.OnThreadStop();
   delete args;  // allocated in the pthread_create wrapper.
   return retval;
 }