Fuzz: drop workarounds for operations that may panic

[Shnatsel]

Drop workarounds for operations that may panic now that rutenspitz compares panic behavior

cc @jakubadamw

[Shnatsel]

Oh , it's finding some mismatches in ArrayVec now! Interesting!

[jakubadamw]

LGTM. 👍

[Shnatsel]

ArrayVec panic is pointing to an integer overflow on this line:

tinyvec/src/arrayvec_drain.rs

Line 28 in 5758549

Bound::Included(&n) => n + 1,

Operation triggering it: v.drain(..=18446744073709551615);

I am surprised that this panic is possible to detect in this setup at all. Does this mean that Vec doesn't panic here?

Side note: https://github.com/jakubadamw/rutenspitz/blob/master/DEBUGGING.md is complicated, lldb-specific (no gdb) and possibly requires rust-lldb as opposed to mainline. I've just added a println!("Operations trace:\n{}", _op_trace);

[Shnatsel]

Yep, std::Vec overflows silently: https://play.rust-lang.org/?version=stable&mode=debug&edition=2018&gist=0654621334a4a9da1917446f5c8571f0

[Shnatsel]

The same overflow was also discovered in TinyVec:

tinyvec/src/tinyvec.rs

Line 433 in 5758549

Bound::Included(x) => x + 1,

[Shnatsel]

CI is failing with DNS resolution errors.

[jakubadamw]

@Shnatsel,

Side note: https://github.com/jakubadamw/rutenspitz/blob/master/DEBUGGING.md is complicated, lldb-specific (no gdb) and possibly requires rust-lldb as opposed to mainline. I've just added a println!("Operations trace:\n{}", _op_trace);

I used a regular lldb (HFUZZ_DEBUGGER=lldb cargo hfuzz run-debug …). In fact, I had some issues running it with rust-lldb. 🙂 But yes, it is written with lldb in mind and perhaps could use some clarification.

[Nemo157]

That sounds worthy of an upstream bug report, silently failing to drain the vector 😦

[Nemo157]

Hmm, building with -Z build-std gives

thread 'main' panicked at 'attempt to add with overflow', /home/wim/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/liballoc/vec.rs:1322:29

so, the behaviour here is actually identical, except std is normally built in release mode and you are testing in debug mode.

[Shnatsel]

I've opened an issue against libstd: rust-lang/rust#74909

[Shnatsel]

No further failures after 500 million executions of arrayish target and 125 million executions of tinyvec target