fuzz: accelerate non-crash detection
commit22ec0c696fd28e8978d0d64dd038eed33b974366
authorQiuhao Li <Qiuhao.Li@outlook.com>
Mon, 11 Jan 2021 06:11:46 +0000 (11 14:11 +0800)
committerThomas Huth <thuth@redhat.com>
Mon, 11 Jan 2021 13:59:21 +0000 (11 14:59 +0100)
treeabc04a882cce6617a0b2d34c40b00856155fbb1f
parent124bd3e0a894b5f18ba743084895c081ab93fc86
fuzz: accelerate non-crash detection

We spend much time waiting for the timeout program during the minimization
process until it passes a time limit. This patch hacks the CLOSED (indicates
the redirection file closed) notification in QTest's output if it doesn't
crash.

Test with quadrupled trace input at:
  https://bugs.launchpad.net/qemu/+bug/1890333/comments/1

Original version:
  real 1m37.246s
  user 0m13.069s
  sys 0m8.399s

Refined version:
  real 0m45.904s
  user 0m16.874s
  sys 0m10.042s

Note:

Sometimes the mutated or the same trace may trigger a different crash
summary (second-to-last line) but indicates the same bug. For example, Bug
1910826 [1], which will trigger a stack overflow, may output summaries
like:

SUMMARY: AddressSanitizer: stack-overflow
/home/qiuhao/hack/qemu/build/../softmmu/physmem.c:488 in
flatview_do_translate

or

SUMMARY: AddressSanitizer: stack-overflow
(/home/qiuhao/hack/qemu/build/qemu-system-i386+0x27ca049) in __asan_memcpy

Etc.

If we use the whole summary line as the token, we may be prevented from
further minimization. So in this patch, we only use the first three words
which indicate the type of crash:

SUMMARY: AddressSanitizer: stack-overflow

[1] https://bugs.launchpad.net/qemu/+bug/1910826

Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com>
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <SYCPR01MB350251DC04003450348FAF68FCAB0@SYCPR01MB3502.ausprd01.prod.outlook.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
scripts/oss-fuzz/minimize_qtest_trace.py