fuzzer: write inputs to shared memory before running

breaking change to the fuzz testing API; it now passes a type-safe
context parameter to the fuzz function.

libfuzzer is reworked to select inputs from the entire corpus.

I tested that it's roughly as good as it was before in that it can find
the panics in the simple examples, as well as achieve decent coverage on
the tokenizer fuzz test.

however I think the next step here will be figuring out why so many
points of interest are missing from the tokenizer in both Debug and
ReleaseSafe modes.

does not quite close #20803 yet since there are some more important
things to be done, such as opening the previous corpus, continuing
fuzzing after finding bugs, storing the length of the inputs, etc.
This commit is contained in:
Andrew Kelley
2025-02-11 11:54:12 -08:00
parent 31c1320818
commit d789f1e5cf
5 changed files with 322 additions and 201 deletions

View File

@@ -30,13 +30,14 @@ test "use other module" {
}
test "fuzz example" {
const global = struct {
fn testOne(input: []const u8) anyerror!void {
const Context = struct {
fn testOne(context: @This(), input: []const u8) anyerror!void {
_ = context;
// Try passing `--fuzz` to `zig build test` and see if it manages to fail this test case!
try std.testing.expect(!std.mem.eql(u8, "canyoufindme", input));
}
};
try std.testing.fuzz(global.testOne, .{});
try std.testing.fuzz(Context{}, Context.testOne, .{});
}
const std = @import("std");