[compiler-rt] b1048ff - [libFuzzer] Preserve position hint in auto dictionary

[Matt Morehouse via llvm-commits]

Author: Fabian Meumertzheim
Date: 2021-05-04T09:06:51-07:00
New Revision: b1048ff68298c1c4e303bbb77ca1832b2f873cd6

URL: https://github.com/llvm/llvm-project/commit/b1048ff68298c1c4e303bbb77ca1832b2f873cd6
DIFF: https://github.com/llvm/llvm-project/commit/b1048ff68298c1c4e303bbb77ca1832b2f873cd6.diff

LOG: [libFuzzer] Preserve position hint in auto dictionary

Currently, the position hint of an entry in the persistent auto
dictionary is fixed to 1. As a consequence, with a 50% chance, the entry
is applied right after the first byte of the input. As the position 1
does not appear to have any particular significance, this is likely a
bug that may have been caused by confusing the constructor parameter
with a success count.

This commit resolves the issue by preserving any existing position hint
or disabling the hint if the original entry didn't have one.

Reviewed By: morehouse

Differential Revision: https://reviews.llvm.org/D101686

Added: 
    

Modified: 
    compiler-rt/lib/fuzzer/FuzzerMutate.cpp

Removed: 
    


################################################################################
diff  --git a/compiler-rt/lib/fuzzer/FuzzerMutate.cpp b/compiler-rt/lib/fuzzer/FuzzerMutate.cpp
index 9854e56bb804b..4650f1beceacd 100644
--- a/compiler-rt/lib/fuzzer/FuzzerMutate.cpp
+++ b/compiler-rt/lib/fuzzer/FuzzerMutate.cpp
@@ -480,7 +480,7 @@ void MutationDispatcher::RecordSuccessfulMutationSequence() {
     assert(DE->GetW().size());
     // Linear search is fine here as this happens seldom.
     if (!PersistentAutoDictionary.ContainsWord(DE->GetW()))
-      PersistentAutoDictionary.push_back({DE->GetW(), 1});
+      PersistentAutoDictionary.push_back(*DE);
   }
 }