Devlog 8: Fuzzing ty and dotfile improvements

It’s been a while since I wrote a dev log. I was working on some networking project and I didn’t really think about other stuff for a few weeks. Now I’m slowly getting back to writing more blogs.

My plan is to share more notes on my blog like my current bookshelf. I’ll probably start with sharing my travels.

Fuzzing Ty#

Fuzzing is a cool technique. With fuzzing you can discover crashes in a codebase that you haven’t worked in before. You might not find the most interesting crashes. But you find crashes.

So what’s fuzzing? You have a huge set of input data for your program. This is called a corpus. A fuzzer program can feed input to your program and detect if it crashes. It can also modify the input to generate new input. The loop is to generate input data, feed it into the program, check for a crash, mutate again.

The mutation can be based on code coverage. The fuzzer can explore random changes to input and try to hit new paths in the program.

It all started after seeing This PR. I wondered if I could find a couple of these panics by fuzzing ty. So I spent a day writing a fuzzer to see how it turns out. I didn’t have prior experience with fuzzing.

The most famous fuzzing tool is probably AFL++. But for ty there was already a fuzzer setup with Rust Fuzz so I used it. I read throughRust Fuzz Book and wrote a fuzzer for autocompletion in ty, and I found three crashes!Debug version panics on autocompletion when cursor is between two bracketsExcessive runtime for nested OrderedDict instancesCalling Enum with a single argument panics

I suspect ty’s fuzzer has not been used for a long time. Following theinstructions, I ran cargo +nightly fuzz run and I immediately got an error.

This build command was for M1 Macs. I’m on Apple silicon but I’m not on M1. Anyway, I then tried the other command that was for non-M1 Macs. Another error.

At this point I started reading the error message to figure out the problem:

= note: Undefined symbols for architecture arm…