Handle expectations for release failure in fuzz test.

When forwarder "fails" to release memory, we may not report released pages. Resolves #206. PiperOrigin-RevId: 571969211 Change-Id: Ia1a969eac8e5348bcd8d5b16ac4fa688cd0db657
google · Oct 9, 2023 · db8a827 · db8a827
1 parent dd8f4b4
commit db8a827
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 2 deletions.
diff --git a/tcmalloc/huge_page_aware_allocator_fuzz.cc b/tcmalloc/huge_page_aware_allocator_fuzz.cc
@@ -228,8 +228,15 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
           stats = allocator->FillerStats();
           released = allocator->ReleaseAtLeastNPagesBreakingHugepages(desired);
         }
-        CHECK_GE(released.in_bytes(),
-                 std::min(desired.in_bytes(), stats.free_bytes));
+
+        if (forwarder.release_succeeds()) {
+          CHECK_GE(released.in_bytes(),
+                   std::min(desired.in_bytes(), stats.free_bytes));
+        } else {
+          // TODO(b/271282540):  This is not strict equality due to
+          // HugePageFiller's unmapping_unaccounted_ state.  Narrow this bound.
+          CHECK_GE(released.in_bytes(), 0);
+        }
         break;
       }
       case 4: {

diff --git a/tcmalloc/mock_huge_page_static_forwarder.h b/tcmalloc/mock_huge_page_static_forwarder.h
@@ -60,6 +60,7 @@ class FakeStaticForwarder {
     release_partial_alloc_pages_ = v;
   }
   void set_hpaa_subrelease(bool v) { hpaa_subrelease_ = v; }
+  bool release_succeeds() const { return release_succeeds_; }
   void set_release_succeeds(bool v) { release_succeeds_ = v; }
 
   // Arena state.

diff --git a/...cator_fuzz/clusterfuzz-testcase-minimized-huge_page_aware_allocator_fuzz-6140744194457600 b/...cator_fuzz/clusterfuzz-testcase-minimized-huge_page_aware_allocator_fuzz-6140744194457600
@@ -0,0 +1 @@
+             ��                s