fuzzing: fault injector

constraint/blueprint.go

@@ -1,5 +1,10 @@
 package constraint
 
+import (
+	"fmt"
+	"math/rand"
+)
+
 type BlueprintID uint32
 
 // Blueprint enable representing heterogeneous constraints or instructions in a constraint system
@@ -24,6 +29,50 @@
 	UpdateInstructionTree(inst Instruction, tree InstructionTree) Level
 }
 
+var MainFaultInjector = newFaultInjector(0, 1, 0.0001)
+
+type faultInjector struct {
+	rnd       *rand.Rand
+	faultProb float64
+	maxFaults int
+	numFaults int
+}
+
+func newFaultInjector(seed int64, maxFaults int, faultProb float64) *faultInjector {
+	return &faultInjector{
+		rnd:       rand.New(rand.NewSource(seed)),
+		faultProb: faultProb,
+		maxFaults: maxFaults,
+	}
+}
+
+func (r *faultInjector) Reset(seed int64, maxFaults int, faultProb float64) {
+	r.rnd = rand.New(rand.NewSource(seed))
+	r.faultProb = faultProb
+	r.maxFaults = maxFaults
+	r.numFaults = 0
+}
+
+func (r *faultInjector) NumFaults() int {
+	return r.numFaults
+}
+
+func (r *faultInjector) Delta() int64 {
+	if r.maxFaults <= r.numFaults {
+		return 0
+	}
+	if r.rnd.Float64() < r.faultProb {
+		d := int64(1)
+		if r.rnd.Float64() < 0.5 {
+			d = -1
+		}
+		fmt.Printf("faultInjector: %d\n", d)
+		r.numFaults++
+		return d
+	}
+	return 0
+}
+
 // Solver represents the state of a constraint system solver at runtime. Blueprint can interact
 // with this object to perform run time logic, solve constraints and assign values in the solution.
 type Solver interface {

internal/generator/backend/template/representations/solver.go.tmpl

@@ -122,6 +122,8 @@ func (s *solver) set(id int, value fr.Element) {
 	if s.solved[id] {
 		panic("solving the same wire twice should never happen.")
 	}
+	delta := constraint.MainFaultInjector.Delta()
+	value = *(new(fr.Element).Add(&value, new(fr.Element).SetInt64(delta)))
 	s.values[id] = value
 	s.solved[id] = true
 	atomic.AddUint64(&s.nbSolved, 1)