Skip to content
Snippets Groups Projects
Commit f1898c3f authored by klauwier's avatar klauwier Committed by Igor Munkin
Browse files

test/fuzz: fix luaJIT fuzzer timeout

LuaJIT fuzzer used to stop due to timeout caused by infinite cycles and
recursions. Counters were introduced for every cycle and function to
address LuaJIT fuzzer timeouts.

The idea is to add unique counters for every cycle and function to
ensure finite code execution, if it wasn't already. For while, repeat,
for cycles, local and global named, anonymous functions, counters will
be initialized before the code generated from protobuf, and checked
in the first body statement. An entry point for the serializer was
created to count cycles and functions for counter initialization.

The idea was taken from a paper "Program Reconditioning: Avoiding
Undefined Behaviour When Finding and Reducing Compiler Bugs" [1].

Here is an example of a change in serialized code made by this commit.

Before:
```lua
while (true) do
    foo = 'bar'
end
function bar()
    bar()
end
```

After:
```lua
counter_0 = 0
counter_1 = 0
while (true) do
    if counter_0 > 5 then
        break
    end
    counter_0 = counter_0 + 1
    foo = 'bar'
end
function bar()
    if counter_1 > 5 then
        return
    end
    counter_1 = counter_1 + 1
    bar()
end
```
Protobuf structures that reproduce the timeout problem were added to
the LuaJIT fuzzer corpus.

[1] https://www.doc.ic.ac.uk/~afd/homepages/papers/pdfs/2023/PLDI.pdf

NO_CHANGELOG=internal
NO_DOC=fuzzer fix

(cherry picked from commit 4d004bbe)
parent 2ac1a9cf
No related branches found
No related tags found
No related merge requests found
Showing
with 9805 additions and 47 deletions
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment