internal/fuzz: compute correct number of mutations

When reconstructing inputs, we miscalculated the number of mutations
that needed to be applied. If the count%chainedMutation == 0 we would
apply 0 mutations, when we should actually be applying chainedMutation
mutations, due to how count is incremented.

Fixes #49047

Change-Id: I76773bff0afd6dfd40deafc317be095da995ecc5
Reviewed-on: https://go-review.googlesource.com/c/go/+/365294
Trust: Roland Shoemaker <roland@golang.org>
Trust: Katie Hockman <katie@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
Run-TryBot: Katie Hockman <katie@golang.org>
Reviewed-by: Bryan C. Mills <bcmills@google.com>
Reviewed-by: Katie Hockman <katie@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>

diff --git a/src/cmd/go/testdata/script/test_fuzz_mutator_repeat.txt b/src/cmd/go/testdata/script/test_fuzz_mutator_repeat.txt
index 5b1e26be24a3ff95c3481868cbc6dc3445d77e76..3764dcb9157a7fd86ac617abd67f8e83c7b90dd7 100644 (file)
--- a/src/cmd/go/testdata/script/test_fuzz_mutator_repeat.txt
+++ b/src/cmd/go/testdata/script/test_fuzz_mutator_repeat.txt
@@ -1,5 +1,3 @@
-skip  # https://golang.org/issue/49047
-
 # TODO(jayconrod): support shared memory on more platforms.
 [!darwin] [!linux] [!windows] skip
 

diff --git a/src/internal/fuzz/worker.go b/src/internal/fuzz/worker.go
index e7d824bea197f35c9ae028db320996194c2d39bc..5be49d28f9832e0c73974f1dfabe369a752bc03e 100644 (file)
--- a/src/internal/fuzz/worker.go
+++ b/src/internal/fuzz/worker.go
@@ -1111,7 +1111,8 @@ func (wc *workerClient) fuzz(ctx context.Context, entryIn CorpusEntry, args fuzz
                wc.m.r.restore(mem.header().randState, mem.header().randInc)
                if !args.Warmup {
                        // Only mutate the valuesOut if fuzzing actually occurred.
-                       for i := int64(0); i < resp.Count%chainedMutations; i++ {
+                       numMutations := ((resp.Count - 1) % chainedMutations) + 1
+                       for i := int64(0); i < numMutations; i++ {
                                wc.m.mutate(valuesOut, cap(mem.valueRef()))
                        }
                }