Enable exploreState without value profile

examples/BUILD.bazel

@@ -129,7 +129,6 @@ java_fuzz_target_test(
         "src/main/java/com/example/MazeFuzzer.java",
     ],
     allowed_findings = ["com.example.MazeFuzzer$$TreasureFoundException"],
-    fuzzer_args = ["-use_value_profile=1"],
     target_class = "com.example.MazeFuzzer",
 )
 

examples/junit/src/test/java/com/example/BUILD.bazel

@@ -372,3 +372,24 @@ java_fuzz_target_test(
         "@maven//:org_junit_jupiter_junit_jupiter_params",
     ],
 )
+
+# Test for the maximize() hill-climbing API.
+# This test uses Jazzer.maximize() to guide the fuzzer toward maximizing
+# a "temperature" value, demonstrating hill-climbing behavior.
+java_fuzz_target_test(
+    name = "ReactorFuzzTest",
+    srcs = ["ReactorFuzzTest.java"],
+    allowed_findings = ["java.lang.RuntimeException"],
+    env = {"JAZZER_FUZZ": "1"},
+    target_class = "com.example.ReactorFuzzTest",
+    verify_crash_reproducer = False,
+    runtime_deps = [
+        ":junit_runtime",
+    ],
+    deps = [
+        "//src/main/java/com/code_intelligence/jazzer/api:hooks",
+        "//src/main/java/com/code_intelligence/jazzer/junit:fuzz_test",
+        "//src/main/java/com/code_intelligence/jazzer/mutation/annotation",
+        "@maven//:org_junit_jupiter_junit_jupiter_api",
+    ],
+)

examples/junit/src/test/java/com/example/ReactorFuzzTest.java

@@ -0,0 +1,59 @@
+/*
+ * Copyright 2026 Code Intelligence GmbH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.example;
+
+import com.code_intelligence.jazzer.api.Jazzer;
+import com.code_intelligence.jazzer.junit.FuzzTest;
+import com.code_intelligence.jazzer.mutation.annotation.NotNull;
+
+public class ReactorFuzzTest {
+
+  @FuzzTest
+  public void fuzz(@NotNull String input) {
+    for (char c : input.toCharArray()) {
+      if (c < 32 || c > 126) return;
+    }
+    controlReactor(input);
+  }
+
+  private void controlReactor(String commands) {
+    long temperature = 0; // Starts cold
+
+    for (char cmd : commands.toCharArray()) {
+      // Complex, chaotic feedback loop.
+      // It is hard to predict which character increases temperature
+      // because it depends on the CURRENT temperature.
+      if ((temperature ^ cmd) % 3 == 0) {
+        temperature += (cmd % 10); // Heat up slightly
+      } else if ((temperature ^ cmd) % 3 == 1) {
+        temperature -= (cmd % 8); // Cool down slightly
+      } else {
+        temperature += 1; // Tiny increase
+      }
+
+      // Prevent dropping below absolute zero for simulation sanity
+      if (temperature < 0) temperature = 0;
+    }
+    // THE GOAL: MAXIMIZATION
+    // We need to drive 'temperature' to an extreme value.
+    // Standard coverage is 100% constant here (it just loops).
+    Jazzer.maximize(temperature, 500, 4500);
+    if (temperature >= 4500) {
+      throw new RuntimeException("Meltdown! Temperature maximized.");
+    }
+  }
+}

src/main/java/com/code_intelligence/jazzer/api/Jazzer.java

@@ -31,15 +31,22 @@ public final class Jazzer {
   private static final MethodHandle TRACE_STRCMP;
   private static final MethodHandle TRACE_STRSTR;
   private static final MethodHandle TRACE_MEMCMP;
-  private static final MethodHandle TRACE_PC_INDIR;
+
+  private static final MethodHandle COUNTERS_TRACKER_ALLOCATE;
+  private static final MethodHandle COUNTERS_TRACKER_SET_RANGE;
+  private static final MethodHandle COUNTERS_TRACKER_SET_COUNTER;
+
+  private static final byte[] EXPLORE_BUCKET_VALUES = {1, 2, 3, 4, 8, 16, 32, (byte) 128};
 
   static {
     Class<?> jazzerInternal = null;
     MethodHandle onFuzzTargetReady = null;
     MethodHandle traceStrcmp = null;
     MethodHandle traceStrstr = null;
     MethodHandle traceMemcmp = null;
-    MethodHandle tracePcIndir = null;
+    MethodHandle countersTrackerAllocate = null;
+    MethodHandle countersTrackerSetRange = null;
+    MethodHandle countersTrackerSetCounter = null;
     try {
       jazzerInternal = Class.forName("com.code_intelligence.jazzer.runtime.JazzerInternal");
       MethodType onFuzzTargetReadyType = MethodType.methodType(void.class, Runnable.class);
@@ -66,10 +73,20 @@ public final class Jazzer {
       traceMemcmp =
           MethodHandles.publicLookup()
               .findStatic(traceDataFlowNativeCallbacks, "traceMemcmp", traceMemcmpType);
-      MethodType tracePcIndirType = MethodType.methodType(void.class, int.class, int.class);
-      tracePcIndir =
+
+      Class<?> countersTracker =
+          Class.forName("com.code_intelligence.jazzer.runtime.CountersTracker");
+      MethodType allocateType = MethodType.methodType(void.class, int.class, int.class);
+      countersTrackerAllocate =
           MethodHandles.publicLookup()
-              .findStatic(traceDataFlowNativeCallbacks, "tracePcIndir", tracePcIndirType);
+              .findStatic(countersTracker, "ensureCountersAllocated", allocateType);
+      MethodType setRangeType = MethodType.methodType(void.class, int.class, int.class);
+      countersTrackerSetRange =
+          MethodHandles.publicLookup().findStatic(countersTracker, "setCounterRange", setRangeType);
+      MethodType setCounterType =
+          MethodType.methodType(void.class, int.class, int.class, byte.class);
+      countersTrackerSetCounter =
+          MethodHandles.publicLookup().findStatic(countersTracker, "setCounter", setCounterType);
     } catch (ClassNotFoundException ignore) {
       // Not running in the context of the agent. This is fine as long as no methods are called on
       // this class.
@@ -85,15 +102,17 @@ public final class Jazzer {
     TRACE_STRCMP = traceStrcmp;
     TRACE_STRSTR = traceStrstr;
     TRACE_MEMCMP = traceMemcmp;
-    TRACE_PC_INDIR = tracePcIndir;
+    COUNTERS_TRACKER_ALLOCATE = countersTrackerAllocate;
+    COUNTERS_TRACKER_SET_RANGE = countersTrackerSetRange;
+    COUNTERS_TRACKER_SET_COUNTER = countersTrackerSetCounter;
   }
 
   private Jazzer() {}
 
   /**
    * A 32-bit random number that hooks can use to make pseudo-random choices between multiple
    * possible mutations they could guide the fuzzer towards. Hooks <b>must not</b> base the decision
-   * whether or not to report a finding on this number as this will make findings non-reproducible.
+   * whether to report a finding on this number as this will make findings non-reproducible.
    *
    * <p>This is the same number that libFuzzer uses as a seed internally, which makes it possible to
    * deterministically reproduce a previous fuzzing run by supplying the seed value printed by
@@ -172,46 +191,31 @@ public static void guideTowardsContainment(String haystack, String needle, int i
   }
 
   /**
-   * Instructs the fuzzer to attain as many possible values for the absolute value of {@code state}
-   * as possible.
+   * Instructs the fuzzer to attain as many possible values for {@code state} as possible.
    *
    * <p>Call this function from a fuzz target or a hook to help the fuzzer track partial progress
    * (e.g. by passing the length of a common prefix of two lists that should become equal) or
    * explore different values of state that is not directly related to code coverage (see the
    * MazeFuzzer example).
    *
-   * <p><b>Note:</b> This hint only takes effect if the fuzzer is run with the argument {@code
-   * -use_value_profile=1}.
+   * <p>Each unique state value is tracked via libFuzzer's counter bucketing mechanism, enabling us
+   * to represent 8 different states for each coverage counter. As a result, all 256 byte values are
+   * distinguished by mapping each to a unique (counter, bucket) pair across 32 counters. See:
+   * https://github.com/llvm/llvm-project/blob/972e73b812cb7b6dd349c7c07daae73314f29e8f/compiler-rt/lib/fuzzer/FuzzerTracePC.h#L213-L235
    *
    * @param state a numeric encoding of a state that should be varied by the fuzzer
    * @param id a (probabilistically) unique identifier for this particular state hint
    */
   public static void exploreState(byte state, int id) {
-    if (TRACE_PC_INDIR == null) {
+    if (COUNTERS_TRACKER_ALLOCATE == null) {
       return;
     }
-    // We only use the lower 7 bits of state, which allows for 128 different state values tracked
-    // per id. The particular amount of 7 bits of state is also used in libFuzzer's
-    // TracePC::HandleCmp:
-    // https://github.com/llvm/llvm-project/blob/c12d49c4e286fa108d4d69f1c6d2b8d691993ffd/compiler-rt/lib/fuzzer/FuzzerTracePC.cpp#L390
-    // This value should be large enough for most use cases (e.g. tracking the length of a prefix in
-    // a comparison) while being small enough that the bitmap isn't filled up too quickly
-    // (65536 bits / 128 bits per id = 512 ids).
-
-    // We use tracePcIndir as a way to set a bit in libFuzzer's value profile bitmap. In
-    // TracePC::HandleCallerCallee, which is what this function ultimately calls through to, the
-    // lower 12 bits of each argument are combined into a 24-bit index into the bitmap, which is
-    // then reduced modulo a 16-bit prime. To keep the modulo bias small, we should fill as many
-    // of the relevant bits as possible.
-
-    // We pass state in the lowest bits of the caller address, which is used to form the lowest bits
-    // of the bitmap index. This should result in the best caching behavior as state is expected to
-    // change quickly in consecutive runs and in this way all its bitmap entries would be located
-    // close to each other in memory.
-    int lowerBits = (state & 0x7f) | (id << 7);
-    int upperBits = id >>> 5;
     try {
-      TRACE_PC_INDIR.invokeExact(upperBits, lowerBits);
+      COUNTERS_TRACKER_ALLOCATE.invokeExact(id, 32);
+      int unsignedState = state & 0xff;
+      int counterIndex = unsignedState >> 3;
+      byte counterValue = EXPLORE_BUCKET_VALUES[unsignedState & 0x7];
+      COUNTERS_TRACKER_SET_COUNTER.invokeExact(id, counterIndex, counterValue);
     } catch (Throwable e) {
       e.printStackTrace();
     }
@@ -222,6 +226,8 @@ public static void exploreState(byte state, int id) {
    * generated call-site identifiers. During instrumentation, calls to this method are replaced with
    * calls to {@link #exploreState(byte, int)} using a unique id for each call site.
    *
+   * <p>Without instrumentation, this is a no-op.
+   *
    * @param state a numeric encoding of a state that should be varied by the fuzzer
    * @see #exploreState(byte, int)
    */
@@ -230,6 +236,75 @@ public static void exploreState(byte state) {
     // an automatically generated call-site id. Without instrumentation, this is a no-op.
   }
 
+  /**
+   * Hill-climbing API to maximize a value. For each observed value v in [minValue, maxValue],
+   * provides feedback that all values in [minValue, v] are covered.
+   *
+   * <p>This enables corpus minimization to keep only the input resulting in the maximum value.
+   * Values below minValue provide no signal. Values above maxValue are clamped to maxValue.
+   *
+   * <p><b>Important:</b> This allocates (maxValue - minValue + 1) coverage counters per unique ID.
+   * For large value ranges, use a mapping function to reduce the range:
+   *
+   * <pre>{@code
+   * // Map [0, 1_000_000] to [0, 1000] steps
+   * long step = value < 0 ? 0 : Math.min(value / 1000, 1000);
+   * Jazzer.maximize(step, id, 0, 1000);
+   * }</pre>
+   *
+   * @param value The value to maximize (will be clamped to [minValue, maxValue])
+   * @param id A unique identifier for this call site (must be consistent across runs)
+   * @param minValue The minimum value in the range (inclusive)
+   * @param maxValue The maximum value in the range (inclusive)
+   */
+  public static void maximize(long value, int id, long minValue, long maxValue) {
+    if (COUNTERS_TRACKER_ALLOCATE == null) {
+      return;
+    }
+
+    if (maxValue < minValue) {
+      throw new IllegalArgumentException("maxValue must be >= minValue");
+    }
+    long range = maxValue - minValue;
+    if (range < 0 || range > (long) Integer.MAX_VALUE - 1) {
+      throw new IllegalArgumentException(
+          "Range too large: (maxValue - minValue + 1) must be <= Integer.MAX_VALUE");
+    }
+
+    int numCounters = (int) (range + 1);
+
+    try {
+      // Allocate counters (idempotent, validates numCounters > 0 and consistency)
+      COUNTERS_TRACKER_ALLOCATE.invokeExact(id, numCounters);
+
+      // Set counters if value provides signal
+      if (value >= minValue) {
+        int toOffset = (int) (Math.min(value, maxValue) - minValue);
+        COUNTERS_TRACKER_SET_RANGE.invokeExact(id, toOffset);
+      }
+    } catch (Throwable e) {
+      e.printStackTrace();
+    }
+  }
+
+  /**
+   * Convenience overload of {@link #maximize(long, int, long, long)} that allows using
+   * automatically generated call-site identifiers. During instrumentation, calls to this method are
+   * replaced with calls to {@link #maximize(long, int, long, long)} using a unique id for each call
+   * site.
+   *
+   * <p>Without instrumentation, this is a no-op.
+   *
+   * @param value The value to maximize
+   * @param minValue The minimum value in the range (inclusive)
+   * @param maxValue The maximum value in the range (inclusive)
+   * @see #maximize(long, int, long, long)
+   */
+  public static void maximize(long value, long minValue, long maxValue) {
+    // Instrumentation replaces calls to this method with calls to maximize(long, int, long, long)
+    // using an automatically generated call-site id. Without instrumentation, this is a no-op.
+  }
+
   /**
    * Make Jazzer report the provided {@link Throwable} as a finding.
    *

src/main/java/com/code_intelligence/jazzer/runtime/BUILD.bazel

@@ -100,6 +100,22 @@ java_library(
 
 # The following targets must only be referenced directly by tests or native implementations.
 
+java_jni_library(
+    name = "counters_tracker",
+    srcs = ["CountersTracker.java"],
+    native_libs = select({
+        "@platforms//os:android": ["//src/main/native/com/code_intelligence/jazzer/driver:jazzer_driver"],
+        "//conditions:default": [],
+    }),
+    visibility = [
+        "//src/main/native/com/code_intelligence/jazzer/driver:__pkg__",
+        "//src/test:__subpackages__",
+    ],
+    deps = [
+        "//src/main/java/com/code_intelligence/jazzer/utils:unsafe_provider",
+    ],
+)
+
 java_jni_library(
     name = "coverage_map",
     srcs = ["CoverageMap.java"],
@@ -170,6 +186,7 @@ java_library(
     ],
     deps = [
         ":constants",
+        ":counters_tracker",
         ":coverage_map",
         ":trace_data_flow_native_callbacks",
         "//src/main/java/com/code_intelligence/jazzer/api:hooks",