langfuzz

URL

Change Log

When What
April 8th, 2015 Donated by Kyle Dewey

Reference

Studies who have been using the data (in any form) are required to include the following reference:

@inproceedings{Dewey:2014:LFU:2642937.2642963,
  author = {Dewey, Kyle and Roesch, Jared and Hardekopf, Ben},
  title = {Language Fuzzing Using Constraint Logic Programming},
  booktitle = {Proceedings of the 29th ACM/IEEE International Conference on Automated Software Engineering},
  series = {ASE '14},
  year = {2014},
  isbn = {978-1-4503-3013-8},
  location = {Vasteras, Sweden},
  pages = {725--730},
  numpages = {6},
  url = {http://doi.acm.org/10.1145/2642937.2642963},
  doi = {10.1145/2642937.2642963},
  acmid = {2642963},
  publisher = {ACM},
  address = {New York, NY, USA},
  keywords = {automated program generation, automated testing, fuzzing},
}

About the Data

Overview of Data

We compare two different approaches to program generation for language fuzzing: sto (the stochastic grammar approach) and clp (our CLP-based approach). The comparison is a bit misleading because CLP can implement stochastic grammars; in fact, all of the approaches are implemented in SWI-Prolog, a publically-available Prolog engine that contains a constraint solver to implement CLP. The comparison does showcase the additional expressiveness and efficiency of CLP over purely stochastic grammars. While we requested implementations of the existing JavaScript fuzzers jsfunfuzz and LangFuzz from Mozilla for comparison with our technique, our request was ignored. Our entire infrastructure, including our implementation of stochastic grammars and the exact predicates that we use for JavaScript, is available in the supplementary materials located under the Downloads link at http://www.cs.ucsb.edu/~pllab.

Paper Abstract

Fuzz testing builds confidence in compilers and interpreters. It is desirable for fuzzers to allow targeted generation of programs that showcase specific language features and behaviors. However, the predominant program generation technique used by most language fuzzers, stochastic context-free grammars, does not have this property. We propose the use of constraint logic programming (CLP) for program generation. Using CLP, testers can write declarative predicates specifying interesting programs, including syntactic features and semantic behaviors. CLP subsumes and generalizes the stochastic grammar approach