Per Ally's suggestion and owing to an observation that, actions generally being atomic and composable, it will often be the case that we want to 'recommend' to the fuzzer randomiser that we pick particular other actions.
For instance:
if we've just run a dead-code introducing action, we could do with adding actions that insert into dead-code;
if we've just run an if-true surrounding action, we should boost if-negating actions, to make up for our lack of if-false actions;
if we've just inserted a loop, we should boost the early-out-at-end action to boost the possibility of getting Morisset-style deadcode loops.
Ally's suggestion was that these 'synergistic' recommendations form a queue that gets added-to at the end of an action; the randomiser can dip into while picking actions, say, with 50/50 probability.
A further idea would be to suggest paths, too (so that actions that just inserted something can lead into other actions transforming them). I'll file this as a separate issue, as it's likely a lot more complex (paths, being relative, get invalidated quickly by insertions and transformations).
MattWindsor91
commented
4 years ago
Per Ally's suggestion and owing to an observation that, actions generally being atomic and composable, it will often be the case that we want to 'recommend' to the fuzzer randomiser that we pick particular other actions.
For instance:
Ally's suggestion was that these 'synergistic' recommendations form a queue that gets added-to at the end of an action; the randomiser can dip into while picking actions, say, with 50/50 probability.
A further idea would be to suggest paths, too (so that actions that just inserted something can lead into other actions transforming them). I'll file this as a separate issue, as it's likely a lot more complex (paths, being relative, get invalidated quickly by insertions and transformations).