cmd/go: fuzz crash minimizer should try deleting, rewriting input bytes

[rsc]

The fuzzer found a crash in a package I'm working on:

go test fuzz v1
string("--\xd6M\x8b<!---->")

I can manually minimize this input further by just doing a trial deletion of each byte, keeping each deletion only if it preserves the crash (not the exact panic message, because slice bounds are changing while remaining invalid, but the fact of a crash). This reduces the input to:

string("M\x8b<!---->")

Then I can change each input byte to an A, one at a time, keeping the crashes. This simplifies to:

string("AA<!---->")

which appears to be the simplest possible (and more readable) form of this crasher.

What I did, the crash minimizer should be able to do. It will result in more ASCII-only crashes. I would suggest for the input byte rewriting to have a priority list ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~ trying letters, digit, space, and finally punctuation for each byte, stopping at the first one that preserves the crash. The letters could be thinned out and the punctuation elided if this is too much. Even ABCXYZabcxyz012789 would be fine.

/cc @jayconrod @katiehockman

[rsc]

Another good possibility for simplifcation would be seeing if setting x[i] = x[i-1] preserves the crash. The minimizer did a good job cutting "�6206b&#Xca0cabD06b&#XD00cabD06\n" down to "�", but then it could have tried that rule and ended at "�".

[katiehockman]

I'm going to remove the release-blocker label for this one. @rsc LMK if you disagree strongly.

This sounds like an improvement to the minimizer, rather than a bug. Although I definitely agree this is an improvement worth doing, I am trying to trim down the release-blocking work as much as possible and limit it only to features that are essential for the UX and for bugs.
(fwiw we may very well still get to this before 1.18)

[gopherbot]

Change https://golang.org/cl/352614 mentions this issue: internal/fuzz: minimize str to be human readable

[ameowlia]

Hi all,

I submitted an algorithm for this where the minimizer tries to replace every character with a "0". If that doesn't work, then it tries to replace each letter with "a", each symbol with "$", and each punctuation with ".".

❓ @rsc - I would like to run this against the same test you were referencing above. Do you mind sharing the test code you were using if you still have it?

Thanks!