Back to Details

fuzz

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Fuzz rules

模糊测试规则

Use 
packages/fuzz
after focused rule tests pass. Read its 
README.md
for harness architecture and corpus setup.
在聚焦规则测试通过后，使用
packages/fuzz
工具。可阅读其
README.md
了解测试 harness 架构和语料库设置。

Run the harness

运行测试 harness

Run the target rule first:
sh
FUZZ_RULE=<rule-id> FUZZ_STRICT=1 FUZZ_ITERATIONS=500 nr fuzz
Useful variants:
sh
nr fuzz
FUZZ_RULE=<rule-id> FUZZ_SEED=42 nr fuzz
FUZZ_INVARIANTS=1 nr fuzz
FUZZ_CORPUS_DIR=<repository-directory> nr fuzz
FUZZ_RULE=<rule-id> FUZZ_PRINT_SILENT=1 nr fuzz
Confirm that the target rule fires. A silent rule only exercises early exits. If it stays silent, add a triggering shape to 
packages/fuzz/src/snippet-pools.ts
and rerun.
Use 
FUZZ_TAG=<tag>
instead of 
FUZZ_RULE
to exercise an entire registry cohort.
Recommended full sweep (e.g. before a rule-batch release), pointing the corpus at real checkouts. Ready-made corpora work on any machine — see the package README "Canonical corpora": 
bun scripts/sync-fuzz-corpus.ts
materializes a pinned 48-repo sample (symlinking the RDE cache when present, cloning otherwise), and 
bun scripts/build-bench-corpus.ts
extracts react-bench's diagnostic-dense RD-health target files:
sh
cd packages/fuzz
bun scripts/sync-fuzz-corpus.ts
FUZZ_INVARIANTS=1 FUZZ_ITERATIONS=100 FUZZ_CORPUS_DIR=tmp/corpus-repos nr fuzz
Run the direct false-positive check when a rule change affects common syntax:
sh
cd packages/fuzz
bun scripts/hunt-false-positives.ts
先运行目标规则：
sh
FUZZ_RULE=<rule-id> FUZZ_STRICT=1 FUZZ_ITERATIONS=500 nr fuzz
实用变体命令：
sh
nr fuzz
FUZZ_RULE=<rule-id> FUZZ_SEED=42 nr fuzz
FUZZ_INVARIANTS=1 nr fuzz
FUZZ_CORPUS_DIR=<repository-directory> nr fuzz
FUZZ_RULE=<rule-id> FUZZ_PRINT_SILENT=1 nr fuzz
确认目标规则已触发。若规则无输出，说明仅执行了提前退出逻辑。此时需向
packages/fuzz/src/snippet-pools.ts
添加触发代码结构，然后重新运行。
可使用
FUZZ_TAG=<tag>
替代
FUZZ_RULE
，以测试整个规则注册表中的同类规则。
推荐在规则批量发布前进行全面扫描，将语料库指向真实代码仓库。现成的语料库可在任意机器上使用——参考包的README中的“标准语料库”：
bun scripts/sync-fuzz-corpus.ts
会生成一个固定的48个仓库样本（若存在RDE缓存则创建符号链接，否则克隆仓库），而
bun scripts/build-bench-corpus.ts
会从react-bench中提取诊断密集型的RD-health目标文件：
sh
cd packages/fuzz
bun scripts/sync-fuzz-corpus.ts
FUZZ_INVARIANTS=1 FUZZ_ITERATIONS=100 FUZZ_CORPUS_DIR=tmp/corpus-repos nr fuzz
当规则变更影响通用语法时，运行直接误报检查：
sh
cd packages/fuzz
bun scripts/hunt-false-positives.ts

Triage findings

分类处理测试发现

Reproducers live in 
packages/fuzz/tmp/fuzz-findings/
.
  • Crash: minimize the program, add a no-throw regression test, fix the rule, and replay the seed
  • Slow case: profile the pathological shape, bound the walk, and keep the existing threshold
  • Verdict drop: fix detection that depends on incidental syntax, then add the rule to the robustness gate when appropriate
  • Invariant violation: decide whether the rule should react to the rewrite; fix and test unexpected changes
  • False positive: add the valid program to the rule tests and fuzz regression corpus
Replay one finding:
sh
FUZZ_RULE=<rule-id> FUZZ_SEED=<seed> FUZZ_ITERATIONS=1 nr fuzz
复现代码位于
packages/fuzz/tmp/fuzz-findings/
目录下。
  • 崩溃问题：简化程序代码，添加不抛出异常的回归测试，修复规则，然后重新运行对应种子
  • 性能缓慢问题：分析有性能问题的代码结构，限制遍历范围，保留现有阈值
  • 诊断结果丢失：修复依赖于偶然语法的检测逻辑，适当时将规则加入鲁棒性验证门
  • 不变量违规：判断规则是否应对代码重写做出反应；修复并测试意外变更
  • 误报问题：将有效程序添加到规则测试和模糊测试回归语料库中
复现单个测试发现：
sh
FUZZ_RULE=<rule-id> FUZZ_SEED=<seed> FUZZ_ITERATIONS=1 nr fuzz

Preserve false positives

留存误报记录

For every confirmed false positive:
  1. Add a minimal fixture to 
    packages/fuzz/corpus/regressions/<rule-id>--<slug>.tsx
    .
  2. Include the rule ID, weakness class, and source in the fixture header.
  3. Add a focused valid case to the rule test suite.
  4. Add a generator snippet when the existing pools cannot produce the weakness.
  5. Run 
    nr -C packages/fuzz test
    and replay the target rule.
Use a stable weakness name such as 
library-idiom
, 
control-flow
, 
wrapper-transparency
, 
name-heuristic
, 
alias-guard
, 
cross-file
, 
framework-gating
, 
paren-shape
, 
default-parameter
, 
dynamic-computed
, 
private-member
, or 
copy-tracking
.
Project-level dead-code and dependency findings belong in core tests, not the rule fuzzer.
针对每个已确认的误报：
  1. 将最小化的测试用例添加到
    packages/fuzz/corpus/regressions/<rule-id>--<slug>.tsx
    。
  2. 在测试用例头部包含规则ID、问题类型和来源。
  3. 在规则测试套件中添加一个聚焦的有效案例。
  4. 若现有代码池无法生成该问题类型，添加生成器代码片段。
  5. 运行
    nr -C packages/fuzz test
    并重新运行目标规则。
使用稳定的问题名称，例如
library-idiom
（库惯用写法）、
control-flow
（控制流）、
wrapper-transparency
（包装器透明性）、
name-heuristic
（名称启发式）、
alias-guard
（别名防护）、
cross-file
（跨文件）、
framework-gating
（框架门控）、
paren-shape
（括号结构）、
default-parameter
（默认参数）、
dynamic-computed
（动态计算）、
private-member
（私有成员）或
copy-tracking
（副本跟踪）。
项目级的死代码和依赖问题属于核心测试范畴，而非规则模糊测试器的处理范围。

Report results

报告结果

Record the command, target-rule fire count, findings, replay seeds, corpus fixtures, and generator changes. Pass confirmed implementation findings to 
rule-validate
.
记录命令、目标规则触发次数、测试发现、复现种子、语料库测试用例和生成器变更。将已确认的实现问题提交给
rule-validate
。