A Rust compiler fuzzer
An installation of Rust is required to compile the source code. This can be done by following the instructions here. This will install the latest stable version of Rust.
Python 3.8 is also required to run the script for automated program generation, compilation, running and differential testing. numpy, pandas and json is required to run the Python script.
Clone the repository
git clone https://github.com/jmanchuck/rustsmith.git
The easiest way to run rustsmith is from the runtest.py script in the generated directory.
cd generated
The test command is followed by a count.
python3 runtest.py test 500
This generates 500 programs, and differential tests them one by one. At the end, a results file is generated in the generated directory summarising the test results.
To delete all generated artifacts:
python3 runtest.py clean
To format all generated Rust programs:
python3 runtest.py format
Generated programs go in the rustsmith/generated/src/bin/ directory.
Using the runtest.py script:
python3 runtest.py generate 0
Generates a program seed_0.rs using the random seed 0.
python3 runtest.py generate -c 100
Generates 100 programs, using 0 to 99 as the random seeds.
Compiled programs go in the rustsmith/generated/executables/opt_level/release/ directory.
python3 runtest.py compile 10
Compiles seed_10.rs with 3 separate optimisation levels. This will fail if seed_10.rs does not exist in the generated/src/bin/ directory (use generate command to create it).
python3 runtest.py compile all
Compiles all .rs in the generated/src/bin/ directory with 3 separate optimisation levels.
To run binaries, they must be generated and compiled to the correct directories.
python3 runtest.py run 10
Runs all seed_10 binaries for all optimisation levels.
python3 runtest.py run all
Runs all binaries.
The programs can also be manually generated by using the generated crate.
cd generated
To generate 50 programs, starting from seed 10:
cargo run --release -- -c 50 --s 10
The --release flag tells the compiler to use the highest optimisation level, by default it uses the --debug level.
The source code is split into 3 separate crates under a single workspace.
The generated crate contains the generated programs and is used for generating programs, compiling them, running them and differential testing. All generated artifacts are generated into this crate. It depends on the runtime and smith crate.s
The runtime crate contains safe arithmetic functions that the generated programs. The generated programs contain import statements that import these functions. Moving this directory may cause issues with the generated programs.
The smith crate contains the program generator and the code used to represent the abstract syntax tree of the program.
See the README.md in the smith crate for a breakdown of the source code.
cargo rustc --bin [BIN_NAME] -- --emit=llvm-ir,asm,mir
Output will be in target/debug/deps or target/release/deps depending on optimisation profile.