Error in instrumentation with distance file

[fuzzer123]

Hi, thanks for your aflgo tool.
I am now using aflgo according to the steps mentioned in README.md.
But when I run Step 9 (instrumentation with distance file), I got the following error.
Could you please give me any suggestion about how to solve the problem?
Thank you very much.

===================
aflgo-llvm-pass (yeah!) 2.49b (distance instrumentation mode)
clang-4.0: /home/fuzzer123/llvm/lib/IR/Instructions.cpp:1350: llvm::LoadInst::LoadInst(llvm::Type*, llvm::Value*, const char*, bool, llvm::Instruction*): Assertion `Ty == cast(Ptr->getType())->getElementType()' failed.
#0 0x00000000039febec llvm::sys::PrintStackTrace(llvm::raw_ostream&) /home/fuzzer123/llvm/lib/Support/Unix/Signals.inc:402:0
#1 0x00000000039fef8b PrintStackTraceSignalHandler(void*) /home/fuzzer123/llvm/lib/Support/Unix/Signals.inc:466:0
#2 0x00000000039fcf23 llvm::sys::RunSignalHandlers() /home/fuzzer123/llvm/lib/Support/Signals.cpp:44:0
#3 0x00000000039fe44d SignalHandler(int) /home/fuzzer123/llvm/lib/Support/Unix/Signals.inc:256:0
#4 0x00007fea32523390 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x11390)
#5 0x00007fea316d8428 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x35428)
#6 0x00007fea316da02a abort (/lib/x86_64-linux-gnu/libc.so.6+0x3702a)
#7 0x00007fea316d0bd7 (/lib/x86_64-linux-gnu/libc.so.6+0x2dbd7)
#8 0x00007fea316d0c82 (/lib/x86_64-linux-gnu/libc.so.6+0x2dc82)
#9 0x00000000033c4b7f llvm::LoadInst::LoadInst(llvm::Type*, llvm::Value*, char const*, bool, llvm::Instruction*) /home/fuzzer123/llvm/lib/IR/Instructions.cpp:1351:0
#10 0x00007fea31498d00 llvm::IRBuilder<llvm::ConstantFolder, llvm::IRBuilderDefaultInserter>::CreateLoad(llvm::Type*, llvm::Value*, llvm::Twine const&) /usr/local/include/llvm/IR/IRBuilder.h:1089:12
#11 0x00007fea31498d00 (anonymous namespace)::AFLCoverage::runOnModule(llvm::Module&) /home/fuzzer123/aflgo/llvm_mode/afl-llvm-pass.so.cc:558:0
#12 0x00000000033f8cc4 (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) /home/fuzzer123/llvm/lib/IR/LegacyPassManager.cpp:1590:0
#13 0x00000000033f93d9 llvm::legacy::PassManagerImpl::run(llvm::Module&) /home/fuzzer123/llvm/lib/IR/LegacyPassManager.cpp:1693:0
#14 0x00000000033f95e5 llvm::legacy::PassManager::run(llvm::Module&) /home/fuzzer123/llvm/lib/IR/LegacyPassManager.cpp:1725:0
#15 0x0000000003cb79c5 (anonymous namespace)::EmitAssemblyHelper::EmitAssembly(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_deletellvm::raw_pwrite_stream >) /home/fuzzer123/llvm/tools/clang/lib/CodeGen/BackendUtil.cpp:723:0
#16 0x0000000003cb91c4 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::DataLayout const&, llvm::Module*, clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_deletellvm::raw_pwrite_stream >) /home/fuzzer123/llvm/tools/clang/lib/CodeGen/BackendUtil.cpp:978:0
#17 0x00000000048591a3 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) /home/fuzzer123/llvm/tools/clang/lib/CodeGen/CodeGenAction.cpp:231:0
#18 0x000000000553c6e9 clang::ParseAST(clang::Sema&, bool, bool) /home/fuzzer123/llvm/tools/clang/lib/Parse/ParseAST.cpp:161:0
#19 0x00000000042ac7bb clang::ASTFrontendAction::ExecuteAction() /home/fuzzer123/llvm/tools/clang/lib/Frontend/FrontendAction.cpp:559:0
#20 0x00000000048577e3 clang::CodeGenAction::ExecuteAction() /home/fuzzer123/llvm/tools/clang/lib/CodeGen/CodeGenAction.cpp:911:0
#21 0x00000000042ac208 clang::FrontendAction::Execute() /home/fuzzer123/llvm/tools/clang/lib/Frontend/FrontendAction.cpp:463:0
#22 0x000000000424d35c clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) /home/fuzzer123/llvm/tools/clang/lib/Frontend/CompilerInstance.cpp:954:0
#23 0x00000000043eaa39 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) /home/fuzzer123/llvm/tools/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:249:0
#24 0x0000000001d390e2 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) /home/fuzzer123/llvm/tools/clang/tools/driver/cc1_main.cpp:221:0
#25 0x0000000001d2ea1b ExecuteCC1Tool(llvm::ArrayRef<char const*>, llvm::StringRef) /home/fuzzer123/llvm/tools/clang/tools/driver/driver.cpp:299:0
#26 0x0000000001d2f639 main /home/fuzzer123/llvm/tools/clang/tools/driver/driver.cpp:380:0
#27 0x00007fea316c3830 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20830)
#28 0x0000000001d2c1d9 _start (/usr/local/bin/clang-4.0+0x1d2c1d9)
Stack dump:
0. Program arguments: /usr/local/bin/clang-4.0 -cc1 -triple x86_64-unknown-linux-gnu -emit-obj -disable-free -main-file-name parserInternals.c -mrelocation-model static -mthread-model posix -fmath-errno -masm-verbose -mconstructor-aliases -munwind-tables -fuse-init-array -target-cpu x86-64 -momit-leaf-frame-pointer -dwarf-column-info -debug-info-kind=limited -dwarf-version=4 -debugger-tuning=gdb -coverage-notes-file /home/fuzzer123/poc/libxml2/parserInternals.gcno -resource-dir /usr/local/bin/../lib/clang/4.0.1 -dependency-file .deps/parserInternals.Tpo -sys-header-deps -MP -MT parserInternals.lo -D HAVE_CONFIG_H -I . -I ./include -I ./include -D _REENTRANT -D __AFL_HAVE_MANUAL_CONTROL=1 -D __AFL_COMPILER=1 -D FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1 -D __AFL_LOOP(_A)=({ static volatile char _B attribute((used)); _B = (char)"##SIG_AFL_PERSISTENT##"; attribute((visibility("default"))) int _L(unsigned int) asm("__afl_persistent_loop"); _L(_A); }) -D __AFL_INIT()=do { static volatile char _A attribute((used)); _A = (char)"##SIG_AFL_DEFER_FORKSRV##"; attribute((visibility("default"))) void _I(void) asm("__afl_manual_init"); _I(); } while (0) -internal-isystem /usr/local/include -internal-isystem /usr/local/bin/../lib/clang/4.0.1/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -W -Wformat -Wunused -Wimplicit -Wreturn-type -Wswitch -Wcomment -Wtrigraphs -Wformat -Wchar-subscripts -Wuninitialized -Wparentheses -Wshadow -Wpointer-arith -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Wmissing-prototypes -Wnested-externs -Winline -Wredundant-decls -Wno-long-long -pedantic -fconst-strings -fdebug-compilation-dir /home/fuzzer123/poc/libxml2 -ferror-limit 19 -fmessage-length 80 -funroll-loops -fobjc-runtime=gcc -fdiagnostics-show-option -vectorize-loops -vectorize-slp -load /home/fuzzer123/aflgo/afl-llvm-pass.so -mllvm -distance=/home/fuzzer123/poc/temp/distance.cfg.txt -o parserInternals.o -x c parserInternals.c

1. parser at end of file
2. Per-module optimization passes
3. Running pass 'Unnamed pass: implement Pass::getPassName()' on module 'parserInternals.c'.
   clang-4.0: error: unable to execute command: Aborted (core dumped)
   clang-4.0: error: clang frontend command failed due to signal (use -v to see invocation)
   clang version 4.0.1 (tags/RELEASE_401/final)
   Target: x86_64-unknown-linux-gnu
   Thread model: posix
   InstalledDir: /usr/local/bin
   clang-4.0: note: diagnostic msg: PLEASE submit a bug report to http://llvm.org/bugs/ and include the crash backtrace, preprocessed source, and associated run script.
   clang-4.0: note: diagnostic msg:

---

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang-4.0: note: diagnostic msg: /tmp/parserInternals-8469e8.c
clang-4.0: note: diagnostic msg: /tmp/parserInternals-8469e8.sh
clang-4.0: note: diagnostic msg:

---

Makefile:1247: recipe for target 'parserInternals.lo' failed
make[2]: *** [parserInternals.lo] Error 1
make[2]: Leaving directory '/home/fuzzer123/poc/libxml2'
Makefile:1439: recipe for target 'all-recursive' failed
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory '/home/fuzzer123/poc/libxml2'
Makefile:858: recipe for target 'all' failed
make: *** [all] Error 2

[thuanpv]

I cannot reproduce this issue even though I am using LLVM and Clang 4.0 like you. Can you provide more information like did you follow exactly all steps in the README or you customized some step? Moreover, how did you install LLVM and Clang?

[fuzzer123]

Hi Thuanpv,

I followed exactly all the steps in the README and I installed LLVM and Clang from building the source code of version 4.0.

I have solved this issue by adding a pointer cast IR to MapDistPtr and MapCntPtr as follows:
MapDistPtr = IRB.CreatePointerCast(MapDistPtr, LargestType->getPointerTo());
MapCntPtr = IRB.CreatePointerCast(MapCntPtr, LargestType->getPointerTo());

It seems that by calling IRB.CreateGEP(MapPtr, MapDistLoc), the MapDistPtr is of integer type that has only 8 bit width. The element type of MapDistPtr is not compatible with LargestType.

Now there is no any errors. But could you please confirm whether my modification is right?
Thank you.

[roachspray]

The solution above worked for me as well.

[stuartly]

@fuzzer123 The solution worked for me too !

[mboehme]

Updated tutorial in commit 5e36152.