> Property-based testers also often (though not necessarily) try to reduce their example (of the property not holding) to a simpler version thereof, AFAIK few i

> Property-based testers also often (though not necessarily) try to reduce their example (of the property not holding) to a simpler version thereof, AFAIK few if any fuzzer does that. Actually, it's pretty common. Both afl and libFuzzer do this. I'm not sure about the details in libFuzzer, but afl runs a test case minimization round automatically during fuzzing. The afl package also contains a specialized tool afl-tmin that does this more extensively. It should also be mentioned that even more coarsely-grained fuzzers like afl and libFuzzer can be made to detect subtler property contradictions (i.e. less dramatic than crashes) through the use of things like AddressSanitizer/MemorySanitizer and asserts. Libraries like Hypothesis and QuickCheck are in a better position to try to construct a contradiction since they possess more language-level knowledge.