It's probably worth trying to run the fuzzer locally for several hours, e.g. with -max_total_time=14400 to see how it goes

How do you specify command line args to the fuzzer? It just treats them as files in my local runs??

The following works fine for me:


$ ninja -C out/Release -j24 media_pipeline_integration_fuzzer
ninja: Entering directory `out/Release'
[1/1] Regenerating ninja files
[39/39] LINK ./media_pipeline_integration_fuzzer



$ out/Release/media_pipeline_integration_fuzzer -print_final_stats=1 -runs=10
INFO: Seed: 2929286252
INFO: Loaded 2 modules   (377452 guards): 27505 [0x7f907b583520, 0x7f907b59e2e4), 349947 [0x2fb1240, 0x3106e2c), 
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: A corpus is not provided, starting from an empty corpus
#0	READ units: 1
../../media/test/pipeline_integration_test_base.cc:230: Failure
Actual function call count doesn't match EXPECT_CALL(*this, OnDurationChange())...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
../../media/test/pipeline_integration_test_base.cc:230: Failure
Actual function call count doesn't match EXPECT_CALL(*this, OnDurationChange())...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
../../media/test/pipeline_integration_test_base.cc:230: Failure
Actual function call count doesn't match EXPECT_CALL(*this, OnDurationChange())...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
#3	INITED cov: 3450 ft: 2925 corp: 1/1b exec/s: 0 rss: 86Mb
../../media/test/pipeline_integration_test_base.cc:230: Failure
Actual function call count doesn't match EXPECT_CALL(*this, OnDurationChange())...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
#4	NEW    cov: 3459 ft: 2955 corp: 2/3b exec/s: 4 rss: 88Mb L: 2/2 MS: 1 CopyPart-
../../media/test/pipeline_integration_test_base.cc:230: Failure
Actual function call count doesn't match EXPECT_CALL(*this, OnDurationChange())...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
../../media/test/pipeline_integration_test_base.cc:230: Failure
Actual function call count doesn't match EXPECT_CALL(*this, OnDurationChange())...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
#6	NEW    cov: 3460 ft: 2956 corp: 3/5b exec/s: 6 rss: 95Mb L: 2/2 MS: 2 CopyPart-CopyPart-
../../media/test/pipeline_integration_test_base.cc:230: Failure
Actual function call count doesn't match EXPECT_CALL(*this, OnDurationChange())...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
../../media/test/pipeline_integration_test_base.cc:230: Failure
Actual function call count doesn't match EXPECT_CALL(*this, OnDurationChange())...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
#8	NEW    cov: 3460 ft: 2973 corp: 4/7b exec/s: 8 rss: 99Mb L: 2/2 MS: 3 CopyPart-CopyPart-ShuffleBytes-
../../media/test/pipeline_integration_test_base.cc:230: Failure
Actual function call count doesn't match EXPECT_CALL(*this, OnDurationChange())...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
../../media/test/pipeline_integration_test_base.cc:230: Failure
Actual function call count doesn't match EXPECT_CALL(*this, OnDurationChange())...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
#10	NEW    cov: 3528 ft: 3047 corp: 5/23b exec/s: 5 rss: 101Mb L: 16/16 MS: 4 CopyPart-CopyPart-ShuffleBytes-CMP- DE: "\x0aStack trace:\x0a"-
../../media/test/pipeline_integration_test_base.cc:230: Failure
Actual function call count doesn't match EXPECT_CALL(*this, OnDurationChange())...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
#11	DONE   cov: 3528 ft: 3047 corp: 5/23b exec/s: 5 rss: 101Mb
###### Recommended dictionary. ######
"\x0aStack trace:\x0a" # Uses: 0
###### End of recommended dictionary. ######
Done 11 runs in 2 second(s)
stat::number_of_executed_units: 11
stat::average_exec_per_sec:     5
stat::new_units_added:          4
stat::slowest_unit_time_sec:    0
stat::peak_rss_mb:              101




and:




$ ninja -C out/Release -j24 mediasource_MP3_pipeline_integration_fuzzer
ninja: Entering directory `out/Release'
[8/8] LINK ./mediasource_MP3_pipeline_integration_fuzzer



$ out/Release/mediasource_MP3_pipeline_integration_fuzzer -print_final_stats=1 -runs=10
INFO: Seed: 3014781813
INFO: Loaded 2 modules   (377459 guards): 27505 [0x7f59e6cd4520, 0x7f59e6cef2e4), 349954 [0x3028280, 0x317de88), 
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: A corpus is not provided, starting from an empty corpus
#0	READ units: 1
../../media/test/pipeline_integration_test_base.cc:555: Failure
Actual function call count doesn't match EXPECT_CALL(*source, InitSegmentReceivedMock(_))...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
../../media/test/pipeline_integration_test_base.cc:555: Failure
Actual function call count doesn't match EXPECT_CALL(*source, InitSegmentReceivedMock(_))...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
#3	INITED cov: 3622 ft: 3173 corp: 1/1b exec/s: 0 rss: 83Mb
../../media/test/pipeline_integration_test_base.cc:555: Failure
Actual function call count doesn't match EXPECT_CALL(*source, InitSegmentReceivedMock(_))...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
#4	NEW    cov: 3629 ft: 3247 corp: 2/2b exec/s: 0 rss: 84Mb L: 1/1 MS: 1 ChangeBinInt-
../../media/test/pipeline_integration_test_base.cc:555: Failure
Actual function call count doesn't match EXPECT_CALL(*source, InitSegmentReceivedMock(_))...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
../../media/test/pipeline_integration_test_base.cc:555: Failure
Actual function call count doesn't match EXPECT_CALL(*source, InitSegmentReceivedMock(_))...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
#6	NEW    cov: 3639 ft: 3262 corp: 3/17b exec/s: 0 rss: 85Mb L: 15/15 MS: 2 ChangeBinInt-InsertRepeatedBytes-
../../media/test/pipeline_integration_test_base.cc:555: Failure
Actual function call count doesn't match EXPECT_CALL(*source, InitSegmentReceivedMock(_))...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
../../media/test/pipeline_integration_test_base.cc:555: Failure
Actual function call count doesn't match EXPECT_CALL(*source, InitSegmentReceivedMock(_))...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
#8	NEW    cov: 3641 ft: 3266 corp: 4/28b exec/s: 8 rss: 86Mb L: 11/15 MS: 3 ChangeBinInt-InsertRepeatedBytes-EraseBytes-
../../media/test/pipeline_integration_test_base.cc:555: Failure
Actual function call count doesn't match EXPECT_CALL(*source, InitSegmentReceivedMock(_))...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
../../media/test/pipeline_integration_test_base.cc:555: Failure
Actual function call count doesn't match EXPECT_CALL(*source, InitSegmentReceivedMock(_))...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
#10	NEW    cov: 3642 ft: 3271 corp: 5/46b exec/s: 10 rss: 87Mb L: 18/18 MS: 4 ChangeBinInt-InsertRepeatedBytes-EraseBytes-CopyPart-
../../media/test/pipeline_integration_test_base.cc:555: Failure
Actual function call count doesn't match EXPECT_CALL(*source, InitSegmentReceivedMock(_))...
         Expected: to be called at least once
           Actual: never called - unsatisfied and active
#11	DONE   cov: 3642 ft: 3271 corp: 5/46b exec/s: 11 rss: 88Mb
Done 11 runs in 1 second(s)
stat::number_of_executed_units: 11
stat::average_exec_per_sec:     11
stat::new_units_added:          4
stat::slowest_unit_time_sec:    0
stat::peak_rss_mb:              88

Do you build fuzzer locally? Here following GN args are needed: https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md#reproducing-libfuzzer-asan-bugs

Yeah for anyone else that hits this, you need use_libfuzzer=true

Ran the fuzzer with -max_total_time=14440 and there were no issues, so sending out: https://chromium-review.googlesource.com/#/c/chromium/src/+/688002

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/dc2770d447e8664fd26bc356f1b55067e1877be5

commit dc2770d447e8664fd26bc356f1b55067e1877be5
Author: Dale Curtis <dalecurtis@chromium.org>
Date: Fri Sep 29 03:28:23 2017

Remove run limit and fix OnDurationChange log spam.

kUnreliableDuration now means we can't rely on OnDurationChange
events, which is fine since we generally use this with bad media.

This also removes the run limit since the fuzzer seems to run fine
locally now > 500000.

BUG= 758631 
TEST=local long run

Change-Id: I4b585776c64c1860c72ae89fc8ab5c020f266bdb
Reviewed-on: https://chromium-review.googlesource.com/688002
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#505282}
[modify] https://crrev.com/dc2770d447e8664fd26bc356f1b55067e1877be5/media/test/BUILD.gn
[modify] https://crrev.com/dc2770d447e8664fd26bc356f1b55067e1877be5/media/test/pipeline_integration_test_base.cc