Running with -j 8 leads to "error: Unrecognized option: 'a'"

[Ekleog-NEAR]

Oops, I got tricked once again by github by submitting early.

If I use bolero 0.8.0 and cargo-bolero 0.8.0, and attempt to run a fuzzer with -j 8, hoping to see 8 jobs, instead I see this result:

cargo bolero test tests::succeed -j 8
    Finished release [optimized] target(s) in 0.02s
  Executable unittests src/lib.rs (target/fuzz/build_58d39c7ddcef2bdf/x86_64-unknown-linux-gnu/release/deps/foo-b9bbcb1c97adc7ba)

running 1 test
Running 4 workers
/tmp/foo/target/fuzz/build_58d39c7ddcef2bdf/x86_64-unknown-linux-gnu/release/deps/foo-b9bbcb1c97adc7ba /tmp/foo/src/__fuzz__/tests__succeed/corpus /tmp/foo/src/__fuzz__/tests__succeed/crashes -artifact_prefix=/tmp/foo/src/__fuzz__/tests__succeed/crashes/ -timeout=10 >fuzz-0.log 2>&1
/tmp/foo/target/fuzz/build_58d39c7ddcef2bdf/x86_64-unknown-linux-gnu/release/deps/foo-b9bbcb1c97adc7ba /tmp/foo/src/__fuzz__/tests__succeed/corpus /tmp/foo/src/__fuzz__/tests__succeed/crashes -artifact_prefix=/tmp/foo/src/__fuzz__/tests__succeed/crashes/ -timeout=10 >fuzz-1.log 2>&1
/tmp/foo/target/fuzz/build_58d39c7ddcef2bdf/x86_64-unknown-linux-gnu/release/deps/foo-b9bbcb1c97adc7ba /tmp/foo/src/__fuzz__/tests__succeed/corpus /tmp/foo/src/__fuzz__/tests__succeed/crashes -artifact_prefix=/tmp/foo/src/__fuzz__/tests__succeed/crashes/ -timeout=10 >fuzz-2.log 2>&1
/tmp/foo/target/fuzz/build_58d39c7ddcef2bdf/x86_64-unknown-linux-gnu/release/deps/foo-b9bbcb1c97adc7ba /tmp/foo/src/__fuzz__/tests__succeed/corpus /tmp/foo/src/__fuzz__/tests__succeed/crashes -artifact_prefix=/tmp/foo/src/__fuzz__/tests__succeed/crashes/ -timeout=10 >fuzz-3.log 2>&1
================== Job 1 exited with exit code 101 ============
error: Unrecognized option: 'a'
================== Job 0 exited with exit code 101 ============
/tmp/foo/target/fuzz/build_58d39c7ddcef2bdf/x86_64-unknown-linux-gnu/release/deps/foo-b9bbcb1c97adc7ba /tmp/foo/src/__fuzz__/tests__succeed/corpus /tmp/foo/src/__fuzz__/tests__succeed/crashes -artifact_prefix=/tmp/foo/src/__fuzz__/tests__succeed/crashes/ -timeout=10 >fuzz-4.log 2>&1
error: Unrecognized option: 'a'
/tmp/foo/target/fuzz/build_58d39c7ddcef2bdf/x86_64-unknown-linux-gnu/release/deps/foo-b9bbcb1c97adc7ba /tmp/foo/src/__fuzz__/tests__succeed/corpus /tmp/foo/src/__fuzz__/tests__succeed/crashes -artifact_prefix=/tmp/foo/src/__fuzz__/tests__succeed/crashes/ -timeout=10 >fuzz-5.log 2>&1
================== Job 2 exited with exit code 101 ============
error: Unrecognized option: 'a'
/tmp/foo/target/fuzz/build_58d39c7ddcef2bdf/x86_64-unknown-linux-gnu/release/deps/foo-b9bbcb1c97adc7ba /tmp/foo/src/__fuzz__/tests__succeed/corpus /tmp/foo/src/__fuzz__/tests__succeed/crashes -artifact_prefix=/tmp/foo/src/__fuzz__/tests__succeed/crashes/ -timeout=10 >fuzz-6.log 2>&1
================== Job 3 exited with exit code 101 ============
error: Unrecognized option: 'a'
/tmp/foo/target/fuzz/build_58d39c7ddcef2bdf/x86_64-unknown-linux-gnu/release/deps/foo-b9bbcb1c97adc7ba /tmp/foo/src/__fuzz__/tests__succeed/corpus /tmp/foo/src/__fuzz__/tests__succeed/crashes -artifact_prefix=/tmp/foo/src/__fuzz__/tests__succeed/crashes/ -timeout=10 >fuzz-7.log 2>&1
================== Job 4 exited with exit code 101 ============
error: Unrecognized option: 'a'
================== Job 5 exited with exit code 101 ============
error: Unrecognized option: 'a'
================== Job 6 exited with exit code 101 ============
error: Unrecognized option: 'a'
================== Job 7 exited with exit code 101 ============
error: Unrecognized option: 'a'

My guess is, it’s because it’s passing the libfuzzer arguments directly to the unit tests binary instead of through BOLERO_LIBFUZZER_ARGS.

[Ekleog-NEAR]

Looking into the code… it probably is because libfuzzer execs itself again in order to implement -jobs?

In which case I’m not entirely sure how this could be fixed besides just not supporting -jobs on the libfuzzer backend

[camshaft]

We have to patch the imported libFuzzer code to pass its arguments via environment variables and pass the existing args (so it'll run the correct libtest harness).