google / google/xls

Port fuzzer to FuzzTest infrastructure

Open
#1,142 1 comment 0 reactions 0 assignees View on GitHub
fuzz
Dominant language
C++
Stars
1.9k
Forks
283
Avg merge
2d 10h
Merged PRs (30d)
135

Description

To get coverage-guided fuzzing we should port our fuzzer to use https://github.com/google/fuzztest. This would be a significant task. Most of the work would involve changing our ast generator to comply with a fuzztest domain:

https://github.com/google/fuzztest/blob/ab39c208420d12b11581b82a1573158b1c215b74/doc/team/implementation.md#domains

Basically we need two mechanisms:

1. Generate a random sample in the domain. This is basically what our existing ast generator does.

2. Mutate an existing sample potentially with a constraint that the size of the sample should be strictly reduced. We do not have this capability now. Example mutations might be: add operation to function, change return value, replace value with constant, replace value with it's operand, replace value with another in the graph, remove dead expression, and others. The IR minimizer has some of these mutations for reducing IR.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.