RavenTarget

Remarks

The deepest target here by a distance, and the only one where "it did not crash" is nearly worthless on its own. Every pass in this pipeline is total by design — the lexer and parser have no throw in them at all, the binder reports and continues, and a backend that cannot express something says so through a diagnostic rather than emitting something that will not compile. So a run watching only for exceptions is watching for something the design says will not happen, and would come back clean while every one of those passes quietly did the wrong thing.

What is checked instead is that each stage agrees with itself:

the tree reproduces the file, byte for byte, valid or not; an incremental reparse equals a full one — the classic bug farm; every diagnostic that escapes is a Diagnostic with an id the language owns; and a module that generated is a module spirv-val accepts.

⚠ The last one is the reason to do any of this, and it catches a class the others cannot. A backend defect does not have to produce a crash or an invalid module — it can produce a valid one that means something else. An implicit-LOD sample in a compute entry point had been silently substituting level zero since July: nothing threw, nothing was reported, every golden file matched because they were regenerated from the same emitter, and the shader was simply not the shader anybody wrote. A validity oracle over a real validator is the only thing in this harness that is not marking its own homework.

⚠ The one finding this target could not write down was a stack overflow, and it is why raven spent two nightlies in VIXEN_FUZZ_SKIP. func F(): float[F()] inside a type sent the binder round ResolveReturnType → BindType → BindArraySize → BindValue → BindInvocation and back, and the CLR ends the process at the guard page with no thread left to record a case — so the run took the other nineteen targets' results with it and no artifact said why. It is raven/70ae34e20b4880ee.bin now that the binder reports RVN2005 instead, which is the whole reason a finding can be a corpus entry: an input that kills the host cannot be one.

Fields and properties (4)

• public string Name

  What to call it on a command line and in a report.

• public string What

  Which receive path this is, in one line.

• public IFuzzDomain Domain

  How its inputs are made, or null for byte havoc.

• public bool NoveltyGuides

  Whether novelty is worth keeping an input for.

Methods (3)

• public long AllowanceFor(int inputLength)

  How many bytes an input may cause to be allocated.

• public void Seed(ICollection<byte[]> corpus)

  Adds well-formed inputs for the mutator to start from.

• public long Run(ReadOnlySpan<byte> input)

  Pushes one input through the decoder.

Used by (2)

• FuzzTargetsVixen.Fuzz
• RavenSeedsVixen.Fuzz