Fuzzer: Segfault on parameter as generate condition
Running the attached testcase with:
verilator_bin --lint-only 8.sv
Verilator 4.020 devel rev v4.020-56-gbcb766bProduces:
%Error: 8.sv:1: Parameter without initial value is never given value (IEEE 1800-2017 6.20.1): 'P' : ... In instance m module m#(parameter P); ^ %Warning-WIDTH: 8.sv:4: Logical Operator GENFOR expects 1 bit on the For Test Condition, but For Test Condition's VARREF 'P' generates 32 bits. : ... In instance m for(j=0;P;j++) ^~~ ... Use "/* verilator lint_off WIDTH */" and lint_on around source to disable this message. %Error: 8.sv:4: Non-genvar used in generate for: 'j' : ... In instance m for(j=0;P;j++) ^~~ Segmentation fault (core dumped)
#3 Updated by Eric Rippey 13 days ago
Regarding only crashes with no output, that's easier said than done. I don't know of any fuzzer capable of doing that out of the box. And fuzzers tend to find many different ways to get to the same problem when a problem stays in the program.
If you still wanted to automatically find bugs effectively under that sort of constraint, you might have to go about this in completely the opposite direction where you start out with known-valid input the way that something like Csmith (https://embed.cs.utah.edu/csmith/) works. That's kind of a major project though because I don't know of an equivalent for Verilog.
Also available in: Atom