a1732b2906
* winch(fuzz): Initial support for differential fuzzing This commit introduces initial support for differential fuzzing for Winch. In order to fuzz winch, this change introduces the `winch` cargo feature. When the `winch` cargo feature is enabled the differential fuzz target uses `wasmi` as the differential engine and `wasm-smith` and `single-inst` as the module sources. The intention behind this change is to have a *local* approach for fuzzing and verifying programs generated by Winch and to have an initial implementation that will allow us to eventually enable this change by default. Currently it's not worth it to enable this change by default given all the filtering that needs to happen to ensure that the generated modules are supported by Winch. It's worth noting that the Wasm filtering code will be temporary, until Winch reaches feature parity in terms of Wasm operators. * Check build targets with the `winch` feature flag * Rename fuzz target feature to `fuzz-winch`
Fuzzing Infrastructure for Wasmtime
This crate provides test case generators and oracles for use with fuzzing.
These generators and oracles are generally independent of the fuzzing engine
that might be using them and driving the whole fuzzing process (e.g. libFuzzer
or AFL). As such, this crate does not contain any actual fuzz targets
itself. Those are generally just a couple lines of glue code that plug raw input
from (for example) libFuzzer into a generator, and then run one or more
oracles on the generated test case.
If you're looking for the actual fuzz target definitions we currently have, they
live in wasmtime/fuzz/fuzz_targets/* and are driven by cargo fuzz and
libFuzzer.