Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion tooling/greybox_fuzzer/src/coverage.rs
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
//! There are several mechanisms for coverage being used:
//! 1. Standard branch coverage taken from brillig, the same as with standard, non-zk programs (detects which branch has been taken in an if)
//! 2. Conditional move coverage from brillig
//! 3. Novel boolean witness coverage. If ACIR execution was successful, we scan the witness for potential boolean values and detect interesting testcases, if we discover a boolean witness with a state that hasn't been previously encountered.

Check warning on line 8 in tooling/greybox_fuzzer/src/coverage.rs

View workflow job for this annotation

GitHub Actions / Code

Unknown word (testcases)

use std::collections::{HashMap, HashSet};
use std::hash::Hash;
Expand Down Expand Up @@ -150,7 +150,7 @@

pub type BrilligCoverageRanges = Vec<BrilligCoverageItemRange>;

/// Raw brillig coverage is just a buffer of uints that contain counters

Check warning on line 153 in tooling/greybox_fuzzer/src/coverage.rs

View workflow job for this annotation

GitHub Actions / Code

Unknown word (uints)
pub type RawBrilligCoverage = Vec<u32>;

/// Information about the coverage of a single testcase execution
Expand Down Expand Up @@ -199,8 +199,8 @@
pub struct AccumulatedSingleBranchCoverage {
/// A bitmask of encountered powers of 2 of repetitions of this branch
encountered_loop_log2s: u32,
/// Which testcases showed log2 behavior

Check warning on line 202 in tooling/greybox_fuzzer/src/coverage.rs

View workflow job for this annotation

GitHub Actions / Code

Unknown word (testcases)
testcases_involved: [Option<TestCaseId>; 32],

Check warning on line 203 in tooling/greybox_fuzzer/src/coverage.rs

View workflow job for this annotation

GitHub Actions / Code

Unknown word (testcases)
/// The maximum number of iterations of this branch encountered in a single execution
encountered_loop_maximum: u32,
/// Testcase that produced the maximum iterations count
Expand All @@ -214,8 +214,8 @@
pub struct AccumulatedCmpCoverage {
/// How many time during a single execution this comparison had the difference between arguments be this power of 2
encountered_loop_log2s: u32,
/// Which testcases exhibited this behavior

Check warning on line 217 in tooling/greybox_fuzzer/src/coverage.rs

View workflow job for this annotation

GitHub Actions / Code

Unknown word (testcases)
testcases_involved: [Option<TestCaseId>; 32],

Check warning on line 218 in tooling/greybox_fuzzer/src/coverage.rs

View workflow job for this annotation

GitHub Actions / Code

Unknown word (testcases)
/// The maximum number of iterations of this comparison with this difference log encountered in a single execution
encountered_loop_maximum: u32,
/// Which testcase exhibited this behavior
Expand All @@ -234,7 +234,7 @@
pub struct AccumulatedFuzzerCoverage {
/// All observed states of boolean witnesses
acir_bool_coverage: HashSet<AcirBoolState>,
/// Testcases in which the boolean states have been observed

Check warning on line 237 in tooling/greybox_fuzzer/src/coverage.rs

View workflow job for this annotation

GitHub Actions / Code

Unknown word (Testcases)
bool_state_to_testcase_id: HashMap<AcirBoolState, TestCaseId>,
/// Branch coverage in brillig that has been observed
brillig_branch_coverage: Vec<AccumulatedSingleBranchCoverage>,
Expand Down Expand Up @@ -743,7 +743,7 @@
// TODO(Parse constants in brillig and add to the dictionary)
| BrilligOpcode::Const { .. }
| BrilligOpcode::IndirectConst { .. }
| BrilligOpcode::Return{..} |
| BrilligOpcode::Return |
BrilligOpcode::ForeignCall { .. }
| BrilligOpcode::Mov { .. }
| BrilligOpcode::Load { .. }
Expand Down
58 changes: 29 additions & 29 deletions tooling/greybox_fuzzer/src/mutation/field.rs
Original file line number Diff line number Diff line change
@@ -1,3 +1,32 @@
//! This file contains mechanisms for deterministically mutating a given field value
//! Types of mutations applied:
//! 1. Substitutions
//! 1. With zero
//! 2. With one
//! 3. With minus one
//! 4. With a value from the dictionary (created from analyzing the code of the program and testcases in the corpus)

Check warning on line 7 in tooling/greybox_fuzzer/src/mutation/field.rs

View workflow job for this annotation

GitHub Actions / Code

Unknown word (testcases)
//! 5. With a power of 2
//! 6. With a power of 2 minus 1
//! 2. Inversions
//! 1. Negation
//! 2. Multiplicative inverse
//! 3. Update with a value that is a power of 2
//! 1. Addition
//! 2. Subtraction
//! 3. Multiplication
//! 4. Division
//! 4. Update with a small (1-255) value
//! 1. Addition
//! 2. Subtraction
//! 3. Multiplication
//! 5. Update with a dictionary value
//! 1. Addition
//! 2. Subtraction
//! 3. Multiplication
//!
//! There are configurations for determining probability of each top-level and low-level mutation
//! Currently, the configurations are constant and "new" methods aren't used, but the architecture is prepared for easier introduction of MOpt (Mutation Optimization) technique in the future

use super::configurations::{
BASIC_FIELD_ELEMENT_DICTIONARY_UPDATE_CONFIGURATION,
BASIC_FIELD_ELEMENT_POW_2_UPDATE_CONFIGURATION,
Expand All @@ -10,37 +39,8 @@
use acvm::{AcirField, FieldElement};
use noirc_abi::input_parser::InputValue;
use rand::{Rng, seq::SliceRandom};
use rand_xorshift::XorShiftRng;

Check warning on line 42 in tooling/greybox_fuzzer/src/mutation/field.rs

View workflow job for this annotation

GitHub Actions / Code

Unknown word (xorshift)

/// This file contains mechanisms for deterministically mutating a given field value
/// Types of mutations applied:
/// 1. Substitutions
/// a. With zero
/// b. With one
/// c. With minus one
/// d. With a value from the dictionary (created from analyzing the code of the program and testcases in the corpus)
/// e. With a power of 2
/// f. With a power of 2 minus 1
/// 2. Inversions
/// a. Negation
/// b. Multiplicative inverse
/// 3. Update with a value that is a power of 2
/// a. Addition
/// b. Subtraction
/// c. Multiplication
/// d. Division
/// 4. Update with a small (1-255) value
/// a. Addition
/// b. Subtraction
/// c. Multiplication
/// 5. Update with a dictionary value
/// a. Addition
/// b. Subtraction
/// c. Multiplication
///
/// There are configurations for determining probability of each top-level and low-level mutation
/// Currently, the configurations are constant and "new" methods aren't used, but the architecture is prepared for easier introduction of MOpt (Mutation Optimization) technique in the future
///
const SMALL_VALUE_MAX: u64 = 0xff;
const SMALL_VALUE_MIN: u64 = 1;

Expand All @@ -54,7 +54,7 @@

struct FieldMutator<'a> {
dictionary: &'a Vec<FieldElement>,
prng: &'a mut XorShiftRng,

Check warning on line 57 in tooling/greybox_fuzzer/src/mutation/field.rs

View workflow job for this annotation

GitHub Actions / Code

Unknown word (prng)
}

impl<'a> FieldMutator<'a> {
Expand Down
12 changes: 6 additions & 6 deletions tooling/greybox_fuzzer/src/mutation/string.rs
Original file line number Diff line number Diff line change
Expand Up @@ -18,13 +18,13 @@ use std::cmp::min;

/// This file contains mechanisms for mutating string InputValues. It can perform the following mutations:
/// 1. Value mutations
/// a. Substitution a random character in the string with a random appropriate value from the dictionary
/// b. Substitution of a random character with a random character
/// 1. Substitution a random character in the string with a random appropriate value from the dictionary
/// 2. Substitution of a random character with a random character
/// 2. Structural mutations
/// a. Chaotically splicing the string with itself (constructing a new string from random chunks of initial string)
/// b. Duplication of a random chunk (picking a chunk of the string and inserting it several times)
/// c. Inserting a repeated random value
/// d. Swapping two chunks
/// 1. Chaotically splicing the string with itself (constructing a new string from random chunks of initial string)
/// 2. Duplication of a random chunk (picking a chunk of the string and inserting it several times)
/// 3. Inserting a repeated random value
/// 4. Swapping two chunks
///
/// It also contains the splicing mechanism used when splicing two inputs. It chooses between:
/// 1. Structured splicing (preserving the indices of the values)
Expand Down
5 changes: 2 additions & 3 deletions tooling/nargo_cli/src/cli/check_cmd.rs
Original file line number Diff line number Diff line change
Expand Up @@ -124,9 +124,8 @@ fn create_input_toml_template(
fn default_value(typ: AbiType) -> toml::Value {
match typ {
AbiType::Array { length, typ } => {
let default_value_vec = std::iter::repeat(default_value(*typ))
.take(length.try_into().unwrap())
.collect();
let default_value_vec =
std::iter::repeat_n(default_value(*typ), length.try_into().unwrap()).collect();
toml::Value::Array(default_value_vec)
}
AbiType::Struct { fields, .. } => {
Expand Down
4 changes: 2 additions & 2 deletions tooling/nargo_cli/src/cli/fuzz_cmd.rs
Original file line number Diff line number Diff line change
Expand Up @@ -362,13 +362,13 @@ fn display_fuzzing_report_and_store(
writer.flush().expect("Failed to flush writer");

match &status {
FuzzingRunStatus::ExecutionPass { .. } => {
FuzzingRunStatus::ExecutionPass => {
writer
.set_color(ColorSpec::new().set_fg(Some(Color::Green)))
.expect("Failed to set color");
writeln!(writer, "ok").expect("Failed to write to stderr");
}
FuzzingRunStatus::MinimizationPass { .. } => {
FuzzingRunStatus::MinimizationPass => {
writer
.set_color(ColorSpec::new().set_fg(Some(Color::Green)))
.expect("Failed to set color");
Expand Down
10 changes: 5 additions & 5 deletions tooling/nargo_cli/src/cli/test_cmd/formatters.rs
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,9 @@ use super::TestResult;
/// 3. For each test, one `test_start_async` event
/// (there's no `test_start_sync` event because it would happen right before `test_end_sync`)
/// 4. For each package, sequentially:
/// a. A `package_start_sync` event
/// b. One `test_end` event for each test
/// a. A `package_end` event
/// 1. A `package_start_sync` event
/// 2. One `test_end` event for each test
/// 3. A `package_end` event
///
/// The reason we have some `sync` and `async` events is that formatters that show output
/// to humans rely on the `sync` events to show a more predictable output (package by package),
Expand Down Expand Up @@ -116,7 +116,7 @@ impl Formatter for PrettyFormatter {
writer.flush()?;

match &test_result.status {
TestStatus::Pass { .. } => {
TestStatus::Pass => {
writer.set_color(ColorSpec::new().set_fg(Some(Color::Green)))?;
write!(writer, "ok")?;
writer.reset()?;
Expand All @@ -138,7 +138,7 @@ impl Formatter for PrettyFormatter {
);
}
}
TestStatus::Skipped { .. } => {
TestStatus::Skipped => {
writer.set_color(ColorSpec::new().set_fg(Some(Color::Yellow)))?;
write!(writer, "skipped")?;
writer.reset()?;
Expand Down
Loading