Re: [PATCH v4 4/7] fuzz: loop the remove minimizer and refactoring

[Alexander Bulekov <alxndr@bu.edu>]

On 201229 1240, Qiuhao Li wrote:
> Now we use a one-time scan and remove strategy in the remval minimizer,
> which is not suitable for timing dependent instructions.
> 
> For example, instruction A will indicate an address where the config
> chunk locates, and instruction B will make the configuration active. If
> we have the following instruction sequence:
> 
> ...
> A1
> B1
> A2
> B2
> ...
> 
> A2 and B2 are the actual instructions that trigger the bug.
> 
> If we scan from top to bottom, after we remove A1, the behavior of B1
> might be unknowable, including not to crash the program. But we will
> successfully remove B1 later cause A2 and B2 will crash the process
> anyway:
> 
> ...
> A1
> A2
> B2
> ...
> 
> Now one more trimming will remove A1.
> 
> In the perfect case, we would need to be able to remove A and B (or C!) at
> the same time. But for now, let's just add a loop around the minimizer.
> 
> Since we only remove instructions, this iterative algorithm is converging.
> 
> Tested with Bug 1908062.
> 
> Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com>

Small note below, but otherwise:
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>

> ---
>  scripts/oss-fuzz/minimize_qtest_trace.py | 41 +++++++++++++++---------
>  1 file changed, 26 insertions(+), 15 deletions(-)
> 
> diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py b/scripts/oss-fuzz/minimize_qtest_trace.py
> index 1a26bf5b93..378a7ccec6 100755
> --- a/scripts/oss-fuzz/minimize_qtest_trace.py
> +++ b/scripts/oss-fuzz/minimize_qtest_trace.py
> @@ -71,21 +71,9 @@ def check_if_trace_crashes(trace, path):
>      return False
>  
>  
> -def minimize_trace(inpath, outpath):
> -    global TIMEOUT
> -    with open(inpath) as f:
> -        trace = f.readlines()
> -    start = time.time()
> -    if not check_if_trace_crashes(trace, outpath):
> -        sys.exit("The input qtest trace didn't cause a crash...")
> -    end = time.time()
> -    print("Crashed in {} seconds".format(end-start))
> -    TIMEOUT = (end-start)*5
> -    print("Setting the timeout for {} seconds".format(TIMEOUT))
> -
> -    i = 0
> -    newtrace = trace[:]
> +def remove_minimizer(newtrace, outpath):

Maybe a different name for this function?
e.g. minimize_each_line or minimize_iter

-Alex

>      remove_step = 1
> +    i = 0
>      while i < len(newtrace):
>          # 1.) Try to remove lines completely and reproduce the crash.
>          # If it works, we're done.
> @@ -174,7 +162,30 @@ def minimize_trace(inpath, outpath):
>                      newtrace[i] = prior[0]
>                      del newtrace[i+1]
>          i += 1
> -    check_if_trace_crashes(newtrace, outpath)
> +
> +
> +def minimize_trace(inpath, outpath):
> +    global TIMEOUT
> +    with open(inpath) as f:
> +        trace = f.readlines()
> +    start = time.time()
> +    if not check_if_trace_crashes(trace, outpath):
> +        sys.exit("The input qtest trace didn't cause a crash...")
> +    end = time.time()
> +    print("Crashed in {} seconds".format(end-start))
> +    TIMEOUT = (end-start)*5
> +    print("Setting the timeout for {} seconds".format(TIMEOUT))
> +
> +    newtrace = trace[:]
> +
> +    # remove minimizer
> +    old_len = len(newtrace) + 1
> +    while(old_len > len(newtrace)):
> +        old_len = len(newtrace)
> +        remove_minimizer(newtrace, outpath)
> +        newtrace = list(filter(lambda s: s != "", newtrace))
> +
> +    assert(check_if_trace_crashes(newtrace, outpath))
>  
>  
>  if __name__ == '__main__':
> -- 
> 2.25.1
>