Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Try fuzzing Alma code by injecting semantics-preserving code #550

Open
masak opened this issue Sep 25, 2019 · 1 comment
Open

Try fuzzing Alma code by injecting semantics-preserving code #550

masak opened this issue Sep 25, 2019 · 1 comment

Comments

@masak
Copy link
Owner

masak commented Sep 25, 2019

  • Start from one of the examples
  • As many times as you want, inject some random code that shouldn't change the meaning of the program.
    • Such as if false { ...deleterious side effects... } or if true { ...original statement... }.
    • Where false and true above could be arbitrarily complex expressions that the fuzzer knows evaluate to false and true.
    • The main part of the fuzzer will be a library of valid bits of code to inject.
  • Run the original code and the changed code.
  • (Optional, but nice) If a difference is detected in output/behavior, try to minimize the injected code that still reproduces such a difference.

I got the idea from this paper which does the same but with graphics shaders.

I have a fairly high confidence in Alma's runtime semantics nowadays. It's been a long time since we found an embarrassing bug in that department. Still, I suspect if we did this, we'd still drag up something, somewhere. 😄

@masak
Copy link
Owner Author

masak commented Sep 25, 2019

Forgot to say: of course we want to inject the code as Qtrees, that is, after parsing the original source.

If the kind of code transformations we need to make there do not feel jQuery-level comfortable, we should define an API layer where they do.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant