Function get_stream_weights

hail-fuzz/src/utils.rs:174–210

Assign weights that control often each stream is mutated based on on the colorization rate. This avoids spending effort on mutating streams that have little to zero impact on the path of the input.

(
    fuzzer: &mut Fuzzer,
    id: usize,
    streams: &[(StreamKey, usize)],
)

/// This avoids spending effort on mutating streams that have little to zero impact on the path of
/// the input.
pub(crate) fn get_stream_weights(
    fuzzer: &mut Fuzzer,
    id: usize,
    streams: &[(StreamKey, usize)],
) -> rand_distr::WeightedAliasIndex<f64> {
    // Currently even streams that are impactful often have a very high colorization rate, this can
    // occur when a 32-bit read performed but only the low 8 are used. Currently we only adjust
    // the mutation probability of fully colorized streams.
    const COLORIZATION_THRESHOLD: f64 = 0.99;

    let color =
        fuzzer.corpus[id].stage_data::<hashbrown::HashMap<StreamKey, usize>>(Stage::Colorization);
    let colorization_rates: Vec<_> = streams
        .iter()
        .map(|(key, len)| {
            color
                .get(key)
                .map_or(1.0, |x| *x as f64 / *len.min(&fuzzer.features.max_i2s_bytes) as f64)
        })
        .collect();
    let weights = colorization_rates
        .into_iter()
        .map(|x| if x > COLORIZATION_THRESHOLD { 0.01 } else { 1.0 })
        .collect();

    // We could adjust the weights such that streams with higher colorization rates are
    // mutated more often, however because of oversized reads, interesting data often has a higher
    // than expected colorization rate.
    //
    // let min_rate = *colorization_rates.iter().min_by(|a, b| a.total_cmp(b)).unwrap_or(&0.0);
    // let weights = colorization_rates
    //     .into_iter()
    //     .map(|x| (1.0 - (x - min_rate) / (1.0 - min_rate)).max(0.01))
    //     .collect();

    rand_distr::WeightedAliasIndex::new(weights).unwrap()
}

pub fn rand_pow2<R: Rng>(mut rng: R, log2_max: u32) -> u64 {
    2_f32.powf(1.0 + (rng.gen::<f32>() * (log2_max as f32 - 1.0))).floor() as u64