srg-imperial / GrayC

GrayC: Greybox Fuzzing of Compilers and Analysers for C
https://srg.doc.ic.ac.uk/projects/grayc/
56 stars 1 forks source link

Are there some mutators missing? #8

Closed thomasyonug closed 1 year ago

thomasyonug commented 1 year ago

Hi, I noticed that this codebase has some inconsistencies with your paper. For example, I couldn't find the actual delete operations in the code, which illustrated in your paper to delete sub-expressions from a given expression in a corpus program.

I list the mutator file you guys showed in this project:

utils-fuzzer
assignment-mutator
constant-mutator
delete-mutator
duplicate-mutator
expression-mutator
function-extractor
function-merger
jump-mutator
rename-transform
append-expression
extract-expression
global-extractor

I check the delete-mutator (about statement) and expression-mutator (about expand expression), and they are both Unrelated.

Could you please clarify the relationship between the 'mutator file' and the 'mutator operation' as described in your paper? I am particularly interested in understanding how these two components are connected. Thank you.

arindam-8 commented 1 year ago

Hi,

Apologies for the confusion caused by the names of the mutator files.

Unfortunately there isn't a strict one-to-one mapping between the table and the mutator implementation files. This is because the table describe the kinds of mutations where the clarity of the description is a priority, while the mutator files are structured in the given way as a remnant of the initial development process. Following is a rough mapping guide:

 Duplicate-Statement: DuplicateMutator.cpp
 Delete-Statement: DuplicateMutator.cpp
 Inject-Control-Flow: JumpMutator.cpp
 Delete-Expression: AssignmentMutator.cpp (for DeclStmt RHS expressions) and ExpressionMutator.cpp (For removal of expressions when it tries to build the expression it can skip some old ones hence resulting in deletion of sub-expressions.)
 Expand-Expression: ExpressionMutator.cpp 
 Replace-by-Constant: DeleteMutator.cpp
 Flip-Bit: ConstantMutator.cpp
 Replace-Digit: ConstantMutator.cpp
 Change-Type: ExpressionMutator.cpp
 Replace-Unary-Operator: AssignmentMutator.cpp
 Replace-Function-Body: FunctionMerger.cpp

Please do let me know if you have any other questions.

Thanks Arindam