Repository navigation
feat(fuzz): bounded dictionary persistence for invariant coverage runs - #17600
Draft
subwaycookiecrunch wants to merge 1 commit into
Draft
subwaycookiecrunch wants to merge 1 commit into
subwaycookiecrunch wants to merge 1 commit into
Conversation
Advance retained raw-value and address dictionary prefixes only when an invariant run produces new coverage, bounded to at most 4,096 raw values and 512 addresses per worker. Bytecode scan caches remain run-local, and setup values and trace-cmp persistence remain separate.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Exploring selective dictionary persistence from Phase 2 of #14437 against master
678beda4.Ordinary raw dictionary values and addresses are currently truncated in
InvariantTest::end_runat run end. While typed samples and sancov trace-cmp values already have separate persistence paths, ordinary raw values collected during coverage-producing runs are discarded, preventing subsequent runs from utilizing newly discovered inputs.Solution
This prototype advances the retained raw-value and address dictionary prefixes only when a run produces new coverage:
Validation Status
end_run_promotes_dictionary_only_with_new_coveragefails on baseline and passes with this change.-D warnings) and nightly rustfmt passed.This PR is submitted as a draft to:
base,monad, workspace-wide features).foundry-scfuzzbench).Passing CI checks correctness; separate benchmarks must establish whether fuzzing improves before requesting final review.
PR Checklist