Broken libxml2 build

[Dor1s]

https://oss-fuzz-build-logs.storage.googleapis.com/index.html

Step #4: + check_startup_crash /workspace/out/address/libxml2_xml_regexp_compile_fuzzer
Step #4: + local FUZZER=/workspace/out/address/libxml2_xml_regexp_compile_fuzzer
Step #4: + local CHECK_PASSED=0
Step #4: + [[ libfuzzer = libfuzzer ]]
Step #4: ++ /workspace/out/address/libxml2_xml_regexp_compile_fuzzer -runs=4
Step #4: ++ egrep 'Done 4 runs' -c
Step #4: BAD BUILD: the fuzzer seems to have either startup crash or exit.
Step #4: + CHECK_PASSED=0
Step #4: + ((  0 == 0  ))
Step #4: + echo 'BAD BUILD: the fuzzer seems to have either startup crash or exit.'
Step #4: + exit 1

[Dor1s]

That seems a little bit flaky, but sometimes I get the following:

root@c1c55f436d60:/out# ./libxml2_xml_regexp_compile_fuzzer -runs=4 
INFO: Seed: 676310733
INFO: Loaded 1 modules   (41044 guards): 41044 [0xc64db0, 0xc8cf00), 
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: A corpus is not provided, starting from an empty corpus
#2	INITED cov: 170 ft: 166 corp: 1/1b exec/s: 0 rss: 45Mb
#3	NEW    cov: 170 ft: 167 corp: 2/2b exec/s: 0 rss: 45Mb L: 1/1 MS: 1 ShuffleBytes-
#4	NEW    cov: 205 ft: 242 corp: 3/95b exec/s: 0 rss: 45Mb L: 93/93 MS: 2 ShuffleBytes-InsertRepeatedBytes-
#5	DONE   cov: 210 ft: 242 corp: 3/95b exec/s: 0 rss: 45Mb
Done 5 runs in 0 second(s)

@kcc, aren't you surprised? :)

root@c1c55f436d60:/out# for i in `seq 1 100`; do ./libxml2_xml_regexp_compile_fuzzer -runs=4 2>&1 | egrep '[0-9] runs' -o >> log.txt; done
root@c1c55f436d60:/out# cat log.txt | grep 5 -c
16
root@c1c55f436d60:/out# cat log.txt | grep 4 -c
84

[kcc]

Yea, I know.
The problem is that libFuzzer tries to run lsan on some inputs (where malloc/free is unbalanced)
and those runs don't check the value of the -runs flag.
Probably worse fixing just to avoid confusion like yours. Otherwise not an issue.

[Dor1s]

Thanks for the comment! Would you accept something like https://reviews.llvm.org/D37632?

[kcc]

Yep!