monitor-cov: don't keep all corpus entries in memory

Author: baflor

Dockerfile

@@ -0,0 +1,12 @@
+# Build with `podman build . -t wasm-fuzzers-wasmfuzz`
+FROM ubuntu:24.04
+RUN apt-get update && apt-get install -y rustup git clang
+RUN rustup toolchain add --no-self-update 1.90
+RUN mkdir /wasmfuzz
+COPY Cargo.toml Cargo.lock wasmfuzz/
+COPY src wasmfuzz/src/
+RUN cargo install --locked --no-default-features --path /wasmfuzz && ln -s /root/.cargo/bin/wasmfuzz /usr/bin/
+COPY wasm-fuzzers/wasmfuzz.sh /usr/bin/
+RUN chmod +x /usr/bin/wasmfuzz.sh
+RUN mkdir -p /seeds/ && echo -n "YELLOW SUBMARINE" > /seeds/seed && mkdir -p /corpus/
+ENTRYPOINT [ "wasmfuzz.sh" ]

eval/container-runner.py

@@ -311,7 +311,7 @@ async def run(self, fuzzer, env=None):
         #    tuna has ~32gb per 8 cores ( 32GB,   8 cores)
         #  alfred has 128gb per 8 cores (  2TB, 128 cores)
         # srv-23- has ~32gb per 8 cores (768GB, 192 cores)
-        fuzzer_cmd += ["--memory", "16g"]
+        fuzzer_cmd += ["--memory", "8g"]
         fuzzer_cmd += ["--network", "none"]
         fuzzer_cmd += ["--log-driver", "none"] # afl++ people say that docker's log infra causes performance issues?
         if self.core_ids:
@@ -369,8 +369,10 @@ async def run_target(target, fuzzer, config=None, num_cores=1):
         config_env = {"FUZZER_CONFIG": None, "FUZZER_CORES": str(num_cores)}
         if config is not None:
             if isinstance(config, str) and config.startswith("pass-ablation-"):
-                config_env["FUZZER_PASS_ABLATION"] = config.removeprefix("pass-ablation-")
+                pass_ = config.removeprefix("pass-ablation-")
+                config_env["FUZZER_PASS_ABLATION"] = pass_
                 config = "pass-ablation"
+                config = dict(name=f"pass-ablation-{pass_}", config=config, args=f"--experiment={config}")
             if isinstance(config, str) and fuzzer == "wasmfuzz":
                 config = dict(name=config, config=config, args=f"--experiment={config}")
             if isinstance(config, str):

src/cli/mod.rs

@@ -401,7 +401,7 @@ pub(crate) fn main() {
                 let input = std::fs::read(input_path).unwrap();
                 sess.reset_pass_coverage();
                 let start = std::time::Instant::now();
-                let res = sess.run(&input, &mut stats);
+                let res = sess.run_reusable_fresh(&input, false, &mut stats);
                 let exec_us = start.elapsed().as_micros();
                 let is_crash = res.is_crash();
                 let is_timeout = matches!(res.trap_kind, Some(TrapKind::OutOfFuel(_)));
@@ -856,9 +856,10 @@ pub(crate) fn main() {
 
             for (file_idx, file) in res.files.iter().enumerate() {
                 if let Some(file_filter) = &file_filter
-                    && !file.contains(file_filter) {
-                        continue;
-                    }
+                    && !file.contains(file_filter)
+                {
+                    continue;
+                }
                 let mut blame_lines = res
                     .map
                     .iter()

src/cli/monitor_cov.rs

@@ -5,6 +5,7 @@ use crate::{
     },
 };
 use std::{
+    hash::Hasher,
     io::Write,
     path::PathBuf,
     time::{Instant, SystemTime},
@@ -111,11 +112,15 @@ pub(crate) fn run(opts: MonitorCovOpts) {
                     if data.len() > input_size_limit {
                         continue;
                     }
-                    if !corpus.insert(data.clone()) {
+                    let data_hash = {
+                        let mut hasher = rustc_hash::FxHasher::with_seed(1234);
+                        hasher.write(&data);
+                        hasher.finish()
+                    };
+                    if !corpus.insert(data_hash) {
                         continue;
                     }
-
-                    let res = sess.run(&data, &mut Stats::default());
+                    let res = sess.run_reusable_fresh(&data, false, &mut Stats::default());
                     crashes |= res.is_crash();
                     timeout |= matches!(
                         res.trap_kind,

src/fuzzer/orc.rs

@@ -654,7 +654,9 @@ impl Orchestrator {
             return None;
         }
         drop(corp);
-        let res = self.codecov_sess.run(input, &mut Stats::new());
+        let res = self
+            .codecov_sess
+            .run_reusable_fresh(input, false, &mut Stats::new());
         if res.novel_coverage_passes.contains(&"funcs") {
             self.last_func_find = Instant::now();
         }