tarantool / tarantool / 20169323062

88%

push

github

test/fuzz: support luzer in test_engine

From the beginning the test test_engine.lua was a typical blackbox
fuzzing test. The test generates inputs for a target program
(tarantool in our case) without knowledge of tarantool's internal
behaviour or implementation.

In general, blackbox fuzzing works well when the target is large,
the target is not deterministic for the same input and the target
is slow. The tarantool storage engines are a large,
non-deterministic and slow targets, but using alternative
approaches, like greybox fuzzing, can make more effective by using
information about the tarantool's internal state, typically code
coverage.

The patch introduces support for greybox fuzzing to the
test_engine.lua by supporting a luzer, a coverage-guided, native
Lua fuzzing engine [1]. luzer is not a standalone fuzzing engine,
under the hood it use a well-known and popular fuzzing engine
libFuzzer. The main value of the luzer is that it allows one to
test programs with the Lua interface using a regular fuzzing
engine. The patch left possibility to execute test_engine as
a blackbox test, but it uses greybox fuzzing when luzer Lua module
is available. However, one can set environment variable
`DISABLE_LUZER` and use test in blackbox mode even luzer is
available.

The range for `wal_max_size` is adjusted because `wal_max_size`
must be greater than 1.

1. https://github.com/ligurio/luzer

Follows up #11884
Closes #11906

NO_CHANGELOG=testing
NO_DOC=testing

70280 of 118262 branches covered (59.43%)

105610 of 120494 relevant lines covered (87.65%)

1379412.54 hits per line