[libFuzzer] perform fewer crossover operations compared to plain mutations

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@247364 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/Fuzzer/FuzzerLoop.cpp b/lib/Fuzzer/FuzzerLoop.cpp
index f1802f65c37ab59e19c2353fda4ce94d824dde00..96783dac6739e488c61a3612702f1d1aabb9fd9c 100644 (file)
--- a/lib/Fuzzer/FuzzerLoop.cpp
+++ b/lib/Fuzzer/FuzzerLoop.cpp
@@ -337,23 +337,24 @@ void Fuzzer::Loop() {
       RereadOutputCorpus();
       if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
         return;
-      // First, simply mutate the unit w/o doing crosses.
       CurrentUnit = Corpus[J1];
-      MutateAndTestOne(&CurrentUnit);
-      // Now, cross with others.
-      if (Options.DoCrossOver && !Corpus[J1].empty()) {
-        for (size_t J2 = 0; J2 < Corpus.size(); J2++) {
+      // Optionally, cross with another unit.
+      if (Options.DoCrossOver && USF.GetRand().RandBool()) {
+        size_t J2 = USF.GetRand()(Corpus.size());
+        if (!Corpus[J1].empty() && !Corpus[J2].empty()) {
+          assert(!Corpus[J2].empty());
           CurrentUnit.resize(Options.MaxLen);
           size_t NewSize = USF.CrossOver(
               Corpus[J1].data(), Corpus[J1].size(), Corpus[J2].data(),
               Corpus[J2].size(), CurrentUnit.data(), CurrentUnit.size());
           assert(NewSize > 0 && "CrossOver returned empty unit");
           assert(NewSize <= (size_t)Options.MaxLen &&
-                 "CrossOver return overisized unit");
+                 "CrossOver returned overisized unit");
           CurrentUnit.resize(NewSize);
-          MutateAndTestOne(&CurrentUnit);
         }
       }
+      // Perform several mutations and runs.
+      MutateAndTestOne(&CurrentUnit);
     }
   }
 }