Method start

hail-fuzz/src/extension.rs:53–107

(fuzzer: &mut Fuzzer)

impl MultiStreamExtendStage {
    fn start(fuzzer: &mut Fuzzer) -> Result<Self, StageExit> {
        fuzzer.copy_current_input();

        let mut attempts = calculate_energy(fuzzer) as usize;

        let last_read = Self::crate_snapshot_after(fuzzer, 0)?;
        let mut end_addrs = HashSet::new();
        end_addrs.insert(fuzzer.vm.cpu.read_pc());

        let mut streams_to_mutate = hashbrown::HashMap::new();

        let factor = fuzzer.get_extension_factor(last_read);
        streams_to_mutate.insert(last_read, factor);

        // @todo: consider adjusting the energy for inputs with a long initial execution time,
        // reducing the amount of times this input is scheduled proportionally.

        let log2_max_extensions = log2_max_extensions(fuzzer);
        let extension_limit = extension_limit(fuzzer);

        let is_first_attempt = fuzzer
            .input_id
            .map(|id| fuzzer.corpus[id].metadata.length_extension_rounds == 0)
            .unwrap_or(true);
        if is_first_attempt {
            attempts *= config::INCREASE_EXTENSIONS_ON_FIRST_EXEC_FACTOR;
        }

        tracing::debug!(
            "[{}] {last_read:#x}@{:#x} (factor={factor}, max extensions={}, limit={extension_limit}) len={}, attempts={attempts}, icount={}",
            fuzzer.input_id.unwrap_or(0),
            fuzzer.vm.cpu.read_pc(),
            2_u32.pow(log2_max_extensions),
            fuzzer.state.input.total_bytes(),
            fuzzer.state.instructions,
        );
        if let Some(id) = fuzzer.input_id {
            fuzzer.corpus[id].metadata.length_extension_rounds += 1;
        }

        Ok(Self {
            current_input: fuzzer.state.input.clone(),
            local_depth: 1,
            log2_max_extensions,
            extension_limit,
            new_starting_inputs: VecDeque::new(),
            rare_input: None,
            i2s_data: None,
            i2s_replacement_attempts: 0,
            end_addrs,
            streams_to_mutate,
            energy: attempts,
            attempts,
        })
    }

    fn exec_one(&mut self, fuzzer: &mut Fuzzer) -> Option<VmExit> {
        Snapshot::restore_prefix(fuzzer);