Commit 55ce18cc authored by Max Moroz's avatar Max Moroz Committed by Commit Bot

[libFuzzer] Document crash minimization command.

Bug: 539572, 997940
Change-Id: Id50533d93acbd60c47cf3dd185a2d0c40d8d2149
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1776487
Commit-Queue: Max Moroz <mmoroz@chromium.org>
Reviewed-by: default avatarMartin Barbella <mbarbella@chromium.org>
Cr-Commit-Position: refs/heads/master@{#691830}
parent 91bcf117
......@@ -107,6 +107,32 @@ out/fuzz/$FUZZER_NAME -timeout=25 -rss_limit_mb=2048 -print_final_stats=1 $CORPU
Waiting for a crash to occur may take some time (up to 1hr), but if it happens,
you will be able to test the fix locally and/or somehow debug the issue.
## Minimizing a crash input (optional)
ClusterFuzz does crash input minimization automatically, and a typical crash
report has two testcases available for downloading:
* An original testcase that has triggered the crash;
* A minimized testcase that is smaller than the original but triggers the same
crash.
If you would like to further minimize a testcase, run the fuzz target with the
two additional arguments:
* `-minimize_crash=1`
* `-exact_artifact_path=<output_filename_for_minimized_testcase>`
The full command would be:
```
out/fuzz/$FUZZER_NAME -minimize_crash=1 -exact_artifact_path=<minimized_testcase_path> $TESTCASE_PATH
```
This might be useful for large testcases that make it hard to identify a root
cause of a crash. You can leave the minimization running locally for a while
(e.g. overnight) for better results.
[ClusterFuzz Reproduce Tool]: https://github.com/google/clusterfuzz-tools
[File a bug]: https://bugs.chromium.org/p/chromium/issues/entry?component=Tools%3EStability%3ElibFuzzer&comment=What%20problem%20are%20you%20seeing
[here]: getting_started.md#symbolize-stacktrace
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment