When a fuzz test crashes, it now gets rerun with the fuzzer attempting to minimize the crashing input. After an amount of time with no improvements, both the reduced and original crash are saved.
Details
The fuzzer now has a special reduce mode where one test is run with an input which is mutated with the goal of shorting its length. In order to effectively mutate the input, metadata on its contents are stored in another memory-mapped file which is recovered when the instance crashes. The test is run indefinitely until it either crashes or is killed by the build runner.
When a normal fuzz test crashes, the build runner saves the original crash, as before, then restarts each instance and sends them the crashing input and metadata. When they crash, it is checked if their input was shorter than the current one, and if so every instance is restarted, otherwise just the crashing instance is. Once a fixed timeout of eight seconds has been reached without an improvement, the reduced crash is saved.
The allocation of memory mapped files has also been simplified, with the build runner now selecting which index the test runner will use instead of them being scanned through. Additionally, when there are multiple run steps with fuzz tests, the number of instances each gets is now distributed based on the maximum number of jobs.
When a fuzz test crashes, it now gets rerun with the fuzzer attempting to minimize the crashing input. After an amount of time with no improvements, both the reduced and original crash are saved.
## Details
The fuzzer now has a special reduce mode where one test is run with an input which is mutated with the goal of shorting its length. In order to effectively mutate the input, metadata on its contents are stored in another memory-mapped file which is recovered when the instance crashes. The test is run indefinitely until it either crashes or is killed by the build runner.
When a normal fuzz test crashes, the build runner saves the original crash, as before, then restarts each instance and sends them the crashing input and metadata. When they crash, it is checked if their input was shorter than the current one, and if so every instance is restarted, otherwise just the crashing instance is. Once a fixed timeout of eight seconds has been reached without an improvement, the reduced crash is saved.
The allocation of memory mapped files has also been simplified, with the build runner now selecting which index the test runner will use instead of them being scanned through. Additionally, when there are multiple run steps with fuzz tests, the number of instances each gets is now distributed based on the maximum number of jobs.