Fuzzing Phil's compiler
A fuzzer writes thousands of programs, some sensible and some deliberately broken, and runs Phil's own compiler on every one. It is looking for the compiler falling over, never answering, or giving a wrong answer.
What it looks for, and what it has found
Only counts are published here. The inputs that trigger each finding go to Phil's author first, as Phil's security policy asks for anything that could be an acceptance problem.
How it works
The compiler is the unmodified philc from the Phil repository, built to WebAssembly, so each run takes a few milliseconds and cannot affect anything outside itself. Three kinds of input are generated: small programs whose result is worked out as they are built, so the compiler's answer can be checked; damaged copies of real programs, where the only rule is “do not crash or hang”; and inputs of growing size, to see how the compiler's time grows. Each finding is shrunk to the smallest input that still shows it.
Phil's compiler accepts a small part of the language today, so the programs with checkable answers are simple: bindings and a return. The search widens as the compiler does.
npm run fuzz -- --seconds 120 --seed 1
A run is reproducible from its seed. The source is in fuzz/.