"--timeout=..." is now a native Jazzer.js flag

Author: oetr

docs/fuzz-settings.md

@@ -55,18 +55,16 @@ npx jazzer fuzzTarget -- -use_value_profile=1
 ## Timeout
 
 Invocations of fuzz targets, which take longer than the configured timeout, will
-cause fuzzing to stop and a timeout finding to be reported. This feature is
-directly provided by the underlying fuzzing engine, libFuzzer.
-
-A [default timeout](https://www.llvm.org/docs/LibFuzzer.html#output) of 1200
-seconds is preconfigured, but can be changed using the `-timeout` fuzzer flag.
+cause fuzzing to stop and a timeout finding to be reported. A default timeout of
+5000 milliseconds is preconfigured, but can be changed using the `--timeout`
+fuzzer flag.
 
 Timeouts work in the sync- and asynchronous fuzzing mode.
 
 **Example invocation:**
 
 ```shell
-npx jazzer fuzzTarget -- -timeout=10
+npx jazzer fuzzTarget --timeout=10000
 ```
 
 **Example output:**

docs/jest-integration.md

@@ -327,4 +327,3 @@ reimplemented.
 
 - Mock functions
 - Isolated workers
-- Test-based timeouts (third parameter to `test` functions)

examples/jest_integration/integration.fuzz.js

@@ -24,6 +24,22 @@ describe("My describe", () => {
 		target.fuzzMe(data);
 	});
 
+	it.fuzz(
+		"My fuzz test with an explicit timeout (async)",
+		async (data) => {
+			target.fuzzMe(data);
+		},
+		1000
+	);
+
+	it.fuzz(
+		"My fuzz test with an explicit timeout (sync)",
+		(data) => {
+			target.fuzzMe(data);
+		},
+		1000
+	);
+
 	it.fuzz("My callback fuzz test", (data, done) => {
 		target.callbackFuzzMe(data, done);
 	});

examples/jest_integration/integration.fuzz/My_describe/My_fuzz_test_with_an_explicit_timeout_(async)/test

@@ -0,0 +1 @@
+test

examples/jest_integration/integration.fuzz/My_describe/My_fuzz_test_with_an_explicit_timeout_(sync)/test

@@ -0,0 +1 @@
+test

fuzztests/.jazzerjsrc

@@ -1,4 +1,5 @@
 {
 	"fuzzerOptions": ["-use_value_profile=1", "-max_total_time=30"],
-	"includes": ["jazzer.js"]
+	"includes": ["jazzer.js"],
+	"timeout": 1000
 }

fuzztests/FuzzedDataProvider.fuzz.js

@@ -42,7 +42,7 @@ describe("FuzzedDataProvider", () => {
 			}
 			jazzer.exploreState(hash(usedMethods), 31);
 		},
-		40000
+		5000
 	);
 });
 

fuzztests/runFuzzTests.js

@@ -9,7 +9,7 @@ const fs = require("fs/promises");
 const { spawn } = require("child_process");
 
 const fuzzTestFileExtension = "fuzz.js";
-const fuzzTestNameRegex = /it.fuzz\(\s*"(.*)"/g;
+const fuzzTestNameRegex = /it.fuzz\s*\(\s*"(.*)"/g;
 
 async function findFuzzTestNamesInFile(file) {
 	const fuzzTestNames = [];
@@ -47,8 +47,11 @@ async function executeFuzzTest(file, name) {
 		});
 		test.on("close", (code) => {
 			console.log(`--- Finished fuzz test ${file} > ${name} with code ${code}`);
-			if (code !== 0 && code !== null) reject(code);
-			else resolve();
+			if (code !== 0 && code !== null) {
+				reject(code);
+			} else {
+				resolve();
+			}
 		});
 	});
 }

packages/core/cli.ts

@@ -181,6 +181,12 @@ yargs(process.argv.slice(2))
 					type: "string",
 					group: "Fuzzer:",
 					default: ["json", "text", "lcov", "clover"],
+				})
+				.option("timeout", {
+					describe: "Timeout in milliseconds for each fuzz test execution.",
+					type: "number",
+					group: "Fuzzer:",
+					default: 5000,
 				});
 		},
 		// eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -196,6 +202,7 @@ yargs(process.argv.slice(2))
 				excludes: args.instrumentation_excludes,
 				dryRun: args.dry_run,
 				sync: args.sync,
+				timeout: args.timeout,
 				fuzzerOptions: args.corpus.concat(args._),
 				customHooks: args.custom_hooks,
 				expectedErrors: args.expected_errors,

packages/core/core.ts

@@ -52,7 +52,7 @@ export interface Options {
 	fuzzerOptions: string[];
 	customHooks: string[];
 	expectedErrors: string[];
-	timeout?: number;
+	timeout: number;
 	idSyncFile?: string;
 	coverage: boolean; // Enables source code coverage report generation.
 	coverageDirectory: string;
@@ -290,10 +290,12 @@ function buildFuzzerOptions(options: Options): string[] {
 		// the last provided option takes precedence
 		opts = opts.concat("-runs=0");
 	}
-	if (options.timeout != undefined) {
-		const inSeconds = options.timeout / 1000;
-		opts = opts.concat(`-timeout=${inSeconds}`);
+
+	if (options.timeout <= 0) {
+		throw new Error("timeout must be > 0");
 	}
+	const inSeconds = Math.ceil(options.timeout / 1000);
+	opts = opts.concat(`-timeout=${inSeconds}`);
 
 	return [prepareLibFuzzerArg0(opts), ...opts];
 }