mirror of https://github.com/carbon-language/carbon-lang.git synced 2026-09-28 14:10:12 +01:00

Files

T

Chandler CarruthandJon Ross-Perkins 13de9e9d06 Fix outstanding clang-tidy errors. (#3654 )

Recent runs of `clang-tidy` for me started showing more errors, and this
is a collection of changes to address them.

First, I've systematically applied the disabling tag to all C++ rules
under //explorer/... with `buildozer` so we don't spend time analyzing
this code or reporting errors from it. Not sure this was strictly
necessary, but it seemed like a nice consistency improvement.

Next, I disabled a buggy check for missing `default` cases in
`switch`es. It seems to get confused by the fancy conversions in our
`enum_base.h`. We don't miss much with this as the Clang compiler
warnings for `switch` catch most of our actual bugs. I also removed the
local disabling of this now that it is turned off centrally.

Lastly, I added error checking to two file descriptor manipulating calls
in the `file_test` infrastructure.

---------

Co-authored-by: Jon Ross-Perkins <jperkins@google.com>

2024-01-26 18:20:47 +00:00

fuzzer_corpus

Implement syntax changes from #2760 in Explorer (#2906 )

2023-06-15 08:42:14 -07:00

ast_to_proto_main.cpp

Rename //explorer/common to base (#3103 )

2023-08-15 19:23:23 +00:00

ast_to_proto_test.cpp

Rename //testing/util to base (#3104 )

2023-08-15 21:28:56 +00:00

ast_to_proto.cpp

Implement syntax changes from #2760 in Explorer (#2906 )

2023-06-15 08:42:14 -07:00

ast_to_proto.h

Relocate fuzzer files and the explorer_fuzzer rule. (#3017 )

2023-07-25 13:27:56 +00:00

BUILD

Fix outstanding clang-tidy errors. (#3654 )

2024-01-26 18:20:47 +00:00

explorer_fuzzer.cpp

Extract ParseAndExecute as its own library. (#2813 )

2023-05-12 08:00:43 -07:00

fuzzer_util_test.cpp

Relocate fuzzer files and the explorer_fuzzer rule. (#3017 )

2023-07-25 13:27:56 +00:00

fuzzer_util.cpp

Change explorer's file_test to support argument passing to main. (#3032 )

2023-07-28 15:29:51 +00:00

fuzzer_util.h

Relocate fuzzer files and the explorer_fuzzer rule. (#3017 )

2023-07-25 13:27:56 +00:00

README.md

Relocate fuzzer files and the explorer_fuzzer rule. (#3017 )

2023-07-25 13:27:56 +00:00

regen_corpus.py

Do cleanup on explorer fuzzing infrastructure. (#2790 )

2023-04-21 08:23:58 -07:00

README.md

Explorer structured fuzzer

Overview

Fuzz testing is based on generating a large amount of random inputs for a software component in order to trigger bugs and unexpected behavior. Basic fuzzing uses randomly generated arrays of bytes as inputs, which works great for some applications but is problematic for testing the logic that operates on highly structured data, as most random inputs are immediately rejected as invalid before any interesting parts of the code get a chance to run.

Structured fuzzing addresses this issue by ensuring the randomly generated data is itself structured, and as such has a high chance of presenting a valid input.

explorer_fuzzer is a structured fuzzer based on libprotobuf-mutator, which is a library to randomly mutate protobuffers.

The input to the fuzzer is an instance of Carbon::Fuzzing::Carbon proto randomly generated by the libprotobuf-mutator framework. explorer_fuzzer converts the proto to a Carbon source code string, and tries to parse and execute the code using explorer implementation.

Fuzzer data format

libprotobuf-mutator supports fuzzer inputs in either text or binary protocol buffer format. explorer_fuzzer uses text proto format with Carbon proto message definition in testing/fuzzing/carbon.proto.

Incorporating AST changes into the fuzzer

Fuzzer AST representation in carbon.proto needs to be updated when changes are made to the AST, like adding a new AST node classes or changing relevant data members of existing nodes.

ast_to_proto_test normally should not require direct changes, as tests work off of Carbon test files in testdata.

To incorporate AST changes into fuzzing logic:

Add appropriate AST information to carbon.proto. Use existing similar cases as examples.
Modify proto_to_carbon.cpp which handles printing of a Carbon proto instance as a Carbon source string. For example, add code to print newly introduced proto fields.
Add logic to populate the proto to ast_to_proto.cpp.
Make sure bazel test //explorer/fuzzing:ast_to_proto_test passes with the new changes.

Running the fuzzer

The fuzzer can be run in 'unit test' mode, where the fuzzer executes on each input file from the fuzzer_corpus/ folder, or in 'fuzzing' mode, where the fuzzer will keep generating random inputs and executing the logic on them until a crash is triggered, or forever in a bug-free program ;).

To run in 'unit test' mode:

bazel test //explorer/fuzzing:explorer_fuzzer

To run in 'fuzzing' mode:

bazel build --config=fuzzer //explorer/fuzzing:explorer_fuzzer.full_corpus

bazel-bin/explorer/fuzzing/explorer_fuzzer.full_corpus

Investigating a crash

Typically it's going to be easiest to run explorer on the problematic carbon program directly. You can do this with:

# Convert a specific fuzzer test to a source file
bazel run //testing/fuzzing:proto_to_carbon -- explorer/fuzzing/fuzzer_corpus/abcd1234 > crash.carbon
# Or convert the crash to a source file.
bazel run //testing/fuzzing:proto_to_carbon -- /tmp/crash.textproto > crash.carbon

# Run explorer on the crash.
bazel run //explorer -- crash.carbon

It's also possible to run the fuzzer on a single input:

bazel-bin/explorer/fuzzing/explorer_fuzzer.full_corpus /tmp/crash.textproto

Generating new fuzzer corpus entries

The ability of the fuzzing framework to generate 'interesting' inputs can be improved by providing 'seed' inputs known as the fuzzer corpus. The inputs need to be a Fuzzing::Carbon text proto.

To generate a text proto from Carbon source:

bazel run //explorer/fuzzing:ast_to_proto -- /tmp/crash.carbon > crash.textproto