-
Notifications
You must be signed in to change notification settings - Fork 85
Unify coverage cleanup: extract from tracer instead of AdditionalResults #811
Copy link
Copy link
Closed
Description
Problem
Coverage data is currently stored in MessageResults.AdditionalResults during transaction execution, then manually cleaned up at multiple call sites to prevent memory retention. This pattern is fragile — missing cleanup at any site causes memory leaks, as confirmed by pprof profiling (~8 MB/min growth from coverage maps retained in the corpus pruner).
Current cleanup sites
Corpus.Initialize(fuzzing/corpus/corpus.go, lines 236-250) — iterates all blocks/messages after chain clone and removes coverage tracer resultscheckSequenceCoverageAndUpdate(fuzzing/corpus/corpus.go, line 390) — removes coverage from the last call's message results after extracting itPruneSequences(fuzzing/corpus/corpus.go, added in memory leak fix) — removes coverage from all elements in each replayed sequence, sincecheckSequenceCoverageAndUpdateonly cleans the last element
Proposed approach
Extract coverage directly from CoverageTracer rather than round-tripping through AdditionalResults:
- After each call sequence execution, query the
CoverageTracerfor accumulated coverage maps - This eliminates the need to store coverage in
AdditionalResultsat all - No storage means no cleanup needed — the retention-leak pattern disappears at its source
- The tracer already tracks this data internally;
AdditionalResultsis just a transport mechanism
Benefits
- Single source of truth for coverage data (the tracer)
- No more scattered cleanup calls that must stay in sync
- Eliminates an entire class of memory leaks
- Simpler mental model for contributors
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels