FuzzDomain

Remarks

Three operations define a domain: read a corpus entry into one of these, change one, and write one back out. This class does the sandwich — read, mutate, write — so that a target author writes only the three, and so that the two decisions below are made once rather than per grammar.

⚠ The corpus stays bytes, and for a language that costs nothing. A tree's serialization is its source text, which is what a corpus file should contain anyway: it can be read in a diff, committed as a regression, and handed to the real compiler by somebody reproducing a finding. A corpus of serialized trees would be none of those things. The price is a parse per case on the way in and another inside Run, which is real and is worth it.

⚠ Garbage is still generated, and leaving it out is the mistake this design is most likely to make. A tree mutator only ever emits text the printer produced, so the lexer's error paths — an unterminated string, a stray byte, a nesting depth that runs the parser out of stack — stop being reached the moment structure-aware generation replaces byte havoc rather than joining it. A grammar-aware fuzzer that never sends garbage has quietly stopped fuzzing the front end. So one mutation in GarbageIn is byte havoc over the serialized form, and the two run against the same corpus.

Fields and properties (3)

• public const int GarbageIn

  One mutation in this many is byte havoc rather than a change to the tree.

• public const int MaxLength

  The largest input this will produce.

• public abstract string What

  What is being mutated, in one line, for a report.

Methods (7)

• protected FuzzDomain(ulong seed)

  Creates a domain.

• protected abstract bool TryRead(ReadOnlySpan<byte> bytes, out T value)

  Reads a corpus entry.

• protected abstract byte[] Write(T value)

  Writes one back out.

• protected abstract T Mutate(T value, T other, FuzzRandom random)

  Changes one.

• protected abstract T Create(FuzzRandom random)

  Produces a value from nothing.

• public byte[] Mutate(ReadOnlySpan<byte> input, ReadOnlySpan<byte> other, FuzzRandom random)

  Produces a mutant of an input, possibly drawing on another.

• public byte[] Fresh(FuzzRandom random)

  Produces an input from nothing.

Used by (1)

• SyntaxDomainVixen.Fuzz