[libFuzzer] make sure CheckExitOnSrcPosOrItem is called after the new input is saved to the corpus
git-svn-id: svn://svn.chromium.org/llvm-project/llvm/trunk/lib/Fuzzer@308653 0b72dbe1-c17f-4bc7-b9db-2b4152be0356
diff --git a/FuzzerLoop.cpp b/FuzzerLoop.cpp
index 37adb1e..ba4ba80 100644
--- a/FuzzerLoop.cpp
+++ b/FuzzerLoop.cpp
@@ -344,8 +344,10 @@
if (U.size() > MaxSize)
U.resize(MaxSize);
if (!Corpus.HasUnit(U)) {
- if (RunOne(U.data(), U.size()))
+ if (RunOne(U.data(), U.size())) {
+ CheckExitOnSrcPosOrItem();
Reloaded = true;
+ }
}
}
if (Reloaded)
@@ -371,6 +373,7 @@
for (const auto &U : *InitialCorpus) {
RunOne(U.data(), U.size());
+ CheckExitOnSrcPosOrItem();
TryDetectingAMemoryLeak(U.data(), U.size(),
/*DuringInitialCorpusExecution*/ true);
}
@@ -418,14 +421,12 @@
if (NumNewFeatures) {
Corpus.AddToCorpus({Data, Data + Size}, NumNewFeatures, MayDeleteFile,
UniqFeatureSetTmp);
- CheckExitOnSrcPosOrItem();
return true;
}
if (II && FoundUniqFeaturesOfII &&
FoundUniqFeaturesOfII == II->UniqFeatureSet.size() &&
II->U.size() > Size) {
Corpus.Replace(II, {Data, Data + Size});
- CheckExitOnSrcPosOrItem();
return true;
}
return false;
@@ -527,6 +528,7 @@
WriteToOutputCorpus(U);
NumberOfNewUnitsAdded++;
TPC.PrintNewPCs();
+ CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus.
}
// Tries detecting a memory leak on the particular input that we have just
diff --git a/test/reduce_inputs.test b/test/reduce_inputs.test
index 833b1cc..77a5f5f 100644
--- a/test/reduce_inputs.test
+++ b/test/reduce_inputs.test
@@ -7,7 +7,7 @@
# Test that reduce_inputs deletes redundant files in the corpus.
RUN: LLVMFuzzer-ShrinkControlFlowSimpleTest -runs=0 %t/C 2>&1 | FileCheck %s --check-prefix=COUNT
-COUNT: READ units: 3
+COUNT: READ units: 4
# a bit longer test
RUN: LLVMFuzzer-ShrinkControlFlowTest -exit_on_item=0eb8e4ed029b774d80f2b66408203801cb982a60 -seed=1 -runs=1000000 2>&1 | FileCheck %s
