You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
Met a use case in which I have multiple existing mutational stages, and I want to catch/hook every mutated and crashing seed before it's directly added into the solution corpus, such as doing some calibration/minimization of the crashing seed first, which requires the executor to execute the seed more times.
Describe the solution you'd like
When existing mutational stages meet a crashing seed, it directly goes through observers/feedbacks and into the solution corpus. What if there could be a mechanism/stage (controlled by the user and combined with existing stages) to not only observe but re-execute it before adding into the corpus, such as minimization of the seed?
Maybe a "tree" structure for stages (or observer/feedback with executor) is for this scenario?
Describe alternatives you've considered
In the current design, having another separate stage to grab testcases from the solution corpus and do the calibration can achieve the similar goal. So not sure how necessary it is to change how much of the current structure.
The text was updated successfully, but these errors were encountered:
In general this seems like a useful thing to have.
One thing to keep in mind: For the InProcessExecutor a crash means that it will restart the fuzzer, and reload the current state - so we'll need to track the current action in the state before exiting. It could become complicated.
Maybe it's easier to add to the corpus, then, on restart, run the solutions calibration state first, keeping process in the metadata between restarts (and potentially remove them from the solutions corpus eventually)
Is your feature request related to a problem? Please describe.
Met a use case in which I have multiple existing mutational stages, and I want to catch/hook every mutated and crashing seed before it's directly added into the solution corpus, such as doing some calibration/minimization of the crashing seed first, which requires the executor to execute the seed more times.
Describe the solution you'd like
When existing mutational stages meet a crashing seed, it directly goes through observers/feedbacks and into the solution corpus. What if there could be a mechanism/stage (controlled by the user and combined with existing stages) to not only observe but re-execute it before adding into the corpus, such as minimization of the seed?
Maybe a "tree" structure for stages (or observer/feedback with executor) is for this scenario?
Describe alternatives you've considered
In the current design, having another separate stage to grab testcases from the solution corpus and do the calibration can achieve the similar goal. So not sure how necessary it is to change how much of the current structure.
The text was updated successfully, but these errors were encountered: