Method start

hail-fuzz/src/i2s/replacement.rs:180–232

(fuzzer: &mut Fuzzer)

impl I2SReplaceStage {
    fn start(fuzzer: &mut Fuzzer) -> Result<Self, StageExit> {
        let input_id = fuzzer.input_id.ok_or(StageExit::Skip)?;

        // Colorization would have just run before this stage, so the current input is the colorized
        // input.
        fuzzer.state.input.seek_to_start();
        let mut base_input = fuzzer.state.input.clone();

        Snapshot::restore_initial(fuzzer);
        let (_, comparisons) = finder::capture_comparisons(fuzzer).ok_or(StageExit::Skip)?;

        if fuzzer.debug.cmplog && fuzzer.global.is_main_instance() {
            comparisons
                .save_to_file(&fuzzer.workdir.join(format!("cmplog/{input_id}.cmplog.txt")))
                .unwrap();
            if let Some(cmplog) = fuzzer.cmplog {
                log_cmplog_data(
                    &mut fuzzer.vm,
                    cmplog,
                    &fuzzer.workdir.join(format!("cmplog/{input_id}.cmplog_raw.txt")),
                )
                .unwrap();
            }
        }

        // For all non-empty streams, extend them a bit to avoid cases where changes that we make
        // exit due to reaching the end of the input.
        for (_, stream) in &mut base_input.streams {
            if stream.bytes.len() > 8 {
                let start: usize = fuzzer.rng.gen_range(0..stream.bytes.len());
                let len: usize = fuzzer.rng.gen_range(1..=(stream.bytes.len() - start).min(32));
                stream.bytes.extend_from_within(start..start + len);
            }
        }

        let parent_prefix = match fuzzer.features.skip_prefix {
            true => crate::utils::count_parent_prefix(fuzzer, input_id, true),
            false => HashMap::default(),
        };

        Ok(I2SReplaceStage {
            comparisons,
            cursor: Position::new(fuzzer.features.strided_int_matches),
            base_input,
            parent_prefix,
            tried_matches: HashMap::new(),
            tried_replacements: HashMap::new(),
            replacement: Replacement::default(),
            total_execs: 0,
            end_icount: fuzzer.vm.cpu.icount(),
            attempted: vec![],
        })
    }

    fn next_replacement(&mut self, fuzzer: &Fuzzer) -> Option<()> {
        loop {