You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/pages/implementation/fuzzing.md
+3-4Lines changed: 3 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,10 +18,9 @@ corpus -> mutate -> lex + parse + vm -> catch_unwind -> [crash | new coverage |
18
18
|`Crash`| panic anywhere in the pipeline | save to `crashes/crash_NNNNNN.py`|
19
19
|`ParseErr`| parser emitted one or more diagnostics | discard |
20
20
|`VmErr`| VM returned a typed error | discard |
21
-
|`Timeout`| VM did not finish within 200 ms | discard, increment timeout counter |
22
21
|`Clean(bm)`| compiled and executed without panic | admit to corpus if `bm` covers new opcodes |
23
22
24
-
`ParseErr`, `VmErr`, and `Timeout` are expected outcomes — typed errors and infinite loops are not bugs. Only an unhandled panic indicates a defect.
23
+
`ParseErr`and `VmErr` are expected outcomes — typed errors are not bugs. Only an unhandled panic indicates a defect.
25
24
26
25
## Coverage
27
26
@@ -31,7 +30,7 @@ An input is admitted to the corpus only when its bitmap introduces at least one
31
30
32
31
## Iteration
33
32
34
-
Some strategies are applied uniformly at random: `byte_flip` (XOR a random byte), `insert_keyword`, `drop_line`, `duplicate_line`, `splice` (join two corpus halves), `inject_boundary` (i64 boundary literals targeting VM overflow), `deep_nest` (100–220 bracket levels, attacks `MAX_EXPR_DEPTH`), `token_shuffle`, `indent_bomb` (50–110 nested `if True:` blocks), and `add_comment`.
33
+
Some sstrategies are applied uniformly at random: `byte_flip` (XOR a random byte), `insert_keyword`, `drop_line`, `duplicate_line`, `splice` (join two corpus halves), `inject_boundary` (i64 boundary literals targeting VM overflow), `deep_nest` (100–220 bracket levels, attacks `MAX_EXPR_DEPTH`), `token_shuffle`, `indent_bomb` (50–110 nested `if True:` blocks), and `add_comment`.
35
34
36
35
## Known Targets
37
36
@@ -58,7 +57,7 @@ The `fuzz` profile inherits from `release` with two overrides: `panic = "unwind"
58
57
Output is written to stderr every 10 000 iterations:
0 commit comments