Port fuzzer to FuzzTest infrastructure
- Dominant language
- C++
- Stars
- 1.9k
- Forks
- 283
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 135
Description
To get coverage-guided fuzzing we should port our fuzzer to use https://github.com/google/fuzztest. This would be a significant task. Most of the work would involve changing our ast generator to comply with a fuzztest domain:
https://github.com/google/fuzztest/blob/ab39c208420d12b11581b82a1573158b1c215b74/doc/team/implementation.md#domains
Basically we need two mechanisms:
1. Generate a random sample in the domain. This is basically what our existing ast generator does.
2. Mutate an existing sample potentially with a constraint that the size of the sample should be strictly reduced. We do not have this capability now. Example mutations might be: add operation to function, change return value, replace value with constant, replace value with it's operand, replace value with another in the graph, remove dead expression, and others. The IR minimizer has some of these mutations for reducing IR.
Contributor guide
Assessment
This issue has not been assessed yet.