fuzzing: Add initial API call fuzzer
We only generate *valid* sequences of API calls. To do this, we keep track of what objects we've already created in earlier API calls via the `Scope` struct. To generate even-more-pathological sequences of API calls, we use [swarm testing]: > In swarm testing, the usual practice of potentially including all features > in every test case is abandoned. Rather, a large “swarm” of randomly > generated configurations, each of which omits some features, is used, with > configurations receiving equal resources. [swarm testing]: https://www.cs.utah.edu/~regehr/papers/swarm12.pdf There are more public APIs and instance introspection APIs that we have than this fuzzer exercises right now. We will need a better generator of valid Wasm than `wasm-opt -ttf` to really get the most out of those currently-unexercised APIs, since the Wasm modules generated by `wasm-opt -ttf` don't import and export a huge variety of things.
This commit is contained in:
@@ -10,6 +10,8 @@ cargo-fuzz = true
|
||||
|
||||
[dependencies]
|
||||
arbitrary = "0.2.0"
|
||||
env_logger = "0.7.1"
|
||||
log = "0.4.8"
|
||||
wasmtime-fuzzing = { path = "../crates/fuzzing", features = ["env_logger"] }
|
||||
wasmtime-jit = { path = "../crates/jit" }
|
||||
libfuzzer-sys = { git = "https://github.com/rust-fuzz/libfuzzer-sys.git" }
|
||||
@@ -29,3 +31,7 @@ path = "fuzz_targets/instantiate.rs"
|
||||
[[bin]]
|
||||
name = "instantiate_translated"
|
||||
path = "fuzz_targets/instantiate_translated.rs"
|
||||
|
||||
[[bin]]
|
||||
name = "api_calls"
|
||||
path = "fuzz_targets/api_calls.rs"
|
||||
|
||||
27
fuzz/fuzz_targets/api_calls.rs
Executable file
27
fuzz/fuzz_targets/api_calls.rs
Executable file
@@ -0,0 +1,27 @@
|
||||
#![no_main]
|
||||
|
||||
use libfuzzer_sys::fuzz_target;
|
||||
use std::sync::Once;
|
||||
use wasmtime_fuzzing::{generators::api::ApiCalls, oracles};
|
||||
|
||||
fuzz_target!(|api: ApiCalls| {
|
||||
static INIT_LOGGING: Once = Once::new();
|
||||
INIT_LOGGING.call_once(|| env_logger::init());
|
||||
|
||||
log::debug!(
|
||||
"If this fuzz test fails, here is a regression tests:
|
||||
```
|
||||
#[test]
|
||||
fn my_regression_test() {{
|
||||
use wasmtime_fuzzing::generators::{{
|
||||
api::{{ApiCall::*, ApiCalls}},
|
||||
WasmOptTtf,
|
||||
}};
|
||||
wasmtime_fuzzing::oracles::make_api_calls({:#?});
|
||||
}}
|
||||
```",
|
||||
api
|
||||
);
|
||||
|
||||
oracles::make_api_calls(api);
|
||||
});
|
||||
Reference in New Issue
Block a user