testing: panic in Fuzz if the function returns a value

Otherwise, the behavior of a fuzz target that returns an error could
be confusing.

Fuzz is already documented to require a function “with no return
value”, so this fixes the implementation to match the existing
documentation.

Fixes #51222

Change-Id: I44ca7ee10960214c92f5ac066ac8484c8bb9cd6f
Reviewed-on: https://go-review.googlesource.com/c/go/+/386175
Trust: Bryan Mills <bcmills@google.com>
Run-TryBot: Bryan Mills <bcmills@google.com>
Reviewed-by: Robert Findley <rfindley@google.com>
Reviewed-by: Nooras Saba‎ <saba@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>

src/cmd/go/testdata/script/test_fuzz_return.txt

@@ -0,0 +1,19 @@
+[short] skip
+
+! go test .
+stdout '^panic: testing: fuzz target must not return a value \[recovered\]$'
+
+-- go.mod --
+module test
+go 1.18
+-- x_test.go --
+package test
+
+import "testing"
+
+func FuzzReturnErr(f *testing.F) {
+	f.Add("hello, validation!")
+	f.Fuzz(func(t *testing.T, in string) string {
+		return in
+	})
+}

src/testing/fuzz.go

@@ -227,6 +227,9 @@ func (f *F) Fuzz(ff any) {
 	if fnType.NumIn() < 2 || fnType.In(0) != reflect.TypeOf((*T)(nil)) {
 		panic("testing: fuzz target must receive at least two arguments, where the first argument is a *T")
 	}
+	if fnType.NumOut() != 0 {
+		panic("testing: fuzz target must not return a value")
+	}
 
 	// Save the types of the function to compare against the corpus.
 	var types []reflect.Type