tests/fuzzers: add nodestatemachine fuzzer (wip) #21970
Conversation
|
Note: when using strings as test field types there are crashes that appear to be inside the fuzzer: In |
|
Unless the fuzzer is very specialized, like needs very particular inputs in order to get any good coverage, adding the corpus to git doesn't really make sense, IMO, so I'd remove that |
| u := u | ||
| optype := u % 5 | ||
| u /= 5 | ||
| nn := n | ||
| shift := u % 4 | ||
| u /= 4 |
There was a problem hiding this comment.
What is this? What's happening?
There was a problem hiding this comment.
I tried to use the quasi-random input string economically :) This part takes two bytes of input and transtlates it to a single operation. These are then assigned to byte values. Subscription callbacks, ns.Operation batches and the "top level" activity are composed as sequences of these single operations. It is similar to what randomInt does, I just do the modulus thing multiple times. Actually I could have used multiple randomInt calls (one for each choice) but I thought this is more efficient since the total amount of information needed to construct a single operation is less than two bytes (so I'm not re-using information, just not wasting it either).
| } | ||
| for i := range ops { | ||
| b := f.randomByte() | ||
| if b+byte(i*137) < 4 { |
There was a problem hiding this comment.
The only magic here is that it is an odd number and therefore a relative prime to 256 :) So the result of the modulo 256 multiplication sweeps the entire byte range and < 4 can work as a simple quasi-random condition. What I wanted here is to make the set of single operations variable in size so if the first byte of the pair satisfies a quasi-random condition then it is considered the end of the set. The chance of satisfying the condition is 1/64 so the average size of the set is 64.
| l = append(l, f.randomByte()) | ||
| } | ||
| if len(l) == 0 || !f.exhausted { | ||
| return -1 |
There was a problem hiding this comment.
I think 0 is beter than -1 here. -1 is for "don't ever use this again, even if it did increase coverage"
| for i, o := range l { | ||
| oplist[r*len(l)+i] = o + b | ||
| } | ||
| b += 81 |
| for ptr < len(list) { | ||
| op := list[ptr] | ||
| ptr++ | ||
| if op+byte(*nodeIdx)*111 < 4 { |
The oss-fuzz fuzzing stores the discovered corpus in the cloud anyway, and I think it'll rediscover + surpass your corpus material pretty quickly. |
This PR is based on #21935 and implements a NodeStateMachine fuzzer.