Skip to content

Commit

Permalink
[dartfuzz] Fix infinite recursion
Browse files Browse the repository at this point in the history
Change-Id: Ie758aae5bf2d455b3232eebfb5a2e960041a4520
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/127581
Commit-Queue: Fizaa Luthra <fizaaluthra@google.com>
Reviewed-by: Ben Konyi <bkonyi@google.com>
Reviewed-by: Aart Bik <ajcbik@google.com>
  • Loading branch information
Fizaa Luthra authored and commit-bot@chromium.org committed Dec 9, 2019
1 parent de0e432 commit 55f86c1
Showing 1 changed file with 19 additions and 10 deletions.
29 changes: 19 additions & 10 deletions runtime/tools/dartfuzz/dartfuzz.dart
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ import 'dartfuzz_type_table.dart';
// Version of DartFuzz. Increase this each time changes are made
// to preserve the property that a given version of DartFuzz yields
// the same fuzzed program for a deterministic random seed.
const String version = '1.76';
const String version = '1.77';

// Restriction on statements and expressions.
const int stmtDepth = 1;
Expand Down Expand Up @@ -81,12 +81,21 @@ abstract class Method {
}, parameters.length, start: 1));
}

void disableRecursionScope(Function callback) {
final originalState = recursionAllowed;
recursionAllowed = false;
callback();
recursionAllowed = originalState;
}

void emitRecursionBaseCase() {
fuzzer.emitIfStatement(() {
fuzzer.emit("$recursionDepthParamName >= ");
fuzzer.emitSmallPositiveInt();
}, () {
fuzzer.emitReturn(terminal: true);
// Temporarily set recursionAllowed to false so that we don't have a
// recursive call in the return statement of the base case.
disableRecursionScope(fuzzer.emitReturn);
return false;
});
}
Expand Down Expand Up @@ -140,7 +149,7 @@ abstract class Method {
final String name;
final List<DartType> parameters;
final DartFuzz fuzzer;
final bool recursionAllowed;
bool recursionAllowed;
}

/// Class for global methods generated by DartFuzz.
Expand All @@ -160,6 +169,9 @@ class FfiMethod extends Method {
void emitFunctionBody() {
fuzzer.emitBraceWrapped(() {
assert(fuzzer.localVars.isEmpty);
if (recursionAllowed) {
emitRecursionBaseCase();
}
if (fuzzer.emitStatements(0)) {
fuzzer.emitReturn();
}
Expand Down Expand Up @@ -1071,13 +1083,13 @@ class DartFuzz {
}

// Emit a return statement.
bool emitReturn({bool terminal = false}) {
bool emitReturn() {
List<DartType> proto = getCurrentProto();
if (proto == null) {
emitLn('return;');
} else {
emitLn('return ', newline: false);
emitExpr(0, proto[0], includeSemicolon: true, terminal: terminal);
emitExpr(0, proto[0], includeSemicolon: true);
}
return false;
}
Expand Down Expand Up @@ -2012,13 +2024,10 @@ class DartFuzz {

// Emit expression.
void emitExpr(int depth, DartType tp,
{RhsFilter rhsFilter,
bool includeSemicolon = false,
// Setting terminal to true forces the emission of a terminal.
bool terminal = false}) {
{RhsFilter rhsFilter, bool includeSemicolon = false}) {
final resetExprStmt = processExprOpen(tp);
// Continuing nested expressions becomes less likely as the depth grows.
if (terminal || (choose(depth + 1) > exprDepth)) {
if (choose(depth + 1) > exprDepth) {
emitTerminal(depth, tp, rhsFilter: rhsFilter);
} else {
// Possibly nested expression.
Expand Down

0 comments on commit 55f86c1

Please sign in to comment.