2323extern " C" {
2424
2525// Signal handler to ensure output is flushed before crash
26- static void fuzzilliSignalHandler (int sig) {
26+ static void fuzzilliSignalHandler (int sig)
27+ {
2728 // Flush all output
2829 fflush (stdout);
2930 fflush (stderr);
@@ -39,7 +40,8 @@ static void fuzzilliSignalHandler(int sig) {
3940// This function is used by Fuzzilli to:
4041// 1. Test crash detection with fuzzilli('FUZZILLI_CRASH', type)
4142// 2. Print output with fuzzilli('FUZZILLI_PRINT', value)
42- static JSC::EncodedJSValue JSC_HOST_CALL_ATTRIBUTES functionFuzzilli (JSC::JSGlobalObject* globalObject, JSC::CallFrame* callFrame) {
43+ static JSC::EncodedJSValue JSC_HOST_CALL_ATTRIBUTES functionFuzzilli (JSC::JSGlobalObject* globalObject, JSC::CallFrame* callFrame)
44+ {
4345 JSC::VM& vm = globalObject->vm ();
4446 auto scope = DECLARE_THROW_SCOPE (vm);
4547
@@ -66,84 +68,84 @@ static JSC::EncodedJSValue JSC_HOST_CALL_ATTRIBUTES functionFuzzilli(JSC::JSGlob
6668
6769 // Trigger different types of crashes for testing (similar to V8 implementation)
6870 switch (crashType) {
69- case 0 :
70- // IMMEDIATE_CRASH - Simple abort
71- std::abort ();
72- break ;
73-
74- case 1 :
75- // CHECK failure - assertion in release builds
76- // Use __builtin_trap() for a direct crash
77- __builtin_trap ();
78- break ;
79-
80- case 2 :
81- // DCHECK failure - always crash (use trap instead of assert which is disabled in release)
82- __builtin_trap ();
83- break ;
84-
85- case 3 :
86- // Wild write - heap buffer overflow (will be caught by ASAN)
87- {
88- volatile char * buffer = new char [10 ];
89- buffer[20 ] = ' x' ; // Write past the end - ASAN should catch this
90- // Don't delete to make it more obvious
91- }
92- break ;
93-
94- case 4 :
95- // Use-after-free (will be caught by ASAN)
96- {
97- volatile char * buffer = new char [10 ];
98- delete[] buffer;
99- buffer[0 ] = ' x' ; // Use after free - ASAN should catch this
100- }
101- break ;
102-
103- case 5 :
104- // Null pointer dereference
105- {
106- volatile int * ptr = nullptr ;
107- *ptr = 42 ;
108- }
109- break ;
110-
111- case 6 :
112- // Stack buffer overflow (will be caught by ASAN)
113- {
114- volatile char buffer[10 ];
115- volatile char * p = const_cast <char *>(buffer);
116- p[20 ] = ' x' ; // Write past stack buffer
117- }
118- break ;
119-
120- case 7 :
121- // Double free (will be caught by ASAN)
122- {
123- char * buffer = new char [10 ];
124- delete[] buffer;
125- delete[] buffer; // Double free - ASAN should catch this
126- }
127- break ;
128-
129- case 8 :
130- // Verify DEBUG or ASAN is enabled
71+ case 0 :
72+ // IMMEDIATE_CRASH - Simple abort
73+ std::abort ();
74+ break ;
75+
76+ case 1 :
77+ // CHECK failure - assertion in release builds
78+ // Use __builtin_trap() for a direct crash
79+ __builtin_trap ();
80+ break ;
81+
82+ case 2 :
83+ // DCHECK failure - always crash (use trap instead of assert which is disabled in release)
84+ __builtin_trap ();
85+ break ;
86+
87+ case 3 :
88+ // Wild write - heap buffer overflow (will be caught by ASAN)
89+ {
90+ volatile char * buffer = new char [10 ];
91+ buffer[20 ] = ' x' ; // Write past the end - ASAN should catch this
92+ // Don't delete to make it more obvious
93+ }
94+ break ;
95+
96+ case 4 :
97+ // Use-after-free (will be caught by ASAN)
98+ {
99+ volatile char * buffer = new char [10 ];
100+ delete[] buffer;
101+ buffer[0 ] = ' x' ; // Use after free - ASAN should catch this
102+ }
103+ break ;
104+
105+ case 5 :
106+ // Null pointer dereference
107+ {
108+ volatile int * ptr = nullptr ;
109+ *ptr = 42 ;
110+ }
111+ break ;
112+
113+ case 6 :
114+ // Stack buffer overflow (will be caught by ASAN)
115+ {
116+ volatile char buffer[10 ];
117+ volatile char * p = const_cast <char *>(buffer);
118+ p[20 ] = ' x' ; // Write past stack buffer
119+ }
120+ break ;
121+
122+ case 7 :
123+ // Double free (will be caught by ASAN)
124+ {
125+ char * buffer = new char [10 ];
126+ delete[] buffer;
127+ delete[] buffer; // Double free - ASAN should catch this
128+ }
129+ break ;
130+
131+ case 8 :
132+ // Verify DEBUG or ASAN is enabled
131133#if defined(DEBUG) || __has_feature(address_sanitizer) || defined(__SANITIZE_ADDRESS__)
132- // Expected to be compiled with debug or ASAN, don't crash
133- fprintf (stdout, " DEBUG or ASAN is enabled\n " );
134- fflush (stdout);
134+ // Expected to be compiled with debug or ASAN, don't crash
135+ fprintf (stdout, " DEBUG or ASAN is enabled\n " );
136+ fflush (stdout);
135137#else
136- // If neither DEBUG nor ASAN is enabled, crash to indicate misconfiguration
137- fprintf (stderr, " ERROR: Expected DEBUG or ASAN to be enabled\n " );
138- fflush (stderr);
139- std::abort ();
138+ // If neither DEBUG nor ASAN is enabled, crash to indicate misconfiguration
139+ fprintf (stderr, " ERROR: Expected DEBUG or ASAN to be enabled\n " );
140+ fflush (stderr);
141+ std::abort ();
140142#endif
141- break ;
143+ break ;
142144
143- default :
144- // Unknown crash type, just abort
145- std::abort ();
146- break ;
145+ default :
146+ // Unknown crash type, just abort
147+ std::abort ();
148+ break ;
147149 }
148150 } else if (command == " FUZZILLI_PRINT" _s) {
149151 // Optional: Print the second argument
@@ -162,7 +164,8 @@ static JSC::EncodedJSValue JSC_HOST_CALL_ATTRIBUTES functionFuzzilli(JSC::JSGlob
162164}
163165
164166// Register the fuzzilli() function on a Bun global object
165- void Bun__REPRL__registerFuzzilliFunction (Zig::GlobalObject* globalObject) {
167+ void Bun__REPRL__registerFuzzilliFunction (Zig::GlobalObject* globalObject)
168+ {
166169 JSC::VM& vm = globalObject->vm ();
167170
168171 // Install signal handlers to ensure output is flushed before crashes
@@ -180,8 +183,7 @@ void Bun__REPRL__registerFuzzilliFunction(Zig::GlobalObject* globalObject) {
180183 functionFuzzilli,
181184 JSC::ImplementationVisibility::Public,
182185 JSC::NoIntrinsic,
183- JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::DontDelete
184- );
186+ JSC::PropertyAttribute::DontEnum | JSC::PropertyAttribute::DontDelete);
185187}
186188
187189// ============================================================================
@@ -206,7 +208,8 @@ static uint32_t* __edges_start = nullptr;
206208static uint32_t * __edges_stop = nullptr ;
207209
208210// Reset edge guards for next iteration
209- static void __sanitizer_cov_reset_edgeguards () {
211+ static void __sanitizer_cov_reset_edgeguards ()
212+ {
210213 if (!__edges_start || !__edges_stop) return ;
211214 uint64_t N = 0 ;
212215 for (uint32_t * x = __edges_start; x < __edges_stop && N < MAX_EDGES; x++) {
@@ -215,7 +218,8 @@ static void __sanitizer_cov_reset_edgeguards() {
215218}
216219
217220// Called by the compiler to initialize coverage instrumentation
218- extern " C" void __sanitizer_cov_trace_pc_guard_init (uint32_t * start, uint32_t * stop) {
221+ extern " C" void __sanitizer_cov_trace_pc_guard_init (uint32_t * start, uint32_t * stop)
222+ {
219223 // Avoid duplicate initialization
220224 if (start == stop || *start) return ;
221225
@@ -257,7 +261,8 @@ extern "C" void __sanitizer_cov_trace_pc_guard_init(uint32_t* start, uint32_t* s
257261}
258262
259263// Called by the compiler for each edge
260- extern " C" void __sanitizer_cov_trace_pc_guard (uint32_t * guard) {
264+ extern " C" void __sanitizer_cov_trace_pc_guard (uint32_t * guard)
265+ {
261266 // There's a small race condition here: if this function executes in two threads for the same
262267 // edge at the same time, the first thread might disable the edge (by setting the guard to zero)
263268 // before the second thread fetches the guard value (and thus the index). However, our
@@ -272,23 +277,27 @@ extern "C" void __sanitizer_cov_trace_pc_guard(uint32_t* guard) {
272277
273278// Function to reset coverage for next REPRL iteration
274279// This should be called after each script execution
275- extern " C" void Bun__REPRL__resetCoverage () {
280+ extern " C" void Bun__REPRL__resetCoverage ()
281+ {
276282 __sanitizer_cov_reset_edgeguards ();
277283}
278284
279285#else
280286
281287// Stub implementations when ASAN is not enabled
282- extern " C" void __sanitizer_cov_trace_pc_guard_init (uint32_t * start, uint32_t * stop) {
288+ extern " C" void __sanitizer_cov_trace_pc_guard_init (uint32_t * start, uint32_t * stop)
289+ {
283290 (void )start;
284291 (void )stop;
285292}
286293
287- extern " C" void __sanitizer_cov_trace_pc_guard (uint32_t * guard) {
294+ extern " C" void __sanitizer_cov_trace_pc_guard (uint32_t * guard)
295+ {
288296 (void )guard;
289297}
290298
291- extern " C" void Bun__REPRL__resetCoverage () {
299+ extern " C" void Bun__REPRL__resetCoverage ()
300+ {
292301}
293302
294303#endif // ASAN
0 commit comments