fuzzfp

Overview ¶

Package fuzzfp watches the arguments a fuzz target hands to a builtin and reports the mutation that no builtin may ever perform: reaching inside an LNative to change the Go value a host handed in.

It used to report a second one -- rewriting a value's source location -- and that half is gone; see "# Source: removed on this branch" below for why, and for what covers it now.

Why only that one ¶

A blanket "the arguments came back unchanged" assertion is not available here, because several callables mutate an argument BY DESIGN -- `append!` grows a vector in place, `assoc!` writes a sorted-map, and MacroCall writes to the nodes a macro returns. A guard that fired on those would be turned off within a week. So this package asserts only properties that hold for every callable in the library, and says so in one place rather than leaving each target to decide.

Source: removed on this branch ¶

This package used to watch a second property -- that no builtin rewrites a value's source location -- and issue #318's tracker recorded that as its headline result. It is gone, and it is not coming back in this form.

The rule read LVal.Source as an exported field, and its whole premise was that every value the interpreter builds without a parser behind it points at ONE process-wide token.Location (lisp.nativeSource), so an in-place edit relocated a large fraction of the process. Both halves of that premise were deleted by the sealing work: #362 removed the shared native-source singleton and synthesizes locations on demand (9edf260), and LVal.Source became an unexported field behind a value-copy accessor (69be094). There is no shared Location left to corrupt and no exported pointer left to corrupt it through, so the rule cannot be expressed here and would have nothing to catch.

What replaced it is stronger, not weaker. The sealed-AST fingerprint (lisp/sealfp.go) hashes source CONTENTS as part of each sealed argument's fingerprint, so a location rewrite on any sealed argument is caught by assertion 5 in lisp/lisplib/fuzz_test.go -- and caught as a seal violation, which names the corruption class directly. The one case the old rule covered and the new one does not is a location rewrite on an UNSEALED argument (vectors, maps, natives); that is runtime storage the kernel may legitimately rework, which is why it is unsealed in the first place.

LNative ¶

The tracker's stated reason for recording only an LNative's dynamic type was that formatting an arbitrary Go value can traverse a randomised map. That is true of fmt, and it is a property of fmt rather than of the values: a walk that sorts map entries by their own fingerprint is deterministic over exactly the same inputs. [fingerprintGo] is that walk. It reads unexported fields through reflect without ever calling Value.Interface (which would panic on them), so it sees inside time.Time and *regexp.Regexp, and it breaks cycles on pointer identity so a self-referential native terminates.

Deterministic here means "twice in one process gives the same answer", which is what a before/after comparison needs and is also the strong form: Go randomises map iteration per range statement per run, so two ranges in one process already disagree. TestFingerprintIsDeterministic exercises that directly, and TestGuardIsDeterministicOverGeneratedValues does it over the whole generated corpus.

What is deliberately NOT watched ¶

• Cells, Str, Int, Float, Quoted, Spliced. Legitimately mutated; see above.
• The Native of an LFun (an *LFunData, holding an *LEnv), an LError (a call stack) or an LBytes (a *[]byte). Only nodes whose Type is LNative have their Native fingerprinted, which is what keeps the walk away from an entire environment and from the deliberately-mutable byte slice.
• Meta. Only populated in format-preserving mode, which no builtin target runs in.