Issue #20448 has been reported by ms-tob (Matt S).
----------------------------------------
Feature #20448: Make coverage event hooking C API public
https://bugs.ruby-lang.org/issues/20448
* Author: ms-tob (Matt S)
* Status: Open
----------------------------------------
# Abstract
Gathering code coverage information is a well-known goal within software engineering. It
is most commonly used to assess code coverage during automated testing. A lesser known
use-case is coverage-guided fuzz testing, which will be the primary use-case presented in
this issue. This issue exists to request that Ruby coverage event hooking be made part of
its official, public C API.
# Background
Ruby currently provides a number of avenues for hooking events *or* gathering coverage
information:
1. The [
Coverage](https://ruby-doc.org/3.3.0/exts/coverage/Coverage.html) module
2. The [
TracePoint](https://ruby-doc.org/3.3.0/TracePoint.html) module
3. The
[
rb_add_event_hook](https://ruby-doc.org/3.3.0/extension_rdoc.html#label-Hoo…
extension function
Unfortunately, none of these pieces of functionality solve this issue's specific
use-case. The `Coverage` module is not a great fit for real-time coverage analysis with an
unknown start and stop point. Coverage-guided fuzz testing requires this. The `TracePoint`
module and `rb_add_event_hook` are not able to hook branch and line coverage events.
Coverage-guided fuzz testing typically tracks branch events.
# Proposal
The ultimate goal is to enable Ruby C extensions to process coverage events in real-time.
I did some cursory investigation into the Ruby C internals to determine what it would take
to achieve this, but I'm by no means an expert, so my list may be incomplete.
The good news is that much of this functionality already exists, but it's part of the
private, internal-only C API.
1. Make `RUBY_EVENT_COVERAGE_LINE` and `RUBY_EVENT_COVERAGE_BRANCH` public:
https://github.com/ruby/ruby/blob/v3_3_0/vm_core.h#L2182-L2184
a. This would be an addition to the current public event types:
https://github.com/ruby/ruby/blob/v3_3_0/include/ruby/internal/event.h#L32-…
2. Allow initializing global coverage state so that coverage tracking can be fully
enabled
a. Currently, if `Coverage.setup` or `Coverage.start` is not called, then coverage
events cannot be hooked. I do not fully understand why this is, but I believe it has
something to do with `rb_get_coverages` and `rb_set_coverages`. If calls to
`rb_get_coverages` return `NULL`
(
https://github.com/ruby/ruby/blob/v3_3_0/iseq.c#L641-L647,
https://github.com/ruby/ruby/blob/v3_3_0/iseq.c#L864-L868), then coverage hooking will not
be enabled. I believe the `Coverage` module initializes that state via a
`rb_set_coverages` call here:
https://github.com/ruby/ruby/blob/v3_3_0/ext/coverage/coverage.c#L112-L120.
b. So, to achieve this goal, a C extension would need to be able to call
`rb_set_coverages` or somehow initialize the global coverage state.
I've actually been able to achieve this functionality by calling undocumented features
and defining `RUBY_EVENT_COVERAGE_BRANCH`:
```c
#include <ruby.h>
#include <ruby/debug.h>
#define RUBY_EVENT_COVERAGE_BRANCH 0x020000
// ...
rb_event_flag_t events = RUBY_EVENT_COVERAGE_BRANCH;
rb_event_hook_flag_t flags = (
RUBY_EVENT_HOOK_FLAG_SAFE | RUBY_EVENT_HOOK_FLAG_RAW_ARG
);
rb_add_event_hook2(
(rb_event_hook_func_t) event_hook_branch,
events,
counter_hash,
flags
);
```
If I call `Coverage.setup(branches: true)`, and add this event hook, then branch hooking
works as expected. `rb_add_event_hook2` will still respect the
`RUBY_EVENT_COVERAGE_BRANCH` value if its passed. But it would be better if I could rely
on official functionality rather than undocumented features.
The above two points would be requirements for this functionality, but there's an
additional nice-to-have:
3. Extend the public `tracearg` functionality to include additional coverage information
a. Currently, `tracearg` offers information like `rb_tracearg_lineno` and
`rb_tracearg_path`. It would be helpful if it also provided additional coverage
information like `coverage.c`'s column information and a unique identifier for each
branch. Currently, I can only use `(path, lineno)` as a unique identifier for a branch
because that's what's offered by the public API, but more information like column
number would be helpful for uniquely identify branches. Since there can be multiple `if`
statements on a single line, this can provide ambiguous identification for a branch
event.
# Use cases
This use-case was born out of a new coverage-guided Ruby fuzzer:
https://github.com/trailofbits/ruzzy. You can read more about its implementation details
here:
https://blog.trailofbits.com/2024/03/29/introducing-ruzzy-a-coverage-guided….
You can also find the Ruby C extension code behind its implementation here:
https://github.com/trailofbits/ruzzy/blob/v0.7.0/ext/cruzzy/cruzzy.c#L220-L….
So, the primary use-case here is enabling real-time, coverage-guided fuzz testing of Ruby
code. However, as mentioned in the abstract, gathering code coverage information is useful
in many domains. For example, it could enable new workflows in standard unit/integration
test coverage. It could also enable gathering coverage information in real-time as an
application is running. I see this as the most generalized form of gathering code coverage
information, and something like the `Coverage` module as a specialized implementation.
Another example,
https://bugs.ruby-lang.org/issues/20282 may be solved by this more
generalized solution.
We are tracking this request downstream here:
https://github.com/trailofbits/ruzzy/issues/9
# Discussion
Fuzz testing is another tool in a testers toolbelt. It is an increasingly common way to
improve software's robustness. Go has it built in to the standard library, Python has
Atheris, Java has Jazzer, JavaScript has Jazzer.js, etc. OSS-Fuzz has helped identify and
fix over 10,000 vulnerabilities and 36,000 bugs [using
fuzzing](https://google.github.io/oss-fuzz/#trophies). Ruby deserves a good fuzzer, and
improving coverage gathering would help achieve that goal.
The `Coverage` module, `TracePoint` module, and `rb_add_event_hook` function seem like
they could fulfill this goal. However, after deeper investigation, none of them fit the
exact requirements for this use-case.
# See also
-
https://bugs.ruby-lang.org/issues/20282
-
https://github.com/google/atheris
-
https://security.googleblog.com/2020/12/how-atheris-python-fuzzer-works.html
-
https://github.com/CodeIntelligenceTesting/jazzer/
-
https://www.code-intelligence.com/blog/java-fuzzing-with-jazzer
-
https://go.dev/doc/security/fuzz/
--
https://bugs.ruby-lang.org/