1638787 - Change JSRT fuzzing interface to return int32 and handle timeouts

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement, P2)

Description

[Christian Holler (:decoder)]

In bug 1635762, I've adjusted libFuzzer to allow non-zero return values in its iteration function. A non-zero return value indicates that the input is "bad" and should be discarded, even if it generated additional coverage. This can for example be used to signal libFuzzer that something timed out internally. Accumulating such internal timeouts in the corpus can make the whole fuzzing process really slow over time.

With this change, JSFuzzIterate is now also expected to return an int32 compatible return value, in particular 0 for a successful execution and 1 for anything abnormal that should be discarded.

In addition, I would like to support the use of timeout() by detecting the timeout on the C++ level and returning 1 in that case. This saves the interface consumer from running their code in evaluate, catching the timeout and returning appropriately.

Comment 1

[Christian Holler (:decoder)]

Attachment: Bug 1638787 - Support return values and timeouts in JSRT fuzzing interface. r?jandem

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ecc61cf8798f
Support return values and timeouts in JSRT fuzzing interface. r=jandem

Comment 3

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/ecc61cf8798f