feat: export the fuzzer input layout - #23
Open
N3ur0sis wants to merge 1 commit into
Open
Conversation
The offsets the sampler uses to fill globals were only recoverable by
reading the generated fuzzer.c, so harnesses run against a corpus had no
supported way to address a specific global.
Add --offsets, which publishes the layout twice: as constants in the
generated C (absolution_globals_size plus one absolution_offset_<global>
per global) for code linked into the fuzzer, and as a line-oriented
sidecar for build scripts and corpus tools. Both are opt-in, so output is
unchanged without the flag; absolution_add_fuzzer() always requests them
and exports the path as ${NAME}_OFFSETS_FILE.
Offsets come from the same per-global byte accounting that sizes the seed
file, so the exported total cannot drift from the sampler.
Closes #12
There was a problem hiding this comment.
Pull request overview
Adds a supported way to export the fuzzer input layout (per-global byte offsets and total sampled prefix size) so harnesses and corpus tooling can address specific globals without parsing generated fuzzer.c. This extends the CLI/codegen pipeline and updates the CMake + test harnesses to consistently request (and optionally pin) the exported layout.
Changes:
- Introduces
--offsets <path>to emit (1) linkablesize_toffset constants in generated C and (2) a line-oriented.offsetssidecar file. - Refactors byte accounting into shared IR helpers (
fieldInputBytes/globalInputBytes) and reuses it for both seed sizing and offset export. - Extends integration/unit tests and fixtures to validate compilation of emitted constants and optionally compare
.offsetsgoldens.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| USAGE.md | Documents --offsets outputs (C constants + sidecar format) and intended consumption patterns. |
| README.md | Updates feature list and CLI example to include optional input-layout export. |
| CONTRIBUTING.md | Documents .c.offsets golden files and the new input-layout export entrypoint. |
| src/seed.zig | Reuses shared IR byte accounting for seed sizing to prevent drift. |
| src/main.zig | Adds --offsets CLI option and forwards it into code generation. |
| src/cgen/ir.zig | Adds fieldInputBytes/globalInputBytes helpers to centralize input-byte accounting. |
| src/cgen/emit.zig | Implements layout computation, emits offset constants + sidecar when --offsets is set, adds unit tests. |
| scripts/integration.zig | Always requests offsets during integration runs; compares .offsets to golden when present. |
| scripts/gen-golden.sh | Generates offsets output and refreshes .offsets goldens only when fixtures include them. |
| cmake/RunAbsolution.cmake | Adds optional OFFSETS argument and passes -m/--offsets to the CLI. |
| cmake/AbsolutionFuzzer.cmake | Makes absolution_add_fuzzer() always generate/export the offsets sidecar and expose ${NAME}_OFFSETS_FILE. |
| tests/exported_input_offsets/target.c | New integration fixture covering contiguous bytes, interior padding, arrays, and static mangling. |
| tests/exported_input_offsets/target.c.zon | Golden parsed-module output for the new offsets-focused fixture. |
| tests/exported_input_offsets/target.c.offsets | Golden offsets sidecar output pinned for the new fixture. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #12
The offsets absolution uses to fill globals were only recoverable by reading the
generated
fuzzer.c, so a harness run against a corpus had no supported way toaddress a specific global.
--offsetsexports the layout two ways:absolution_globals_size, plus oneabsolution_offset_<global>per global (astaticuses the mangled name itgets after
objcopyrenaming, since that's what it links as).redef, with aversiondirectiveOffsets reuse the same per-global byte accounting that sizes the seed file, so
the exported total can't drift from what the sampler consumes.
Opt-in: without the flag the generated output is byte-identical to before.
absolution_add_fuzzer()always requests it and exports${NAME}_OFFSETS_FILE.Tests: 132 unit (13 new) + 22 integration — offsets are now requested for every
fixture, so all of them also check the emitted constants compile, and the new
exported_input_offsetsfixture pins exact values. Both release modes and theCMake example verified.