langfuzz

We compare two different approaches to program generation for language fuzzing: sto (the stochastic grammar approach) and clp (our CLP-based approach). The comparison is a bit misleading because CLP can implement stochastic grammars; in fact, all of the approaches are implemented in SWI-Prolog, a publically-available Prolog engine that contains a constraint solver to implement CLP. The comparison does showcase the additional expressiveness and efficiency of CLP over purely stochastic grammars. While we requested implementations of the existing JavaScript fuzzers jsfunfuzz and LangFuzz from Mozilla for comparison with our technique, our request was ignored. Our entire infrastructure, including our implementation of stochastic grammars and the exact predicates that we use for JavaScript, is available in the supplementary materials located under the Downloads link at http://www.cs.ucsb.edu/~pllab.