New issue
Advanced search Search tips

Issue 745851 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug

Blocking:
issue 729024
issue v8:6612



Sign in to add a comment

Add dictionary for v8 regex fuzzer

Project Member Reported by infe...@chromium.org, Jul 18 2017

Issue description

Blocking: 729024
Components: Blink>JavaScript
Cc: -machenb...@chromium.org jgruber@chromium.org
Blocking: v8:6612
In https://cs.chromium.org/chromium/src/v8/test/fuzzer/regexp/ we already have some sample regexes. Do you suggest adding more?
Yes, it has ~1600 regexes whereas the current sample set is just 23. It should improve coverage hopefully.
How should the samples be provided? As individual files like currently, or is there some format?

Comment 7 by mmoroz@chromium.org, Jul 20 2017

There are two opportunities:

1) seed corpus: https://cs.chromium.org/chromium/src/testing/libfuzzer/fuzzers/BUILD.gn?q=regexp_fuzzer&sq=package:chromium&l=255

existing one is quite small: https://cs.chromium.org/chromium/src/v8/test/fuzzer/regexp/

but you can easily make it:
seed_corpus = [ "//v8/test/fuzzer/regexp/", "another_dir_with_testcaes", "and so on" ]

2) a dictionary (as Abhishek mentioned in the description)

existing one: https://cs.chromium.org/chromium/src/testing/libfuzzer/fuzzers/dicts/regexp.dict?q=regexp.dict&dr

documentation on the format: https://chromium.googlesource.com/chromium/src/testing/libfuzzer/+/HEAD/efficient_fuzzer.md#Fuzzer-Dictionary



The rule of thumb might be: Put relatively large inputs into seed corpus, use small constructions / expressions in dictionary.
Funny. The comment in the dictionary says I made it. I don't even remember.

I'll extract regexps from the test and add them as dict.

Sign in to add a comment