From: Roland Shoemaker Date: Wed, 16 Jun 2021 18:10:17 +0000 (-0700) Subject: [dev.fuzz] testing: capture coverage even if tRunner failed X-Git-Tag: go1.18beta1~1282^2~37 X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=df99a270b36fe9f0b8bd43ba05e305fa738d2de6;p=gostls13.git [dev.fuzz] testing: capture coverage even if tRunner failed Call SnapshotCoverage when the fuzzFn panics, or t.Fatal(f) is called. We currently don't use this coverage for anything, but it is necessary to allow the coordinator to continue when loading a corpus that contains an input that causes crashes. We will also probably want this behavior once we allow the fuzzer to continue after finding a crasher, since the input used to find one crasher may be a useful input for further mutation. Fixes #46633 Change-Id: I40ed5440c88fa354d90a4ff4ae2bf8a19bf3254f Reviewed-on: https://go-review.googlesource.com/c/go/+/328650 Trust: Roland Shoemaker Trust: Katie Hockman Run-TryBot: Roland Shoemaker TryBot-Result: Go Bot Reviewed-by: Katie Hockman Reviewed-by: Jay Conrod --- diff --git a/src/testing/fuzz.go b/src/testing/fuzz.go index b4c1ffcdd5..fc1212b142 100644 --- a/src/testing/fuzz.go +++ b/src/testing/fuzz.go @@ -354,9 +354,13 @@ func (f *F) Fuzz(ff interface{}) { for _, v := range e.Values { args = append(args, reflect.ValueOf(v)) } + // Before reseting the current coverage, defer the snapshot so that we + // make sure it is called right before the tRunner function exits, + // regardless of whether it was executed cleanly, panicked, or if the + // fuzzFn called t.Fatal. + defer f.fuzzContext.snapshotCoverage() f.fuzzContext.resetCoverage() fn.Call(args) - f.fuzzContext.snapshotCoverage() }) <-t.signal f.inFuzzFn = false