v0.9.0 already carries the ifcopenshell::file rename this harness was
originally adapted for, but moved Logger into the ifcopenshell namespace
too (logger::root() -> ifcopenshell::logger::root()) and never had a
BUILD_ONLY_COMMON_SCHEMAS cmake option - schema selection there has always
been via the SCHEMA_VERSIONS list. Verified with -fsyntax-only against the
system-installed v0.9.0 headers.
Logger::SetOutput was never called by the harness, so every parse
warning/error (e.g. "Overwriting instance with name #N") was silently
discarded. This directly cost time root-causing a leak: grepping stdout
for an expected warning found nothing, looking like it ruled out a
hypothesis that was actually correct, because the message was just never
printed anywhere.
Only enable it when the binary is given an explicit file argument
(single-input repro, e.g. `-runs=1 <file>`), not during a real campaign
against a corpus directory, where logging on every execution would
dominate the runtime. Verified with -fsyntax-only against this branch's
headers (a real CMake build of ifcviewer-wgpu wasn't attempted, same as
the harness's prior namespace-rename commit).
Generated with the assistance of an AI coding tool.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
ifcviewer-wgpu renamed IfcParse::IfcFile to ifcopenshell::file (header
moved to ifcparse/file.h) and Base::toString to Base::to_string. Update
the harness and README to match; verified with a syntax-only compile
against this branch's headers.
Construction of IfcFile already tokenizes, type-checks, and resolves
every attribute of every instance, so toString() isn't what makes
tokenizer/argument bugs reachable.
A coverage-guided libFuzzer harness (src/ifcfuzz/ifcparse_fuzzer.cpp) that
constructs IfcFile directly from in-memory input and calls toString() on
every parsed instance to force full lazy attribute evaluation, rather than
only observing IfcConvert's exit code from a fuzzed subprocess.
Gated behind a new BUILD_FUZZERS option (OFF by default) so it has no
effect on existing builds; enabling it requires a Clang toolchain built
with -fsanitize=fuzzer. -fsanitize=fuzzer itself stays scoped to the one
new target rather than going into the global compiler flags, since it
supplies its own main() and would otherwise break every other target
including CMake's own compiler checks.
Already found and fixed three real bugs this way: two null-pointer
dereferences (in header parsing and reference resolution) and a leak of
IfcSpfLexer on early return/exception during file scanning.
See src/ifcfuzz/README.md for build and usage instructions.
Bruno Postle