Skip to content

Optionally collect fuzzer statistics across runs - #9073

Open
tlively wants to merge 2 commits into
mainfrom
fuzz-br-on-cast-more
Open

Optionally collect fuzzer statistics across runs#9073
tlively wants to merge 2 commits into
mainfrom
fuzz-br-on-cast-more

Conversation

@tlively

@tlively tlively commented Sep 4, 2026

Copy link
Copy Markdown
Member

When a new BINARYEN_FUZZ_STATS environment variable is set, collect statistics about fuzzer patterns and events. Save these statistics to a file, where they can be accumulated and updated across several fuzzer runs. The API is designed to make it easy to add new patterns and events for one-off local experiments. Include sample patterns collecting frequencies of various cast instructions as an example.

When a new BINARYEN_FUZZ_STATS environment variable is set, collect statistics about fuzzer patterns and events. Save these statistics to a file, where they can be accumulated and updated across several fuzzer runs. The API is designed to make it easy to add new patterns and events for one-off local experiments. Include sample patterns collecting frequencies of various cast instructions as an example.
@tlively
tlively force-pushed the fuzz-br-on-cast-more branch from 4816e63 to fcdfa85 Compare September 10, 2026 19:01
@tlively
tlively marked this pull request as ready for review September 10, 2026 19:05
@tlively
tlively requested a review from a team as a code owner September 10, 2026 19:05
@tlively
tlively requested review from kripken and removed request for a team September 10, 2026 19:05
@tlively tlively changed the title [WIP] Optionally collect fuzzer statistics across runs Optionally collect fuzzer statistics across runs Sep 10, 2026
Comment thread src/tools/fuzzing/fuzz-stats.cpp Outdated
@@ -0,0 +1,323 @@
/*
* Copyright 2024 WebAssembly Community Group participants

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* Copyright 2024 WebAssembly Community Group participants
* Copyright 2026 WebAssembly Community Group participants

namespace {

struct FuzzStatsVisitor : public FuzzStats::Visitor<FuzzStatsVisitor> {
void visitBrOn(BrOn* curr) {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please comment as to why we collect these and not others.

#define RECORD_EVENT(name, outcome) \
::wasm::FuzzStats::recordEvent((name), __FILE__, __LINE__, (outcome))

#define RECORD_FUZZ_EVENT(name, outcome) RECORD_EVENT(name, outcome)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Who uses this?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No one in the PR. I could add an example usage like we have for the patterns.

Comment thread src/tools/fuzzing/fuzz-stats.h Outdated
const std::map<std::string, uint64_t>& funcMatches);

// CRTP base class for visitors that collect fuzzing pattern statistics.
template<typename SubType> struct Visitor : public PostWalker<SubType> {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The name Visitor is maybe confusing. Walker is contrasted against Visitor in wasm-traversal.h (one visits one node, the other walks all the nodes)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants