{"action":"opened","issue":{"url":"https://api.github.com/repos/ethereum/solidity/issues/7249","repository_url":"https://api.github.com/repos/ethereum/solidity","labels_url":"https://api.github.com/repos/ethereum/solidity/issues/7249/labels{/name}","comments_url":"https://api.github.com/repos/ethereum/solidity/issues/7249/comments","events_url":"https://api.github.com/repos/ethereum/solidity/issues/7249/events","html_url":"https://github.com/ethereum/solidity/issues/7249","id":480598879,"node_id":"MDU6SXNzdWU0ODA1OTg4Nzk=","number":7249,"title":"[ossfuzz] build instrumentation can do without instrumented dependencies","user":{"login":"bshastry","id":2388185,"node_id":"MDQ6VXNlcjIzODgxODU=","avatar_url":"https://avatars1.githubusercontent.com/u/2388185?v=4","gravatar_id":"","url":"https://api.github.com/users/bshastry","html_url":"https://github.com/bshastry","followers_url":"https://api.github.com/users/bshastry/followers","following_url":"https://api.github.com/users/bshastry/following{/other_user}","gists_url":"https://api.github.com/users/bshastry/gists{/gist_id}","starred_url":"https://api.github.com/users/bshastry/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bshastry/subscriptions","organizations_url":"https://api.github.com/users/bshastry/orgs","repos_url":"https://api.github.com/users/bshastry/repos","events_url":"https://api.github.com/users/bshastry/events{/privacy}","received_events_url":"https://api.github.com/users/bshastry/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-08-14T10:21:17Z","updated_at":"2019-08-14T10:21:17Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"## Abstract\r\n\r\nCurrently, the following solidity (fuzzing) dependencies are instrumented (either by address or undefined behavior sanitizer)\r\n  - boost\r\n  - evmone\r\n  - intx\r\n  - ethash\r\n\r\nThis has the following negatives\r\n  - slower build\r\n  - slower fuzzing due to additional run time overhead (e.g., asan checks whether each load/store is within bounds) due to instrumented dependencies\r\n  - bugs in dependencies get reported to us instead of their respective maintainers\r\n\r\nSince we make use of (fixed) versioned dependencies, their building may instead be moved to the dockerfile where they will be build once and cached (in the resulting docker image).\r\n\r\n## Motivation\r\n\r\nThis will need to be fixed in the `build.sh` script located here (so a PR to google/oss-fuzz repo is required)\r\n\r\nhttps://github.com/google/oss-fuzz/blob/48f321e93939354788fa7a0e1e41c5843b069ad5/projects/solidity/build.sh#L18-L51\r\n\r\n## Specification\r\n\r\nNA\r\n\r\n## Backwards Compatibility\r\n\r\nNA"}}
{"actor":{"display_login":"bshastry"}}