commit 1432992775c8b25fd623379ea6d605927b18cb3d
author Adrian Taylor <adetaylor@chromium.org> Tue Nov 14 21:16:21 2023
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Nov 14 21:16:21 2023
tree 9aeee1909b40cb74f26eda95b24763b8df8cec48
parent 2fc8622850085325ceefd34b7b5238607aa9d6a9

Display coverage even for fuzzers which fail.

Previously, we ran each fuzzer for its whole corpus in one go. This was
quick, but if the fuzzer exited due to any one input, this resulted in
us failing to write out any coverage information for the fuzzer at all.

Since some fuzzers result in crashes, this meant 122 fuzzers were
displaying no coverage.

This change detects the case where the initial bulk run results in a
crash, and then runs the fuzzer individually against each input in the
hopes that some of them don't crash.

So, how much longer will this all take?

We currently have 122 fuzzers which are erroring out. Let's assume each
case takes 0.3 seconds.

"Worst" case = 1000 test cases * 122 fuzzers * 0.3 seconds = 10 hours
longer to run the job

But let's assume that these fuzzers only have to run 400 test cases in
order to get 200 valid traces, which seems more likely.

So likely case = 400 test cases * 122 fuzzers * 0.3 seconds = 4 hours
longer to run the job

In practice, the 0.3 estimate might be wrong, we'll see.

Bug: 1498406
Change-Id: I05f272dfa658e1f4f878d0d0dea7783e40788820
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4997037
Commit-Queue: Adrian Taylor <adetaylor@chromium.org>
Reviewed-by: Bruce Dawson <brucedawson@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1224535}