Skip to content

Add sample-based program generation to the fuzzer - #209

Open
matteB10 wants to merge 1 commit into
microsoft:mainfrom
matteB10:feature/fuzz_samples
Open

Add sample-based program generation to the fuzzer#209
matteB10 wants to merge 1 commit into
microsoft:mainfrom
matteB10:feature/fuzz_samples

Conversation

@matteB10

@matteB10matteB10 commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Extends the Trieste fuzzer so it can build random ASTs out of fragments taken from real sample programs. Sample subtrees are fast-forwarded to the start pass and updated for every subsequent pass when not running with --sequence mode. Experiments show that using samples reduces the number of retries to generate hash unique trees and increases code coverage.

New driver options:

  • --samples takes a one or multiple paths to sample files.
  • --sampling-level: 0 copies a full sample subtree; 1..n copies that many levels of a sample node and lets the generator fill in the rest.
  • `--sampling-frequency, 0–100: how often a sample is used vs. random generation. 0 = never, 100 = always. Defaults to 50%. Stops generating if the tree reaches the ceiling depth.

Example usage for a driver-based reader:
infix_trieste test --samples examples/*.infix --sampling-level 1 --sampling-frequency 50

It is also added for the non-driver based json_fuzzer and yaml_fuzzer, but where the --samples option accepts a single path (possibly a directory).

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@matteB10