#!/bin/bash
# Run libFuzzer targets with persistent corpus and dictionary management.
#
# Usage: iree-bazel-fuzz [options] <target> [-- fuzzer-args...]
#
# Examples:
#   iree-bazel-fuzz //runtime/src/iree/base/internal:unicode_fuzz
#   iree-bazel-fuzz //path/to:target -- -max_total_time=60 -jobs=8
#   iree-bazel-fuzz -m //path/to:target   # minimize corpus first

set -e

# Source shared library.
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "${SCRIPT_DIR}/iree-bazel-lib"
iree_bazel_init "iree-bazel-fuzz"

# Expand combined short flags (e.g., -nv -> -n -v).
eval "set -- $(iree_expand_combined_flags "$@")"

# Fuzz-specific globals.
FUZZ_CACHE_DIR="${IREE_FUZZ_CACHE:-${HOME}/.cache/iree-fuzz-cache}"
FUZZ_CORPUS_DIR="${IREE_FUZZ_CORPUS:-${HOME}/.cache/iree-fuzz-corpus}"
FUZZ_MINIMIZE=0
FUZZ_DICT_ONLY=0
FUZZ_MIN_USES=10       # Minimum usage count for dict entries
FUZZ_AUTO_MINIMIZE=1000  # Auto-minimize when corpus exceeds this count

show_help() {
    cat << 'EOF'
iree-bazel-fuzz - Run libFuzzer targets with persistent corpus/dict

USAGE
    iree-bazel-fuzz [options] <target> [-- fuzzer-args...]

OPTIONS
    -n, --dry_run       Show command without executing
    -v, --verbose       Show command before executing
    -m, --minimize      Minimize corpus with set_cover_merge before fuzzing
    -d, --dict_only     Update dict from corpus without new fuzzing
    -h, --help          Show this help

    NOTE: Short flags can be combined: -nv is equivalent to -n -v

ARGUMENTS
    target              Bazel fuzz target (required)
    fuzzer-args         Arguments passed to libFuzzer (after --)

EXAMPLES
    # Basic fuzzing (Ctrl+C to stop)
    iree-bazel-fuzz //runtime/src/iree/base/internal:unicode_fuzz

    # Time-limited with parallel workers
    iree-bazel-fuzz //path/to:target -- -max_total_time=60 -jobs=8

    # Minimize corpus before fuzzing
    iree-bazel-fuzz -m //path/to:target

    # Just update dictionary from existing corpus
    iree-bazel-fuzz -d //path/to:target

    # Overnight fuzzing: all fuzz targets under a path (Ctrl+C to stop)
    iree-bazel-fuzz //runtime/src/iree/tokenizer/... -- -jobs=128

    # Time-limited multi-target fuzzing
    iree-bazel-fuzz //runtime/... -- -jobs=64 -max_total_time=3600

CORPUS & DICTIONARY
    Corpus:    ~/.cache/iree-fuzz-cache/<relative-path>/<target>/corpus/
    Artifacts: ~/.cache/iree-fuzz-cache/<relative-path>/<target>/artifacts/
    Dictionary: ~/.cache/iree-fuzz-corpus/<relative-path>/<target>.dict

    Paths mirror the source tree structure. Artifacts (crash-*, slow-unit-*)
    persist across runs. Dictionary entries (Uses > 10) are auto-appended.
    Corpus is auto-minimized when it exceeds 1000 files.

COMMON FUZZER FLAGS
    -max_total_time=N   Stop after N seconds
    -jobs=N             Run N parallel fuzzing jobs
    -workers=M          Use M worker processes (default: min(jobs, cores/2))
    -dict=file          Load additional dictionary

SEE ALSO
    iree-bazel-build, iree-bazel-run, iree-bazel-test
EOF
}

# Extract target name from bazel label (e.g., "//foo/bar:baz" -> "baz")
get_target_name() {
    local target="${1}"
    echo "${target##*:}"
}

# Get the repo-relative directory for a target (e.g., "runtime/src/iree/base").
# Uses bazel query to find source file location.
get_target_relative_dir() {
    local target="${1}"
    local BAZEL_BIN
    BAZEL_BIN=$(iree_get_bazel_command)

    # Query for source files of this target.
    local src_location
    src_location=$("${BAZEL_BIN}" query "labels(srcs, ${target})" --output=location 2>/dev/null | head -1)

    if [[ -n "${src_location}" ]]; then
        # Extract directory from "path/to/file.cc:1:1" and make it relative.
        local src_file="${src_location%%:*}"
        local src_dir
        src_dir=$(dirname "${src_file}")

        # Make path relative to worktree root.
        echo "${src_dir#${IREE_BAZEL_WORKTREE_DIR}/}"
    fi
}

# Get the dict file path for a target in the fuzz-corpus directory.
# Returns path even if file doesn't exist yet (for creation).
find_dict_file() {
    local target="${1}"
    local target_name
    target_name=$(get_target_name "${target}")

    local relative_dir
    relative_dir=$(get_target_relative_dir "${target}")

    if [[ -n "${relative_dir}" ]]; then
        local dict_dir="${FUZZ_CORPUS_DIR}/${relative_dir}"
        mkdir -p "${dict_dir}"
        echo "${dict_dir}/${target_name}.dict"
    fi
}

# Parse recommended dictionary from fuzzer output.
# Filters to entries with usage count >= threshold.
# Converts octal escapes (\NNN) to hex escapes (\xNN) for libFuzzer compatibility.
parse_dict_entries() {
    local output_file="${1}"
    local min_uses="${2}"

    # Extract lines between "Recommended dictionary" and "End of recommended"
    # Format: "\NNN\NNN" # Uses: NNN (libFuzzer outputs octal, but only parses hex)
    sed -n '/^###### Recommended dictionary/,/^###### End of recommended/p' "${output_file}" \
        | grep -E '^"' \
        | while IFS= read -r line; do
            # Extract usage count
            local uses
            uses=$(echo "${line}" | grep -oE 'Uses: [0-9]+' | grep -oE '[0-9]+')
            if [[ -n "${uses}" ]] && [[ "${uses}" -ge "${min_uses}" ]]; then
                # Output just the string part (before #), converting octal to hex.
                # \NNN (octal) -> \xNN (hex)
                echo "${line}" | sed 's/ *#.*//' | perl -pe 's/\\([0-7]{3})/sprintf("\\x%02x", oct($1))/ge'
            fi
        done
}

# Merge new dict entries into dict file (creates file if needed).
merge_dict_entries() {
    local dict_file="${1}"
    local new_entries="${2}"
    local temp_file
    local valid_entries

    if [[ -z "${new_entries}" ]]; then
        iree_debug "No new dictionary entries to add"
        return 0
    fi

    temp_file=$(mktemp)
    valid_entries=$(mktemp)
    trap "rm -f '${temp_file}' '${valid_entries}'" RETURN

    # Filter new entries to only valid ones (start with " and end with ").
    # Use printf to avoid bash escape interpretation.
    printf '%s\n' "${new_entries}" | while IFS= read -r entry; do
        # Validate: must start with " and end with "
        if [[ "${entry}" =~ ^\".*\"$ ]]; then
            printf '%s\n' "${entry}"
        else
            iree_debug "Skipping malformed dict entry: ${entry}"
        fi
    done > "${valid_entries}"

    if [[ ! -s "${valid_entries}" ]]; then
        iree_debug "No valid dictionary entries to add"
        return 0
    fi

    # Combine existing entries (if any) with new entries, sort, dedupe.
    {
        grep -E '^"' "${dict_file}" 2>/dev/null || true
        cat "${valid_entries}"
    } | sort -u > "${temp_file}"

    local old_count new_count added_count
    old_count=$(grep -cE '^"' "${dict_file}" 2>/dev/null || true)
    old_count=${old_count:-0}
    new_count=$(wc -l < "${temp_file}")
    added_count=$((new_count - old_count))

    if [[ "${added_count}" -gt 0 ]]; then
        # Preserve comments from original file (if exists), then add sorted entries.
        {
            grep -E '^#|^$' "${dict_file}" 2>/dev/null || true
            cat "${temp_file}"
        } > "${dict_file}.new"
        mv "${dict_file}.new" "${dict_file}"
        iree_info "Added ${added_count} new dictionary entries to ${dict_file}"
    else
        iree_debug "No new unique dictionary entries"
    fi
}

# Run corpus minimization using set_cover_merge.
minimize_corpus() {
    local binary="${1}"
    local corpus_dir="${2}"

    local corpus_count
    corpus_count=$(ls -1 "${corpus_dir}" 2>/dev/null | wc -l)

    if [[ "${corpus_count}" -eq 0 ]]; then
        iree_debug "Corpus is empty, nothing to minimize"
        return 0
    fi

    iree_info "Minimizing corpus (${corpus_count} files)..."

    local temp_corpus
    temp_corpus=$(mktemp -d)
    trap "rm -rf '${temp_corpus}'" RETURN

    if "${binary}" -set_cover_merge=1 "${temp_corpus}" "${corpus_dir}" 2>/dev/null; then
        local new_count
        new_count=$(ls -1 "${temp_corpus}" | wc -l)
        # Use find -delete to avoid "argument list too long" with large corpora.
        find "${corpus_dir}" -mindepth 1 -delete
        mv "${temp_corpus}"/* "${corpus_dir}"/ 2>/dev/null || true
        iree_info "Corpus minimized: ${corpus_count} -> ${new_count} files"
    else
        iree_warn "Corpus minimization failed"
    fi
}

# Parse arguments.
TARGET=""
BAZEL_ARGS=()
FUZZER_ARGS=()
PARSING_FUZZER_ARGS=0

while [[ $# -gt 0 ]]; do
    if [[ "${PARSING_FUZZER_ARGS}" == "1" ]]; then
        FUZZER_ARGS+=("${1}")
        shift
        continue
    fi

    case "${1}" in
        -h|--help)
            show_help
            exit 0
            ;;
        --agent-md|--agent_md)
            iree_show_agent_md
            exit 0
            ;;
        -n|--dry_run|--dry-run)
            IREE_BAZEL_DRY_RUN=1
            shift
            ;;
        -v|--verbose)
            IREE_BAZEL_VERBOSE=1
            shift
            ;;
        -m|--minimize)
            FUZZ_MINIMIZE=1
            shift
            ;;
        -d|--dict_only|--dict-only)
            FUZZ_DICT_ONLY=1
            shift
            ;;
        --)
            PARSING_FUZZER_ARGS=1
            shift
            ;;
        -*)
            BAZEL_ARGS+=("${1}")
            shift
            ;;
        *)
            if [[ -z "${TARGET}" ]]; then
                TARGET="${1}"
            else
                BAZEL_ARGS+=("${1}")
            fi
            shift
            ;;
    esac
done

# Target is required.
if [[ -z "${TARGET}" ]]; then
    iree_error "Target is required"
    echo ""
    show_help
    exit 1
fi

# Set up worktree.
iree_setup_worktree

#===----------------------------------------------------------------------===#
# Multi-target pattern support (e.g., //path/to/...)
#===----------------------------------------------------------------------===#

if [[ "${TARGET}" == *"..."* ]]; then
    # Expand pattern to all fuzz targets.
    BAZEL_BIN=$(iree_get_bazel_command)

    iree_info "Discovering fuzz targets matching: ${TARGET}"

    # Query for all targets ending in _fuzz under the pattern.
    FUZZ_TARGETS=()
    while IFS= read -r target; do
        if [[ "${target}" == *"_fuzz" ]]; then
            FUZZ_TARGETS+=("${target}")
        fi
    done < <("${BAZEL_BIN}" query "${TARGET}" 2>/dev/null | sort)

    if [[ ${#FUZZ_TARGETS[@]} -eq 0 ]]; then
        iree_error "No fuzz targets found matching: ${TARGET}"
        exit 1
    fi

    iree_info "Found ${#FUZZ_TARGETS[@]} fuzz targets"

    # Dry-run: just list targets.
    if iree_is_dry_run; then
        iree_info "Would run these fuzz targets:"
        for target in "${FUZZ_TARGETS[@]}"; do
            echo "  ${target}"
        done
        iree_info "Fuzzer args: ${FUZZER_ARGS[*]:-<none>}"
        exit 0
    fi

    # Build all targets first.
    iree_info "Building all fuzz targets..."
    iree_bazel_build_default_configs
    BUILD_ARGS=("${IREE_BAZEL_DEFAULT_CONFIGS[@]}" "--config=fuzzer" "${BAZEL_ARGS[@]}")

    if ! iree_bazel_build_quiet "${TARGET}" "${BUILD_ARGS[@]}"; then
        iree_error "Build failed"
        exit 1
    fi

    # Track results using indexed arrays (bash 3 compatible).
    declare -a FUZZ_PIDS=()
    declare -a FUZZ_TARGETS_RUNNING=()
    CRASHED_TARGETS=()
    CLEAN_TARGETS=()

    # Trap Ctrl+C to stop all fuzzers gracefully.
    cleanup_multi() {
        echo ""
        iree_info "Stopping all fuzzers..."
        for pid in "${FUZZ_PIDS[@]}"; do
            kill -INT "${pid}" 2>/dev/null || true
        done
        wait 2>/dev/null || true

        echo ""
        iree_info "=== Fuzzing Summary ==="
        iree_info "Total targets: ${#FUZZ_TARGETS[@]}"
        if [[ ${#CRASHED_TARGETS[@]} -gt 0 ]]; then
            iree_warn "Crashed (${#CRASHED_TARGETS[@]}):"
            for t in "${CRASHED_TARGETS[@]}"; do
                echo "  - ${t}"
            done
        fi
        if [[ ${#CLEAN_TARGETS[@]} -gt 0 ]]; then
            iree_info "Clean (${#CLEAN_TARGETS[@]}): ${#CLEAN_TARGETS[@]} targets"
        fi

        exit 0
    }
    trap cleanup_multi INT TERM

    # Build forwarded options for child processes.
    declare -a FORWARD_ARGS=()
    [[ "${FUZZ_MINIMIZE}" == "1" ]] && FORWARD_ARGS+=("-m")
    [[ "${FUZZ_DICT_ONLY}" == "1" ]] && FORWARD_ARGS+=("-d")
    [[ "${IREE_BAZEL_VERBOSE}" == "1" ]] && FORWARD_ARGS+=("-v")
    FORWARD_ARGS+=("${BAZEL_ARGS[@]}")

    # Run all fuzzers. They each manage their own corpus/artifacts.
    iree_info "Starting ${#FUZZ_TARGETS[@]} fuzzers..."
    echo ""

    for target in "${FUZZ_TARGETS[@]}"; do
        # Spawn fuzzer in subshell that ignores SIGINT (parent handles cleanup).
        (
            trap '' INT
            exec "${SCRIPT_DIR}/iree-bazel-fuzz" "${FORWARD_ARGS[@]}" "${target}" -- "${FUZZER_ARGS[@]}"
        ) &
        FUZZ_PIDS+=($!)
        FUZZ_TARGETS_RUNNING+=("${target}")
    done

    # Wait for all fuzzers and collect results.
    for i in "${!FUZZ_PIDS[@]}"; do
        local pid="${FUZZ_PIDS[$i]}"
        local target="${FUZZ_TARGETS_RUNNING[$i]}"
        if wait "${pid}"; then
            CLEAN_TARGETS+=("${target}")
        else
            CRASHED_TARGETS+=("${target}")
        fi
    done

    # Final summary.
    echo ""
    iree_info "=== Fuzzing Complete ==="
    iree_info "Total targets: ${#FUZZ_TARGETS[@]}"
    if [[ ${#CRASHED_TARGETS[@]} -gt 0 ]]; then
        iree_warn "Crashed (${#CRASHED_TARGETS[@]}):"
        for t in "${CRASHED_TARGETS[@]}"; do
            echo "  - ${t}"
        done
    fi
    iree_info "Clean: ${#CLEAN_TARGETS[@]} targets"

    exit 0
fi

# Extract target info for directory structure.
TARGET_NAME=$(get_target_name "${TARGET}")
TARGET_RELATIVE_DIR=$(get_target_relative_dir "${TARGET}")

# Set up corpus and artifact directories with repo-relative paths.
# Structure: ~/.cache/iree-fuzz-cache/<relative-path>/<target>/corpus/
#            ~/.cache/iree-fuzz-cache/<relative-path>/<target>/artifacts/
if [[ -n "${TARGET_RELATIVE_DIR}" ]]; then
    FUZZ_TARGET_DIR="${FUZZ_CACHE_DIR}/${TARGET_RELATIVE_DIR}/${TARGET_NAME}"
else
    # Fallback if we can't determine relative path.
    FUZZ_TARGET_DIR="${FUZZ_CACHE_DIR}/${TARGET_NAME}"
fi
CORPUS_DIR="${FUZZ_TARGET_DIR}/corpus"
ARTIFACT_DIR="${FUZZ_TARGET_DIR}/artifacts"

# Find dictionary file.
DICT_FILE=$(find_dict_file "${TARGET}")

# Set up bazel args with fuzzer config.
iree_bazel_build_default_configs
BAZEL_ARGS=("${IREE_BAZEL_DEFAULT_CONFIGS[@]}" "--config=fuzzer" "${BAZEL_ARGS[@]}")

# Create corpus and artifact directories.
mkdir -p "${CORPUS_DIR}" "${ARTIFACT_DIR}"

# Verbose/dry-run output.
if iree_is_verbose || iree_is_dry_run; then
    iree_info "Target: ${TARGET}"
    iree_info "Corpus: ${CORPUS_DIR}"
    iree_info "Artifacts: ${ARTIFACT_DIR}"
    if [[ -n "${DICT_FILE}" ]]; then
        iree_info "Dict: ${DICT_FILE}"
    fi
    iree_info "Bazel args: ${BAZEL_ARGS[*]}"
    iree_info "Fuzzer args: ${FUZZER_ARGS[*]:-<none>}"
fi

if iree_is_dry_run; then
    exit 0
fi

# Build the target.
iree_debug "Building ${TARGET}..."
if ! iree_bazel_build_quiet "${TARGET}" "${BAZEL_ARGS[@]}"; then
    exit $?
fi

# Get the binary path.
BINARY_PATH=$(iree_bazel_get_binary_path "${TARGET}" "${BAZEL_ARGS[@]}")
if [[ -z "${BINARY_PATH}" ]] || [[ ! -x "${BINARY_PATH}" ]]; then
    iree_error "Could not find built binary for ${TARGET}"
    exit 1
fi

iree_debug "Binary: ${BINARY_PATH}"

# Minimize corpus if requested or if corpus is too large.
CORPUS_COUNT=$(ls -1 "${CORPUS_DIR}" 2>/dev/null | wc -l)
if [[ "${FUZZ_MINIMIZE}" == "1" ]]; then
    minimize_corpus "${BINARY_PATH}" "${CORPUS_DIR}"
elif [[ "${CORPUS_COUNT}" -gt "${FUZZ_AUTO_MINIMIZE}" ]]; then
    iree_info "Corpus has ${CORPUS_COUNT} files (threshold: ${FUZZ_AUTO_MINIMIZE}), auto-minimizing..."
    minimize_corpus "${BINARY_PATH}" "${CORPUS_DIR}"
fi

# Dict-only mode: just run briefly to generate dictionary recommendations.
if [[ "${FUZZ_DICT_ONLY}" == "1" ]]; then
    if [[ -z "${DICT_FILE}" ]]; then
        iree_error "No .dict file found for ${TARGET}"
        exit 1
    fi

    iree_info "Running corpus to extract dictionary entries..."
    OUTPUT_FILE=$(mktemp)
    trap "rm -f '${OUTPUT_FILE}'" EXIT

    # Run with existing corpus, short time limit.
    "${BINARY_PATH}" "${CORPUS_DIR}" -max_total_time=5 2>&1 | tee "${OUTPUT_FILE}"

    # Extract and merge dictionary entries.
    NEW_ENTRIES=$(parse_dict_entries "${OUTPUT_FILE}" "${FUZZ_MIN_USES}")
    merge_dict_entries "${DICT_FILE}" "${NEW_ENTRIES}"
    exit 0
fi

# Set up log directory for this instance (temp, cleaned on success).
FUZZ_LOG_DIR="/tmp/iree-bazel-fuzz/${TARGET_NAME}/$$"
mkdir -p "${FUZZ_LOG_DIR}"

# Build fuzzer command.
FUZZ_CMD=("${BINARY_PATH}" "${CORPUS_DIR}")

# Redirect artifacts to persistent location, logs to temp.
FUZZ_CMD+=("-artifact_prefix=${ARTIFACT_DIR}/")

# Add dictionary if it exists.
if [[ -n "${DICT_FILE}" ]] && [[ -f "${DICT_FILE}" ]]; then
    FUZZ_CMD+=("-dict=${DICT_FILE}")
    iree_info "Using dictionary: ${DICT_FILE}"
elif [[ -n "${DICT_FILE}" ]]; then
    iree_debug "Dictionary will be created at: ${DICT_FILE}"
fi

# Add per-input timeout if not specified but max_total_time is.
# This prevents pathological inputs from hanging the fuzzer.
HAS_TIMEOUT=0
MAX_TOTAL_TIME=0
for arg in "${FUZZER_ARGS[@]}"; do
    if [[ "${arg}" =~ ^-timeout= ]]; then
        HAS_TIMEOUT=1
    elif [[ "${arg}" =~ ^-max_total_time=([0-9]+) ]]; then
        MAX_TOTAL_TIME="${BASH_REMATCH[1]}"
    fi
done
if [[ "${HAS_TIMEOUT}" -eq 0 ]] && [[ "${MAX_TOTAL_TIME}" -gt 0 ]]; then
    # Default timeout to 2x max_total_time (minimum 5 seconds).
    DEFAULT_TIMEOUT=$((MAX_TOTAL_TIME * 2))
    if [[ "${DEFAULT_TIMEOUT}" -lt 5 ]]; then
        DEFAULT_TIMEOUT=5
    fi
    FUZZ_CMD+=("-timeout=${DEFAULT_TIMEOUT}")
    iree_debug "Auto-setting timeout=${DEFAULT_TIMEOUT}s (2x max_total_time)"
fi

# Add user fuzzer args.
FUZZ_CMD+=("${FUZZER_ARGS[@]}")

# Cleanup and dict update on exit.
CLEANUP_DONE=0
cleanup() {
    local exit_code=$?

    # Prevent running twice (INT then EXIT).
    if [[ "${CLEANUP_DONE}" -eq 1 ]]; then
        exit ${exit_code}
    fi
    CLEANUP_DONE=1
    trap - EXIT INT TERM

    # Extract dictionary from log files using grep to find exact section.
    if [[ -n "${DICT_FILE}" ]] && [[ -d "${FUZZ_LOG_DIR}" ]]; then
        # Use grep -A to get lines after the dictionary marker.
        # The dictionary section ends with "End of recommended", so we stop there.
        local dict_output
        dict_output=$(grep -h -A 1000 '^###### Recommended dictionary' "${FUZZ_LOG_DIR}"/*.log 2>/dev/null \
            | sed '/^###### End of recommended/q' \
            | grep -E '^"' || true)
        if [[ -n "${dict_output}" ]]; then
            NEW_ENTRIES=$(echo "${dict_output}" \
                | while IFS= read -r line; do
                    local uses
                    uses=$(echo "${line}" | grep -oE 'Uses: [0-9]+' | grep -oE '[0-9]+')
                    if [[ -n "${uses}" ]] && [[ "${uses}" -ge "${FUZZ_MIN_USES}" ]]; then
                        echo "${line}" | sed 's/ *#.*//' | perl -pe 's/\\([0-7]{3})/sprintf("\\x%02x", oct($1))/ge'
                    fi
                done)
            merge_dict_entries "${DICT_FILE}" "${NEW_ENTRIES}"
        fi
    fi

    # Report corpus size.
    local corpus_count
    corpus_count=$(ls -1 "${CORPUS_DIR}" 2>/dev/null | wc -l)
    iree_info "Corpus: ${corpus_count} files in ${CORPUS_DIR}"

    # Check for crash/leak/timeout artifacts in persistent location.
    local artifact_count
    artifact_count=$(ls -1 "${ARTIFACT_DIR}" 2>/dev/null | wc -l)
    if [[ "${artifact_count}" -gt 0 ]]; then
        iree_warn "Artifacts (${artifact_count} files): ${ARTIFACT_DIR}"
        ls -1 "${ARTIFACT_DIR}" | head -5 | while read -r artifact; do
            echo "  ${artifact}"
        done
        if [[ "${artifact_count}" -gt 5 ]]; then
            echo "  ... and $((artifact_count - 5)) more"
        fi
    fi

    # Clean up log directory on success, keep on failure for debugging.
    if [[ "${exit_code}" -eq 0 ]]; then
        rm -rf "${FUZZ_LOG_DIR}"
    else
        # Show error messages from logs on failure.
        if [[ "${exit_code}" -ne 0 ]]; then
            local errors
            errors=$(grep -h -E '(ERROR|FATAL|ASAN|SUMMARY:|ParseDictionaryFile:)' "${FUZZ_LOG_DIR}"/*.log 2>/dev/null | head -20 || true)
            if [[ -n "${errors}" ]]; then
                iree_error "Fuzzer failed:"
                echo "${errors}" >&2
            fi
        fi
        iree_info "Logs and artifacts: ${FUZZ_LOG_DIR}"
    fi

    exit ${exit_code}
}
trap cleanup EXIT INT TERM

# Run the fuzzer from log directory so fuzz-N.log files go there.
# Output goes to log files only - we just show status.
iree_info "Starting fuzzer (Ctrl+C to stop)..."
iree_info "Logs: ${FUZZ_LOG_DIR}"
cd "${FUZZ_LOG_DIR}"
"${FUZZ_CMD[@]}" > main.log 2>&1