commit f7bd9700c034d80c43a040318c84d1d7682be5ac
author Fabian Meumertzheim <meumertzheim@code-intelligence.com> Tue May 04 08:52:17 2021 -0700
committer Copybara-Service <copybara-worker@google.com> Sun May 09 19:11:04 2021 -0700
tree 767fad657e620e4ac122c70c2678abf052442229
parent ec3a006e2b10743694463cf97bd3b1f802f53122

[libFuzzer] Preserve position hint in auto dictionary

Currently, the position hint of an entry in the persistent auto
dictionary is fixed to 1. As a consequence, with a 50% chance, the entry
is applied right after the first byte of the input. As the position 1
does not appear to have any particular significance, this is likely a
bug that may have been caused by confusing the constructor parameter
with a success count.

This commit resolves the issue by preserving any existing position hint
or disabling the hint if the original entry didn't have one.

Reviewed By: morehouse

Differential Revision: https://reviews.llvm.org/D101686

GitOrigin-RevId: b1048ff68298c1c4e303bbb77ca1832b2f873cd6

FuzzerMutate.cpp

diff --git a/FuzzerMutate.cpp b/FuzzerMutate.cpp
index 9854e56..4650f1b 100644
--- a/FuzzerMutate.cpp
+++ b/FuzzerMutate.cpp
@@ -480,7 +480,7 @@
     assert(DE->GetW().size());
     // Linear search is fine here as this happens seldom.
     if (!PersistentAutoDictionary.ContainsWord(DE->GetW()))
-      PersistentAutoDictionary.push_back({DE->GetW(), 1});
+      PersistentAutoDictionary.push_back(*DE);
   }
 }