Lorenz Nickel
79e478e50e
**I fixed some links and some other minor flaws.** I also found the following outdated links, which I didn't fix: - [This link](https://github.com/dart-lang/pool/tree/zone.strong) in [this file](https://github.com/dart-lang/sdk/blob/master/docs/newsletter/20170728.md) (didn't fix because don't know new location and this is some sort of archive so the link should probably stay the original) - [This link](https://www.dartlang.org/tools/analyzer) in [this file](https://github.com/dart-lang/sdk/blob/master/pkg/analyzer_cli/lib/src/options.dart) (didn't fix since the link is still working, it just gets redirected and the link is part of the programm, I don't want to break anything by changing it, all other links are in comments) - [This link](https://github.com/domokit/mojo/issues/728) in [this file](https://github.com/dart-lang/sdk/blob/master/build/config/compiler/BUILD.gn) (didn't fix since probably has no new location and is part of TODO, which I don't want to change) While doing all this I also noticed that [these tests](https://github.com/dart-lang/sdk/tree/master/tests/compiler/dart2js_extra) contain a lot of other inconsistencies in their comments and the location of the import-statements (I only fixed one which was not link-related), could be target of another PR. Closes #36927 https://github.com/dart-lang/sdk/pull/36927 GitOrigin-RevId: 71d05d0b52d8ec5b92d077a070e066d1fdd4bbfa Change-Id: Ide4b2424fccad8ae2e06c788efd4443dc0de997b Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/102222 Reviewed-by: Michael Thomsen <mit@google.com> Commit-Queue: Michael Thomsen <mit@google.com>
DartLibFuzzer
DartLibFuzzer is a fuzzing tool built with LibFuzzer, which is an in-process, coverage-guided, evolutionary fuzzing engine. The DartLibFuzzer tool consists of a collection of "target functions", each of which stresses a particular part of the Dart runtime and compiler.
How to build and run DartLibFuzzer
Build the dart_libfuzzer binary as follows (first either export DART_USE_ASAN=1 or run ./tools/gn.py --mode=debug --asan):
./tools/build.py \
-m [all|debug|release|product] \
-a [x64|arm64|simarm64] \
dart_libfuzzer
Then, to start a blank fuzzing session on a particular target function (as defined in dart_libfuzzer.cc), run:
dart_libfuzzer [--t=<target-function>]
To start a fuzzing session with an initial corpus inside the directory CORPUS, run:
dart_libfuzzer CORPUS
Background
Although test suites are extremely useful to validate the correctness of a system and to ensure that no regressions occur, any test suite is necessarily finite in size and scope. Tests typically focus on validating particular features by means of code sequences most programmers would expect. Regression tests often use slightly less idiomatic code sequences, since they reflect problems that were not anticipated originally, but occurred “in the field”. Still, any test suite leaves the developer wondering whether undetected bugs and flaws still linger in the system.
Over the years, fuzz testing has gained popularity as a testing technique for discovering such lingering bugs, including bugs that can bring down a system in an unexpected way. Fuzzing refers to feeding a large amount of random data as input to a system in an attempt to find bugs or make it crash. Generation-based fuzz testing constructs random, but properly formatted input data. Mutation-based fuzz testing applies small random changes to existing inputs in order to detect shortcomings in a system. Profile-guided or coverage-guided fuzz testing adds a direction to the way these random changes are applied. Multi-layered approaches generate random inputs that are subsequently mutated at various stages of execution.
The randomness of fuzz testing implies that the size and scope of testing is no longer bounded. Every new run can potentially discover bugs and crashes that were hereto undetected.