x/website: write a guide for fuzzing

[jayconrod]

We expect to have many users that are encountering fuzzing for the first time. We should write a thorough guide on how to use fuzzing effectively with that audience in mind.

An introductory guide should cover, at minimum:

• What fuzzing is.
• What fuzzing is good for (and not good for).
• How to write a fuzz target.
• How to run fuzzing with go test -fuzz=target, with information about relevant flags.
• What to do with a crasher if one is found
• Strategies for helping the fuzzer if it isn't finding any crashers after running for a while
• Current limitations of the native fuzzing support (e.g. it stops running after the first crash is found, it isn't currently supported to easily integrate with CI)

Some advanced topics that could be covered in other guides:

• Choosing a good seed corpus.
• Measuring coverage.
• Differential fuzzing.
• Fuzzing continuously.

[jayconrod]

We should reconsider what documentation should be part of the go command and where that should be located. Currently, I'm thinking:

• The testing package documentation should have a section on writing a fuzz target. It should explain the signature for the fuzz target (must take a *testing.F), what it must do (call F.Add then F.Fuzz), and what testing will do with it when fuzzing is enabled and disabled. This is meant to be reference documentation.
• go help test and go help testflag should explain all flags, including those related to fuzzing. They should be kept brief, pointing to other sources for more explanation.
• One or more guides on the website should tie this all together. Most users should read those first.
• We should delete go help fuzz. It will be redundant with the guides.

[toothrot]

Checking in on this issue as it's labeled a release blocker for Go 1.18. Is there any update?

[jayconrod]

Not yet. There are a lot of fuzzing issues. We'll get to them as soon as we can.

This one can be done during the freeze.

[gopherbot]

Change https://golang.org/cl/363754 mentions this issue: _content/ref: create fuzz.md with glossary

[toothrot]

@katiehockman Checking in on this as a release-blocking issue. Is there more left to do here?

[katiehockman]

There is more to do on it, and it's in progress. I can remove the release-blocker label though, as we'll keep working on it and get as much done before the release as we can.