[libFuzzer] Don't add leaking inputs to corpus.

[kcc]

Code LG.
Please add a test.

[morehouse]

• Add test.

[kcc]

compiler-rt/test/fuzzer/fuzzer-leak.test

16

This is too involved. I would just run the same test with -runs=0 on the corpus.
If there are leaky inputs in the corpus that will fail.

[morehouse]

• Simplify test logic.

[kcc]

LGTM

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

for (int i = 0; i < Options.MutateDepth; i++) {
     if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
       break;
     size_t NewSize = 0;
     NewSize = MD.Mutate(CurrentUnitData, Size, CurrentMaxMutationLen);
     assert(NewSize > 0 && "Mutator returned empty unit");
     assert(NewSize <= CurrentMaxMutationLen && "Mutator return oversized unit");
     Size = NewSize;
     II.NumExecutedMutations++;
-    if (RunOne(CurrentUnitData, Size, /*MayDeleteFile=*/true, &II))
-      ReportNewCoverage(&II, {CurrentUnitData, CurrentUnitData + Size});
 
+    bool NewCov = RunOne(CurrentUnitData, Size, /*MayDeleteFile=*/true, &II);
     TryDetectingAMemoryLeak(CurrentUnitData, Size,
                             /*DuringInitialCorpusExecution*/ false);
+    if (NewCov)
+      ReportNewCoverage(&II, {CurrentUnitData, CurrentUnitData + Size});
   }
 }
 
 void Fuzzer::PurgeAllocator() {
   if (Options.PurgeAllocatorIntervalSec < 0 || !EF->__sanitizer_purge_allocator)
     return;
   if (duration_cast<seconds>(system_clock::now() -
                              LastAllocatorPurgeAttemptTime)

compiler-rt/test/fuzzer/fuzzer-leak.test

 REQUIRES: lsan
 RUN: %cpp_compiler %S/LeakTest.cpp -o %t-LeakTest
 RUN: %cpp_compiler %S/ThreadedLeakTest.cpp -o %t-ThreadedLeakTest
 RUN: %cpp_compiler %S/LeakTimeoutTest.cpp -o %t-LeakTimeoutTest
 
-RUN: not %t-LeakTest -runs=100000 -detect_leaks=1 2>&1 | FileCheck %s --check-prefix=LEAK_DURING
+RUN: rm -rf %t-corpus && mkdir -p %t-corpus
+RUN: not %t-LeakTest -runs=100000 -detect_leaks=1 %t-corpus 2>&1 | tee %t.log | FileCheck %s --check-prefix=LEAK_DURING
 LEAK_DURING: ERROR: LeakSanitizer: detected memory leaks
 LEAK_DURING: Direct leak of 4 byte(s) in 1 object(s) allocated from:
 LEAK_DURING: INFO: to ignore leaks on libFuzzer side use -detect_leaks=0
 LEAK_DURING: Test unit written to ./leak-
 LEAK_DURING-NOT: DONE
 LEAK_DURING-NOT: Done
 
+// Verify leaking input was not added to corpus
+RUN: not ls %t-corpus/$(grep 'Test unit written to ./leak-' %t.log | sed 's/.*-//')
+
 RUN: not %t-LeakTest -runs=0 -detect_leaks=1 %S 2>&1 | FileCheck %s --check-prefix=LEAK_IN_CORPUS
 LEAK_IN_CORPUS: ERROR: LeakSanitizer: detected memory leaks
 LEAK_IN_CORPUS: INFO: a leak has been found in the initial corpus.
 
 RUN: not %t-LeakTest -runs=100000000 %S/hi.txt 2>&1 | FileCheck %s --check-prefix=MULTI_RUN_LEAK
 MULTI_RUN_LEAK-NOT: pulse
 MULTI_RUN_LEAK: LeakSanitizer: detected memory leaks