Files
romanett 8e96408b2a Fuzz oracles: confirm net48 allocation findings by re-running the target (#4818)
## Problem

`FuzzCrashAssets(AflfuzzBinaryDecoder)` failed intermittently on net48
(run 38897795750, test-windows-net48 1/16, on #4815, which changes only
`perf/`):

> 10562496 bytes allocated for 42 input bytes, budget 8391296 bytes

On .NET Framework, `FuzzOracles` measures allocations with
`AppDomain.MonitoringTotalAllocatedMemorySize`. That counter covers the
whole AppDomain, so it also counts other threads in the test host.

Measured on net48 Release for
`crash-0bdcbfafc13981ae6f665ad52cabc1cbe21b0238`:

| Scenario | Bytes |
|---|---|
| First decode in the process (one-time XML setup) | 1,083,232 |
| Later decodes, same thread or a fresh thread | 16,440 |
| Same decode with one concurrent thread allocating | 10.7 to 23.8 MB
(over budget) |

The decoder does not have a per-thread cost, and #4812 did not regress
it. The CI TRX shows that tests ran one at a time. The failure came
about 2 s into the run, right after a burst of about 100 fast test
cases, which fits vstest serializing results on a background thread.

## Fix

`FuzzOracles.RunTarget` re-runs a target when the allocation finding
comes from a counter that is not per thread (`AllocationConfirmationRuns
= 2`). It reports the finding only if every run confirms it. A real
over-budget decode allocates the same amount every time, while a burst
on another thread rarely lines up with all three runs. This is the same
approach the time oracle already uses (`TimeConfirmationRuns`). Runtimes
with a per-thread counter (net8+) behave as before. `FuzzMethods`
playback goes through `RunTarget` too, so it also gets the confirmation
runs.

## Tests

- New tests in `FuzzOraclesTests`:
- A finding that every run confirms is still reported, after 3 runs on
net48 and 1 run on net8+.
- A finding inflated by another thread is ignored (net48 only). This
test fails when the confirmation runs are set to 0.
- net48 Release: Opc.Ua.Fuzzing.Tests 156/156,
Opc.Ua.Encoders.Fuzz.Tests 8130/8130.
- net10.0: FuzzOraclesTests pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-16 17:21:59 +02:00
..