Reproducing slow-unit results with autofuzz

[jtpereyda]

I've been experimenting with autofuzz, and for some targets I tend to get slow-unit results that I didn't get with my handmade harness. However, since there are so many factories involved, it's hard for me to tell how to reproduce these cases.

For a given slow-unit result, is there a way I can create a reproducer, or otherwise figure out how autofuzz was using the data?

[fmeum]

We are currently working on a feature that would generate a simple Java reproducer for Autofuzz findings.

But even with that, Autofuzz may sometimes produce slow inputs where a more targeted fuzz target would not. This is expected due to the heavy use of reflection and classpath scanning, but will hopefully improve as we stabilize the implementation.

[jtpereyda]

Thanks! Good to know about tendency to produce more slow inputs. That would probably explain the additional OOMs too.

[fmeum]

@jtpereyda While additional slow inputs are somewhat expected, additional OOMs are not. If you can share code that produces OOMs with Autofuzz, please open an issue and I will take a look.