jazzer
jazzer copied to clipboard
Hierarchically budget fuzzer bytes with Autofuzz
Currently, whenever Autofuzz needs to decide how many bytes from the fuzzer input to spend on the construction of an object, it uses half of the remaining bytes. While this ensures that primitives with non-trivial values can be generated with arbitrarily many nested object constructions, this strategy does not make good use of the fuzzer input in the case of flat call graphs (e.g. a foo(String, int) method). Experiments show that ignoring half of the fuzzer input hurts efficiency quite a bit.
This commit switches to a new strategy that hierarchically assigns a "budget" for every consume or autofuzz call:
- Every call to consume or autofuzz is allocated a fraction of the remaining bytes and assigns equal parts of this budget to the recursive invocations it makes.
- By constructing the objects that consume a bounded number of bytes first in autofuzz, the remaining budget for an autofuzz invocation can be evenly distributed among the variable-length objects without risking that primitive arguments are forced to trivial values.