Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add eye-fuzz visualization tool #123

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

noloerino
Copy link

This PR adds eye-fuzz, a tool for visualizing the relationship between a source of randomness and generators that I've been working on under the supervision of @carolemieux. See the project repository for how to build and run the tool - the tl;dr is that it provides a javascript interface that lets a user modify the input bytes being fed to a generator class, and to observe its effects on the generator output and produced code coverage. The hope is that this ability to keep a human in the fuzzing loop will make it easier to write better, more robust generators.

I've for now put it as a submodule under examples (the build process is somewhat different from JQF since a significant portion of the code is in Kotlin, and I'm not quite sure how to add another nested maven project within the examples directory), but I'd be happy to copy my source files into whatever directory structure works best.

To test things out: run git submodule update --init --recursive, then cd eye-fuzz and follow the instructions listed in the README. Comments and suggestions are welcome (though I'm not sure how Github comments work on pull requests to add a submodule - again, if it's easier I can copy in the source files instead of making a submodule if that's easier to review).

@rohanpadhye
Copy link
Owner

Thanks for the contribution! Sounds interesting. Will take a look.

@rohanpadhye
Copy link
Owner

I've been trying to build locally using the instructions on your README, but I get the following test errors when running mvn package:

image

And many more similar errors. Do you have an idea of what's going on?

@noloerino
Copy link
Author

Those are expected - an explanation of the cause is under the first error (although it might be kind of hard to see)

Distinct function calls with different stack traces may break history reproduction.
If possible, consider separating calls to random() within the generator onto different lines.

The heart of the problem is basically that I'm tracking program locations as essentially a pair of (stack trace, count), where count is incremented every time a new call to a Random method with the same stack trace is made. There's some somewhat pathological examples of control flow that can make it so that bytes from one call site are improperly used at the other when reproducing a history, for example here.

That said, in most cases I don't think this should be an issue - should I just suppress the warning/have it only appear once?

@rohanpadhye
Copy link
Owner

Ohh, I didn't realize it was just a silent warning. I saw the red text and mistakenly assumed it was the cause of the build failure. I can ignore these warnings. Scrolling down, I see that my build failed due to a different test failure:

...
Acknowledged completion of work request for RERUN_GENERATOR on thread Thread[main,5,main]
Tests run: 2, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 0.033 sec <<< FAILURE!
testLittleEndianLoad(EdgeCaseTest)  Time elapsed: 0.024 sec  <<< FAILURE!
org.junit.ComparisonFailure: expected:<-5590[3873]7> but was:<-5590[7457]7>
	at org.junit.Assert.assertEquals(Assert.java:115)
	at kotlin.test.junit.JUnitAsserter.assertEquals(JUnitSupport.kt:32)
	at kotlin.test.AssertionsKt__AssertionsKt.assertEquals(Assertions.kt:57)
	at kotlin.test.AssertionsKt.assertEquals(Unknown Source)
	at kotlin.test.AssertionsKt__AssertionsKt.assertEquals$default(Assertions.kt:56)
	at kotlin.test.AssertionsKt.assertEquals$default(Unknown Source)
	at EdgeCaseTest$testLittleEndianLoad$1.invoke(EdgeCaseTest.kt:54)
	at EdgeCaseTest$testLittleEndianLoad$1.invoke(EdgeCaseTest.kt:11)
	at TestServerKt.testServer(TestServer.kt:23)
	at EdgeCaseTest.testLittleEndianLoad(EdgeCaseTest.kt:41)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:564)
	at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
	at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
	at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
	at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
	at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
	at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
	at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
	at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
	at org.apache.maven.surefire.junit4.JUnit4TestSet.execute(JUnit4TestSet.java:53)
	at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:123)
	at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:104)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:564)
	at org.apache.maven.surefire.util.ReflectionUtils.invokeMethodWithArray(ReflectionUtils.java:164)
	at org.apache.maven.surefire.booter.ProviderFactory$ProviderProxy.invoke(ProviderFactory.java:110)
	at org.apache.maven.surefire.booter.SurefireStarter.invokeProvider(SurefireStarter.java:172)
	at org.apache.maven.surefire.booter.SurefireStarter.runSuitesInProcessWhenForked(SurefireStarter.java:104)
	at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:70)

Results :

Failed tests:   testLittleEndianLoad(EdgeCaseTest): expected:<-5590[3873]7> but was:<-5590[7457]7>

@noloerino
Copy link
Author

noloerino commented Dec 29, 2020 via email

@noloerino
Copy link
Author

It looks like there were some parallelism bugs that came up about half the time via mvn package but not in IntelliJ, as well as some underlying logic bugs. I've fixed the logic bug and made the identical stack trace warning less frequent, and also forced each test class to run on a new JVM instance. You should be able to see the changes with git submodule update --init --recursive.

@rohanpadhye
Copy link
Owner

Hey I tried this again but there doesn't seem to be any new commit since December 16. The last commit I see is noloerino/eye-fuzz@54b8cc04f, which still gives me the same errors.

@noloerino
Copy link
Author

Looks like I forgot to push, can you check again?

@carolemieux
Copy link
Collaborator

@noloerino I just tried cloning a fresh version of your repo, and ran git submodule update --init --recursive. The last commit in the main repo is 16231be, and in the submodule eye-fuzz it's commit 16231be from Dec 30th. Running with Apache Maven 3.6.0, Java 11, on Ubuntu 18.04.

What I see when mvn package fails is this:

[ERROR] Tests run: 2, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 0.039 s <<< FAILURE! - in Edge
CaseTest                                                                                              
[ERROR] EdgeCaseTest.testLittleEndianLoad  Time elapsed: 0.03 s  <<< FAILURE!                         
java.lang.AssertionError: expected:<246267631> but was:<246272628>                                    
        at org.junit.Assert.fail(Assert.java:88)                                                      
        at org.junit.Assert.failNotEquals(Assert.java:834)                                            
        at org.junit.Assert.assertEquals(Assert.java:118)                                             
        at kotlin.test.junit.JUnitAsserter.assertEquals(JUnitSupport.kt:32)                           
        at kotlin.test.AssertionsKt__AssertionsKt.assertEquals(Assertions.kt:57)                      
        at kotlin.test.AssertionsKt.assertEquals(Unknown Source)                                      
        at kotlin.test.AssertionsKt__AssertionsKt.assertEquals$default(Assertions.kt:56)              
        at kotlin.test.AssertionsKt.assertEquals$default(Unknown Source)                              
        at EdgeCaseTest$testLittleEndianLoad$1.invoke(EdgeCaseTest.kt:54)                             
        at EdgeCaseTest$testLittleEndianLoad$1.invoke(EdgeCaseTest.kt:11)                             
        at TestServerKt.testServer(TestServer.kt:23)                                                  
        at EdgeCaseTest.testLittleEndianLoad(EdgeCaseTest.kt:41)                                      
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)             
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja$
a:62)                                                                                                 
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso$
Impl.java:43)                                                                                         
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
        at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
        at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
        at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
        at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
        at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
        at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
        at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
        at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
        at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
        at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
        at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
        at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
        at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:364)
        at org.apache.maven.surefire.junit4.JUnit4Provider.executeWithRerun(JUnit4Provider.java:272)
        at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:237)
        at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:158)
        at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:428)
        at org.apache.maven.surefire.booter.ForkedBooter.execute(ForkedBooter.java:162)
        at org.apache.maven.surefire.booter.ForkedBooter.run(ForkedBooter.java:562)
        at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:548)

[INFO]
[INFO] Results:
[INFO]
[ERROR] Failures: 
[ERROR]   EdgeCaseTest.testLittleEndianLoad:41 expected:<246267631> but was:<246272628>
[INFO]
[ERROR] Tests run: 4, Failures: 1, Errors: 0, Skipped: 0

@noloerino
Copy link
Author

Sorry for the long turnaround, this got lost in my inbox. I just rebased to latest JQF master and the failure seems to disappear, can you check if that's the case for you? If it still fails, can you also try cloning the eye-fuzz repo independently and running mvn package to see if it encounters the same error?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants