Post

Here's Bombadil finding a 1/6^10 probability bug (rolling a die 10 times and finding a particular sequence of numbers) inside Antithesis within minutes.

This was always that one very uncomfortable concession when talking about browser fuzzing: the slowness and the practical impossibility of rewinding time, made it very impractical to do any sort of search through a state space.

Blind random walks are useful and you can definitely find bugs that you hadn't otherwise, but there's so much you're missing out on.

I had various designs where if you at least had isolation, then over time you could *maybe* get somewhere. Building up some graph or tree model of the space, balance exploration vs exploitation, etc. The catch is that the code also changes over time, which greatly complicates building useful models.

Here, instead, we have full-system branching time, and the fuzzer uses client-side JS coverage as part of the objective function. It's all done with default properties in Bombadil, no extra config needed. It takes a few minutes to find the bug, it's all online learning, no over-time complications.