minimize-reproducer

# Minimize Reproducer ## Workflow ### 1. Identify the Failure Signature Before minimizing, understand exactly what "reproduction" looks like. - **Exact Command:** e.g., \`out/x64.release/d8 --fuzzing poc.js\` - **Failure Type:** Crash (segfault, abort), Assertion failure, Sandbox violation, or Incorrect output. - **Stability Check:** Initially check how stable the reproduction is. If it's flaky, you'll need to run it multiple times at every step. Use the bundled \`repro_check.sh\` script. ### 2. Command-Line Flag Minimization Find the minimal set of V8 flags required to reproduce the issue. - **Batch Removal:** Start by removing larger batches of flags (e.g., all flags starting with \`--no-\` or all optimization flags). - **One-by-One:** Progressively remove individual flags until only the essential ones remain. - **Common Critical Flags:** Pay attention to flags like \`--sandbox-fuzzing\`, \`--memory-corruption-via-watchpoints\`, or \`--turbofan\`, as these often control the underlying feature being tested. - **Validation:** Test reproduction after every step. If it stops failing, restore the last flag removed. ### 3. File Minimization (The Iterative Phase) Reduce the input JavaScript file systematically. Always work on a copy (e.g., \`poc-copy.js\`) and maintain a \`poc-min.js\` as your "best known" version. - **Remove Large Blocks:** Start by removing entire functions, classes, or large blocks of code (e.g., fuzzer boilerplate, unused libraries). - **Binary Search:** If a large block is present, try removing half. If it still fails, that half was unnecessary. - **Remove Individual Lines:** Once large blocks are gone, try removing individual lines. - **Inline Functions:** If a function is called only once, inline its content and remove the definition. - **Simplify Wrappers:** Remove \`try-catch\` blocks but retain the code inside the \`try\` block. - **Stabilize with Loops:** If a reproduction is flaky (e.g., it only fails 10% of the time), add a loop around the triggering logic to increase the failure probability to 100%. ### 4. Wasm Minimization WebAssembly reproductions often start as opaque `Uint8Array` blobs. Converting these to readable `WasmModuleBuilder` JS is critical for understanding and minimizing the logic. - **Convert Early with `wami`:** Use the `wami` tool to automatically generate `WasmModuleBuilder` code from a Wasm binary. This is much less error-prone than manual conversion. - **Command:** `out/x64.release/wami --mjsunit input.wasm > poc.js` - **Handle `WasmModuleBuilder` Specifics:** - **Recursive Types:** Be careful with recursive type definitions; ensure they are correctly indexed. - **Reference Types:** When specifying indices for heap types (e.g., in `struct.get`), use `wasmRefNullType(typeIndex)` or similar helpers where the builder expects a type object rather than a raw integer. - **Signature Validation:** After conversion, verify that the module still reproduces the original issue. `WasmModuleBuilder` might require minor manual adjustments if the original binary had subtle validation errors. ### 5. Special API Handling (e.g., Sandbox API) - **Offset Alignment:** Some APIs (like `Sandbox.markForCorruptionOnAccess`) require specific alignments (e.g., tagged-size-aligned offsets like 8, 12, or 16). - **Object Context:** Ensure the object being manipulated (e.g., a String) is large enough for the offset being targeted. Use `%DebugPrint(obj)` with `--allow-natives-syntax` to inspect the internal structure. ### 6. Clean and Polish - **Rename Variables:** Obfuscated names like `__v_0` should be renamed to something descriptive like `str` or `targetObj`. - **Readability > Size:** A 20-line file that is easy to understand is better than a 10-line file that is completely cryptic. - **Self-Contained:** Ensure the final `poc-min.js` is completely self-contained and does not rely on external fuzzer libraries unless strictly necessary. ## Guidelines - **Work on a copy:** Never modify the original reproduction file directly. - **Validate EVERY change:** A single character change can stop a bug from reproducing. Always verify. - **Keep a "Best Version":** Always update your \`-min.js\` file as soon as you find a smaller working version. This allows you to easily backtrack if a more aggressive minimization fails.