doc: add a section in the fuzzing documentation about using MSan #31704

1. 
   darosior commented at 7:53 pm on January 21, 2025: member

   Just a couple lines in a subsection of the sanitizers section mentioning that using the memory sanitizer is a bit more involve than other sanitizers, describing the steps and pointing to an example.
2. doc: add a section about using MSan

   Thanks to Niklas Pieter and Michael for the pointers.

   ac6011cb85
3. 
   DrahtBot commented at 7:53 pm on January 21, 2025: contributor

   The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

   Code Coverage & Benchmarks

   For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/31704.

   Reviews

   See the guideline for information on the review process. A summary of reviews will appear here.

4. DrahtBot added the label Docs on Jan 21, 2025
5. in doc/fuzzing.md:120 in ac6011cb85

   112@@ -113,6 +113,15 @@ the qa-assets repo
   113 Patience is useful; even with improved throughput, libFuzzer may need days and
   114 10s of millions of executions to reach deep/hard targets.
   115 
   116+### Using the MemorySanitizer (MSan)
   117+
   118+MSan [requires](https://clang.llvm.org/docs/MemorySanitizer.html#handling-external-code)
   119+that all linked code be instrumented. It's necessary to compile a custom libc++ to run a Bitcoin
   120+Core fuzz target with MSan. The exact steps to achieve this may vary but involve compiling `clang`
   

   ---

   ---

   

   darosior commented at 7:55 pm on January 21, 2025:

   Is it necessary to compile clang from source to build an instrumentalized libc++? I figured probably not, but maybe building a libc++ of a given version requires the clang binary for this very version? Or maybe not required but recommended? Anyhow i kept it here as that’s what the MSan CI job does.
6. in doc/fuzzing.md:119 in ac6011cb85

   112@@ -113,6 +113,15 @@ the qa-assets repo
   113 Patience is useful; even with improved throughput, libFuzzer may need days and
   114 10s of millions of executions to reach deep/hard targets.
   115 
   116+### Using the MemorySanitizer (MSan)
   117+
   118+MSan [requires](https://clang.llvm.org/docs/MemorySanitizer.html#handling-external-code)
   119+that all linked code be instrumented. It's necessary to compile a custom libc++ to run a Bitcoin
   

   ---

   ---

   

   sipa commented at 7:58 pm on January 21, 2025:

   libc++ is the name of one implementation of the C++ standard library. I assume it works with other standard C++ library implementations (like libstdc++ as used on non-Android Linux systems) too?
7. in doc/fuzzing.md:116 in ac6011cb85

   112@@ -113,6 +113,15 @@ the qa-assets repo
   113 Patience is useful; even with improved throughput, libFuzzer may need days and
   114 10s of millions of executions to reach deep/hard targets.
   115 
   116+### Using the MemorySanitizer (MSan)
   

   ---

   ---

   

   maflcko commented at 8:12 pm on January 21, 2025:

   Wrong subsection? (This is under ## Run without sanitizers for increased throughput)
8. maflcko approved
9. 
   maflcko commented at 8:13 pm on January 21, 2025: member

   lgtm. Seems fine to add a note/pointer to the CI task.

Contributors
darosior DrahtBot sipa maflcko

Labels
Docs