1 files changed, 63 insertions, 0 deletions
diff --git a/tests/drivers/fuzz_malformed.py b/tests/drivers/fuzz_malformed.py
new file mode 100644
index 0000000..5bf97cf
--- /dev/null
+++ b/tests/drivers/fuzz_malformed.py
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+"""Deterministic malformed-source differential fuzzing for compiler hosts.
+
+Usage: python3 tests/drivers/fuzz_malformed.py [native] [microcore]
+"""
+import random
+import subprocess
+import sys
+
+
+bins = sys.argv[1:] or ["bin/zy", "bin/zym"]
+if len(bins) == 1:
+    bins.append(bins[0])
+rng = random.Random(0xC0DE)
+tokens = [
+    b"fn", b"let", b"int", b"char*", b"word", b"return", b"if", b"else",
+    b"while", b"for", b"include", b"std", b";", b"{", b"}", b"(", b")",
+    b"[", b"]", b"=", b",", b".", b":", b"?", b"+", b"-", b"*", b"&",
+    b"|", b"!", b"~", b'"text"', b"'x'", b"0", b"1", b"_", b"NIF",
+    b"asm", b"unchecked", b"\x00", b"\xff", "λ".encode(),
+]
+cases = []
+for i in range(256):
+    words = [rng.choice(tokens) for _ in range(rng.randrange(1, 100))]
+    cases.append(b" ".join(words) + b"\n")
+
+# Mutate a small valid program around parser and analyzer boundaries. Keeping
+# each mutation bounded makes a failing seed easy to reproduce and minimize.
+base = b"include std;\nfn main() { let x = 1; return x; }\n"
+for _ in range(64):
+    data = bytearray(base)
+    for __ in range(rng.randrange(1, 5)):
+        at = rng.randrange(len(data))
+        if rng.randrange(2):
+            data[at:at + 1] = rng.choice(tokens)
+        else:
+            del data[at:at + 1]
+    cases.append(bytes(data))
+
+
+def run(binary, source):
+    return subprocess.run(
+        [binary], input=b"typecheck on;\n" + source, capture_output=True, timeout=3
+    )
+
+
+for i, source in enumerate(cases):
+    results = []
+    for binary in bins:
+        try:
+            result = run(binary, source)
+        except subprocess.TimeoutExpired:
+            raise SystemExit(f"{binary} timed out on malformed seed 0xC0DE case {i}: {source!r}")
+        if result.returncode < 0:
+            raise SystemExit(
+                f"{binary} crashed on malformed seed 0xC0DE case {i}: "
+                f"signal {-result.returncode}, source={source!r}, stderr={result.stderr!r}"
+            )
+        results.append((result.returncode, result.stdout, result.stderr))
+    if any(result != results[0] for result in results[1:]):
+        raise SystemExit(f"compiler hosts disagreed on malformed seed 0xC0DE case {i}: {source!r}")
+
+print(f"ok   malformed-source fuzz: {len(cases)} bounded token and byte mutations agree on {len(bins)} compiler hosts")