simplicity: add fuzz target

[delta1]

adds a new fuzz target for elements_simplicity_execSimplicity

compile with instructions in fuzzing.md

run with: FUZZ=simplicity src/test/fuzz/fuzz

[delta1]

Updated to include the expected invariants for control block and script_bytes.

Haven't found any crashes now, and submitted some seed data in ElementsProject/qa-assets#2

Run with: FUZZ=simplicity src/test/fuzz/fuzz /path/to/qa-assets/fuzz_seed_corpus/simplicity

[roconnor-blockstream]

We will probably need to do something about this IMR field. I don't think the fuzzer is going to figure out the hash of the program randomly by itself. I'll look into it.

[roconnor-blockstream]

Sorry, actually it is the scriptCMR that is the problem. This imr is actually an output field (and thus you don't need to fill it with random data).

[roconnor-blockstream]

One idea is to exclude this check when compiling with FUZZER defined mode.

https://github.com/BlockstreamResearch/simplicity/blob/195c5152683330cc34fa4b6d39008a1f6cf09ecb/C/primitive/elements/exec.c#L71-L75

Though the idea of disabling important checks doesn't thrill me. There might be some safer variations of this idea.

[roconnor-blockstream]

One thing we should verify is that the PRODUCTION flag is not enable during fuzzing to ensure all assertions are being run:

https://github.com/BlockstreamResearch/simplicity/blob/master/C/simplicity_assert.h#L12

If there is some sort of FUZZ define, we can add a check/warning to the simplicity code that FUZZ and PRODUCTION are not both set.

[roconnor-blockstream]

@delta1 I don't know why, but running the command

$ PRINT_ALL_FUZZ_TARGETS_AND_ABORT= src/test/fuzz/fuzz

doesn't list "simplicity" for some reason.

[delta1]

@roconnor-blockstream I saw the same issue, made a change in fuzz.cpp and recompiled, and now it seems to appear? Maybe ccache related, are you using that too?

Here's my output with some lines removed for clarity

> PRINT_ALL_FUZZ_TARGETS_AND_ABORT= src/test/fuzz/fuzz
addition_overflow
...
signet
simplicity
snapshotmetadata_deserialize
...
witness_program
fuzz: test/fuzz/fuzz.cpp:66: auto initialize()::(anonymous class)::operator()() const: Assertion `"!should_abort" && check' failed.
zsh: IOT instruction (core dumped)  PRINT_ALL_FUZZ_TARGETS_AND_ABORT= src/test/fuzz/fuzz

The change I made before recompiling was:

diff --git a/src/test/fuzz/fuzz.cpp b/src/test/fuzz/fuzz.cpp
index a33297e0ed..800bcd0354 100644
--- a/src/test/fuzz/fuzz.cpp
+++ b/src/test/fuzz/fuzz.cpp
@@ -27,6 +27,7 @@ std::map<std::string_view, std::tuple<TypeTestOneInput, TypeInitialize, TypeHidd
 
 void FuzzFrameworkRegisterTarget(std::string_view name, TypeTestOneInput target, TypeInitialize init, TypeHidden hidden)
 {
+    std::cout << "register: " << name << std::endl;
     const auto it_ins = FuzzTargets().try_emplace(name, std::move(target), std::move(init), hidden);
     Assert(it_ins.second);
 }

Which I then confirmed printed register: simplicity and then saw simplicity in the target list...

[roconnor-blockstream]

Oops I was building #1326 instead of this PR. My bad.

[roconnor-blockstream]

I've finally got the coverage analysis of fuzzing working, and I will share how to do that with you and everyone else shortly.

However, in the meantime, the results I have suggest to me that tx is always NULL, and thus the fuzzer doesn't even make it past the first line of elements_simplicity_execSimplicity.

I'm not 100% sure of this, so you should double check this.

[delta1]

oh interesting. maybe if we provide a well formed transaction to the fuzzer via the corpus it will have a better starting point

[roconnor-blockstream]

You can probably go ahead and check the return value of elements_simplicity_execSimplicity and assert that it is true. elements_simplicity_execSimplicity only returns false during catastrophic failure, such as malloc failing, or, as in this case, if you have called it with (detectable) incorrect parameters.

The implementation actually does this assertion:

elements/src/script/interpreter.cpp

Lines 3115 to 3117 in 2423e85

	if (!elements_simplicity_execSimplicity(&error, 0, txdata->m_simplicity_tx_data, nIn, simplicityTapEnv, txdata->m_hash_genesis_block.data(), budget, 0, witness.data(), witness.size())) {
	assert(!"elements_simplicity_execSimplicity internal error");
	}

The result of evaluation, (success or what sort of failure) is really returned in the &error argument.

[roconnor-blockstream]

Please rebase this PR. Thanks.

[delta1]

@roconnor-blockstream rebased