2 ms·

Not sure if this makes sense but is that similar to fuzzing? Or can it be used alongside fuzzing What I am familiar is with property testing libraries that aut

Not sure if this makes sense but is that similar to fuzzing? Or can it be used alongside fuzzing What I am familiar is with property testing libraries that automatically shrink failing cases, like quickcheck for Haskell, quickcheck for Rust and Hypothesis for Python. I suppose that if we modelled C code as an AST one could use quickcheck to shrink a test case. Is creduce like this, but operating on strings rather than trees? https://stackoverflow.com/questions/16968549/what-is-a-shrink-with-regard-to-haskells-quickcheck https://stackoverflow.com/questions/16968549/what-is-a-shrin...

gergo_barany 2y ago
Yes, the kind of test case reduction that C-Reduce does is analogous to QuickCheck's shrinking. Some of C-Reduce's transformations are purely "on strings", e.g., "delete a physical line from the file", others are a bit more syntax-aware, e.g., "delete N tokens", and some actually build an AST using Clang and do some semantic transformations like "replace function parameter by global variable". And yes, this is used alongside fuzzing, once a fuzzer (like Csmith from the same group as C-Reduce) has found a file that provokes a bug. A reducer is not a fuzzer itself, although with some ingenuity it can be made to behave like a fuzzer in certain contexts: https://blog.regehr.org/archives/1284 https://blog.regehr.org/archives/1284