Description
When running test cases against a harness, whether before dynamic analysis execution or after, it may be possible that undefined behavior occurs for the input, and may not be entirely clear whether its the fault of an improperly written harness, or an actual digression from functional correctness.
For example, an intentional lack of a sanity check for whether or not an instantiation is NULL
results in the following for a bitmap fuzzer:
WARNING: No test specified, defaulting to first test defined (Portability_Deserialize)
TRACE: Initialized test input buffer with data from `../testcpp.bin`
TRACE: Running: Portability_Deserialize from ../tests/format_portability_unit.cpp(22)
ERROR: Crashed: Portability_Deserialize
ERROR: Test case ../testcpp.bin crashed
We know that this isn't a crash as a result of violating an assertion, but it's still unclear what is going on and where exactly it occurred.
Besides manually sprinkling in a bunch of calls to the logger, we should also be able to configure the harness to introspectively triage the crash once it occurs. At the simplest level, it would be reporting the line number at which the crash occur, but it would also be informative to also include a traceback if an option is set (i.e --verbose_crash_trace
).