Re: Finding regression ranges for a fuzz bug?

On 6/18/18 11:00 PM, Jason Kratzer wrote:
> Emilio,
> 
> There are plans on implementing automatic bisection as part of the 
> browser fuzzing process.  Currently we use autobisect which leverages 
> ffpuppet and taskcluster to reduce the build range.
> 
> https://github.com/MozillaSecurity/autobisect
> 
> There's still a few bugs that I'd like to iron out but really the only 
> thing left to do is automate bisection as bugs come in.  If I get time I 
> may try to implement this next quarter.

Oh, that's awesome to know \o/. Looking forward to it :)

Thanks!

  -- Emilio

> Regards
> 
> 
> On Mon, Jun 18, 2018, 3:12 PM Emilio Cobos Álvarez <[email protected] 
> <mailto:[email protected]>> wrote:
> 
>     Hi Fuzzing Team,
> 
>     One of the things I'd appreciate the most from fuzzing bugs is a
>     regression range (the other is a reduced test-case, but we already get
>     that, which is amazing :P).
> 
>     Anyway, sometimes I can guess the regression range from the kind of
>     assertion / crash, or look at the test-case and do an educated guess
>     after looking at the bug. Sometimes if I don't see any obvious offender
>     I run mozregression --debug manually.
> 
>     Is there any plan to automate this process? It'd be really nice IMO,
>     specially in terms of prioritizing them, or finding someone to work
>     on a
>     given bug, and IIRC the JS fuzzers do have something like this. Would
>     there be any obvious blockers for this other than "it's work that
>     someone needs to do"? If not I'd be happy to help out :).
> 
>     I've cc'd the layout people in case they have further thoughts on it.
> 
>     Thanks for all the work you do, it's amazing!
> 
>        -- Emilio
> 
_______________________________________________
dev-tech-layout mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-tech-layout