whatsapp / erlfuzz Goto Github PK

From sys_core_alias.erl:

%% Builds the key used to check if a value can be
%% replaced by an alias. It considers literals,
%% aliases, variables, tuples and cons recursively.
%%
%% We bail out after an arbitrary amount of nodes
%% as very complex expressions may take forever to
%% process otherwise.
-define(DEPTH_LIMIT, 100).
nodes_to_key(Kind, Nodes) ->
    ntk_1(Nodes, [], Kind, ?DEPTH_LIMIT).

ntk_1(_, _Acc, _Kind, 0) ->
    error;

erlfuzz seems unable to generate code that causes the last line in the example (line 333) to be executed because it does not generate deep enough terms.

One way to cause the line to be executed is to compile the following function:

detect_charset({_,undefined} = State) ->
    {State, "Can't detect character encoding due to lack of indata"}.

(Each character in the string adds a depth of 2.)

As far as I can see, erlfuzz never generates literal strings, such "abc".

I think it can be useful to document what constructs erlfuzz never generates. (Alternatively, implement all missing constructs, but that might take a while. 😉 ) Here is a list of things that I've found so far:

• receive and ! (there have been many compiler bugs involving receive)
• Calls to certain functions that returns references, such as make_ref/0, spawn_monitor/1, monitor/2. This blog post about receive optimizations gives some information about why that would be useful.
• Calls to setelement/3 (specially optimized by the compiler; see setelement/3 in the Efficiency Guide)
• Records (mostly useful for testing tools such as pretty-printers, but will also emit code that takes advantage of the setelement/3 optimization mentioned above).
• The pre-processor. Difficult to implement and not useful for finding compiler bugs. Can be useful for testing tools such as language servers and pretty-printers. If it is ever implemented, I suggest it is turned off by default.