fuzzing infinite mode #22901
Description
Related:
- introduce --fuzz=<limit> to make tests pass after a certain quantity of fuzz testing has completed #22900
- fuzzing: support more than one executable at once #20988
In infinite mode, the fuzzer has a priority system, which is the same priority system used with time based fuzzing from #22900. The priority system is based on doing fuzzing in batches and measuring a heuristic called "productivity". This is intended to be a measure of how much progress the fuzzer is making in terms of code coverage, regardless of whether or not it has found any bugs.
Available fuzz tests are sorted by "productivity" and then by accumulated iteration count.
Infinite mode is also interactive via the web interface - in addition to observing code coverage change in real time, the user can influence the priorities, and even make input mutation tweaks.