Skip to content

feat(fuzz): bounded dictionary persistence for invariant coverage runs - #17600

Draft
subwaycookiecrunch wants to merge 1 commit into
foundry-rs:masterfrom
subwaycookiecrunch:fix/invariant-dictionary-persistence
Draft

subwaycookiecrunch wants to merge 1 commit into
foundry-rs:masterfrom
subwaycookiecrunch:fix/invariant-dictionary-persistence

Conversation

@subwaycookiecrunch

Copy link
Copy Markdown
Contributor

Motivation

Exploring selective dictionary persistence from Phase 2 of #14437 against master 678beda4.

Ordinary raw dictionary values and addresses are currently truncated in InvariantTest::end_run at run end. While typed samples and sancov trace-cmp values already have separate persistence paths, ordinary raw values collected during coverage-producing runs are discarded, preventing subsequent runs from utilizing newly discovered inputs.

Solution

This prototype advances the retained raw-value and address dictionary prefixes only when a run produces new coverage:

  • Bounded retention: Retains at most 4,096 additional raw values and 512 additional addresses per worker from coverage-producing runs.
  • Isolation & cleanliness: Setup values and existing trace-cmp persistence remain separate; worker dictionaries stay isolated.
  • Run-local scan cache: Bytecode scan-cache entries stay run-local so recreated bytecode can be scanned again.
  • Preserved non-coverage behavior: Runs without new coverage discard ephemeral values as before.

Validation Status

54 targeted tests passed locally, alongside targeted Clippy and formatting. Full upstream CI and matched fuzzing benchmarks remain pending. Draft for feedback on retention policy.

  • Run-finalization regression test: end_run_promotes_dictionary_only_with_new_coverage fails on baseline and passes with this change.
  • Targeted tests: 17 dictionary-state unit tests and 37 invariant unit tests passed locally.
  • Lint & format: Targeted Clippy (-D warnings) and nightly rustfmt passed.

This PR is submitted as a draft to:

  1. Run full upstream CI across platform matrices (base,monad, workspace-wide features).
  2. Gather maintainer feedback on whether this direction and fixed per-worker bounds (or an alternative eviction policy) are desired before investing in matched campaign benchmarks (foundry-scfuzzbench).

Passing CI checks correctness; separate benchmarks must establish whether fuzzing improves before requesting final review.

PR Checklist

  • Added Tests
  • Added Documentation
  • Breaking changes

Advance retained raw-value and address dictionary prefixes only when an invariant run produces new coverage, bounded to at most 4,096 raw values and 512 addresses per worker.

Bytecode scan caches remain run-local, and setup values and trace-cmp persistence remain separate.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

1 participant