add --capture rllvm as an alternative to gllvm

[h1994st]

Hi @vanhauser-thc ,

I came across fuzz-reachability while fixing some Grammar-Mutator issues. These days I maintain rllvm, a successor to gllvm and wllvm, which are no longer actively maintained. Besides C/C++, it also captures Rust and mixed C/C++/Rust builds, and support WebAssembly and eBPF.

This PR adds rllvm as an opt-in --capture rllvm; gllvm stays the default.

• Same results. Reachable and unreachable sets are identical to gllvm's on the C/C++ and Rust fixtures and on libxml2.
• One build for every language. For Rust and mixed targets, rllvm wraps rustc as well, and one extraction from the linked fuzz binary replaces the separate Rust collection and the llvm-link merge.
• More precise for Rust harnesses. The current Rust collection also merges crates that only run at build time (syn, proc_macro2, cc, ...), and type matching then connects them to the harness. Taking the bitcode from the linked binary leaves them out: on the url crate's cargo-fuzz target, 6746 reachable of 6748 defined instead of 12661 of 18149.

My rllvm-query does something related: source-level queries such as callers, callees and reachability over the captured bitcode. It only follows call edges it can prove, so your type-based indirect-call resolution complements it nicely. I also looked at SVF for indirect calls, but it was too slow and expensive, and I saw you dropped it here too.

It needs rllvm 0.7.1 or newer, which REACHABILITY_CAPTURE=rllvm bash scripts/setup.sh installs. Happy to adjust anything. Thanks for the tool!

---

Details

What changes:

• C/C++: rllvm-cc/rllvm-cxx replace gclang/gclang++, with the same pinned toolchain and bitcode-only -O0 -fno-inline flags.
• Rust, mixed and the harness types: one build with rustc wrapped by rllvm-rustc (plus CC/CXX for mixed), then one extraction from the linked artifact.
• The artifact search skips cargo's deps/, build/ and incremental/ copies and also looks in a workspace's target directory.
• setup.sh installs rllvm via Homebrew or cargo, and the docs cover all of it.

Validation:

• Identical sets on all C/C++ fixtures, rust_main, rust_dyn, rust_generic, mixed_c_rust, and libxml2 2.9.2 with --static-libs auto (1903 reachable, 1133 unreachable).

• The test suite gives the same results under both captures (REACHABILITY_CAPTURE=rllvm).

• The build-time crates on url:

  git clone --depth 1 https://github.com/servo/rust-url && cd rust-url/url
  reachability run --project . --lang libfuzzer --build-cmd 'cargo +nightly fuzz build parse'
  jq -r '.reachable[].demangled' reachability.json | grep -c 'syn::'   # 2709
  reachability run --project . --lang libfuzzer --build-cmd 'cargo +nightly fuzz build parse' --capture rllvm
  jq -r '.reachable[].demangled' reachability.json | grep -c 'syn::'   # 0

  Nothing is lost the other way: every function the fuzz binary defines, apart from the prebuilt std and libFuzzer's C++, is in the rllvm bitcode.

[vanhauser-thc]

Hi!
sure, why not! I do not like gllvm much, so at some point moving completely over to rllvm would be fine with me once this is stable.
can it be merged?

[h1994st]

@vanhauser-thc Yes, this PR is ready for merge. Thanks!

Feel free to let me know if you see any issues against rllvm while use it with fuzz-reachability.