fix(encoder): make encode() total under fuzzing + seed corpus (#186) - #189
Merged
Conversation
…sets (#186) The `encoder_no_panic` fuzz target (empty corpus) intermittently found pre-existing panics, making Fuzz Smoke flaky. Two roots, both now closed: the PC/R15-operand debug_assert (#185, fixed in v0.11.4) and arithmetic overflow in the ARM32 branch encoders — `*offset - 2` overflow-panics at i32::MIN under `-Cdebug-assertions`. Use `wrapping_sub` (total, identical for any real branch offset). After this, a 180s sweep ran 8.8M executions with zero panics. Also adds a committed `fuzz/seed_corpus/encoder_no_panic/` (61 inputs promoted from the clean sweep + the #185 PC-reg regression) so CI's 60s run starts with coverage instead of exploring cold — the empty-corpus flakiness root. The i64_lowering_doesnt_clobber_params target has a separate finding (real clobber vs harness false-positive) tracked in #188. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #186 — the
encoder_no_panicfuzz target (empty corpus) intermittently found pre-existing panics, making Fuzz Smoke flaky on every PR.Two roots, both now closed:
verify_reg_bitsdebug_assert — fixed in v0.11.4 (arm encoder: panics (debug_assert) on PC/R15 operand instead of returning Err — fuzz-found, pre-existing #185).*offset - 2overflow-panics ati32::MINunder-Cdebug-assertions. Nowwrapping_sub(total; identical for any real branch offset — synth never emits ani32::MINbranch displacement).Verification
fuzz/seed_corpus/encoder_no_panic/(61 inputs promoted from the clean sweep + the arm encoder: panics (debug_assert) on PC/R15 operand instead of returning Err — fuzz-found, pre-existing #185 PC-reg regression) — the target had no seed corpus, the root of the empty-corpus flakinessScope
The
i64_lowering_doesnt_clobber_paramstarget has a separate finding — aMov R0,R8return-placement flagged as an AAPCS clobber, which is either a real i64-lowering bug or a harness false-positive (the protected LocalGet may be dead). Pre-existing inselect_with_stack(untouched here). Filed with full reproducer as #188 rather than rushed into this release.Closes #186.
🤖 Generated with Claude Code