Function respawn_libfuzzer_process

src/program/libfuzzer.rs:607–651

save the incident and respawn the libfuzzer

(fuzzer_dir: &Path, executor: &Executor)

/// save the incident and respawn the libfuzzer
pub fn respawn_libfuzzer_process(fuzzer_dir: &Path, executor: &Executor) -> Result<Child> {
    static ERROR_COUNT: OnceCell<RwLock<HashMap<u16, usize>>> = OnceCell::new();

    let fuzzer = get_fuzzer_path(fuzzer_dir);
    let fuzz_log = get_fuzzer_log(fuzzer_dir);

    let artifact =
        parse_artifact_from_log(&fuzz_log).context(format!("parse artifact fail: {fuzz_log:?}"))?;

    if let Some(driver_id) = parse_driver_id(&artifact) {
        log::info!("Found an error happened in driver: {driver_id}");

        // if this driver error many times
        let err_count = {
            let error_count_map_guard = ERROR_COUNT.get_or_init(|| RwLock::new(HashMap::new())).read().unwrap();
            if let Some(value) = error_count_map_guard.get(&driver_id) {
                *value
            } else {
                1
            }
        };

        if let Ok(mut error_count_map_guard) = ERROR_COUNT.get_or_init(|| RwLock::new(HashMap::new())).write() {
            *error_count_map_guard.entry(driver_id).or_default() += 1;
        }

        let incident_dir = get_incident_dir(fuzzer_dir, driver_id);
        save_the_incident(fuzzer_dir, &incident_dir, &artifact, None)?;

        if is_incident_reproducible(&incident_dir, &executor.deopt)? || err_count > 5 {
            let fuzz_code: PathBuf = get_fuzzer_path(fuzzer_dir).with_extension("cc");
            mask_driver_from_fuzzer(&fuzz_code, driver_id)?;
            executor.compile_lib_fuzzers(fuzzer_dir, &fuzzer, crate::execution::Compile::FUZZER)?;
        } else {
            std::fs::remove_dir_all(incident_dir)?;
        }
        log::warn!("{fuzzer_dir:?} found an error with id `{driver_id}` and re-execute");
    }

    let corpus: PathBuf = [fuzzer_dir.to_path_buf(), "corpus".into()].iter().collect();
    let child = executor.spawn_libfuzzer(&fuzzer, &corpus).context(format!(
        "Fail to spawn libfuzzer process: {fuzzer:?} on {corpus:?}"
    ))?;
    Ok(child)
}

pub mod sanitize_crash {
    use std::{collections::HashSet, ffi::OsStr};