feat(fuzz): cargo-fuzz harnesses for ARM instruction selection (#82)

[avrabe]

Closes #82 (scaffolds the fuzz directory and the smoke job; long-budget
nightly campaigns and capstone-differential are left as follow-ups on
the same issue).

Why

synth's V&V coverage matrix has property-tests, Rocq proofs, and Z3
translation validation, but no cargo-fuzz. ARM-codegen edges — encoding
corner cases, instruction-mix edge cases, odd register allocations — are
exactly where silent mis-compilations live and where fuzzing pays the
most.

Concrete evidence: issue #93 (silicon-blocking) escaped every existing
check because the bug — optimizer_bridge::wasm_to_ir silently mapping
three i32↔i64 conversion ops to Opcode::Nop via a _ => fallback —
left an IR that looked perfectly well-formed to type-based checkers. A
single-op fuzz harness would have flagged it in seconds.

What

Adds fuzz/ (workspace-excluded), with libfuzzer-sys + arbitrary, and
four targeted harnesses. Each harness inverts a bug class — not a
single bug instance — into a fuzz-detectable invariant.

Harness	Bug class	What it asserts
wasm_ops_lower_or_error	lowering panic / unencodable instr	optimize_full + ir_to_arm and select_with_stack each return Ok(_)/Err(_); emitted ArmOps round-trip through ArmEncoder::encode.
wasm_to_ir_roundtrip_op_coverage	silent op drop (issue #93)	Every value-producing wasm op contributes ≥ 1 live IR instruction. Issue-#93 conversion ops are skipped until PR #97 lands; the skip block is documented inline.
i64_lowering_doesnt_clobber_params	AAPCS clobber (issues #85, #86)	For every param p < num_params, no ARM instr emitted from a wasm op preceding LocalGet(p) writes R{p}.
encoder_no_panic	encoder panic on a valid ArmOp	ArmEncoder::encode returns Ok(_)/Err(_) on randomly-parametrised but well-typed ArmOp across ARM32 / Thumb-2 / Thumb-2+VFP.

Each FuzzOp lowers deterministically to one synth_core::WasmOp, so
libfuzzer crashes carry replayable WASM op sequences — drop the saved
artifact into a unit test and the regression is pinned.

CI smoke gate

.github/workflows/fuzz-smoke.yml runs each harness for 60 s on every
PR + push to main, on the same self-hosted Linux pool as the rest of
synth CI ([self-hosted, linux, x64, rust-cpu]). Matrix:

• wasm_ops_lower_or_error
• wasm_to_ir_roundtrip_op_coverage
• i64_lowering_doesnt_clobber_params
• encoder_no_panic

Crash artifacts (corpus + minimised input) are uploaded on failure with
30-day retention.

Verification

• cargo build --workspace clean (synth-fuzz is workspace-excluded; main workspace unaffected).
• cd fuzz && cargo build clean — all four harnesses compile under stable Rust.
• cd fuzz && cargo clippy --all-targets -- -D warnings clean.
• cd fuzz && cargo fmt --check clean.
• Per-harness cargo +nightly fuzz run X -- -max_total_time=60 — runtime validation is left to the CI smoke job (cargo-fuzz needs nightly + libfuzzer ASan, which is not available in the dev sandbox this PR was authored in).

Notes

• Avoided editing optimizer_bridge.rs (PR fix(opt): i64 lowering miscompiles memset-style loop counter on Cortex-M (#93) #97 in flight), arm_backend.rs (feat(opt): direct hi/lo extraction for u64-packed values (#94) #98), instruction_selector.rs (feat(opt): fold constant address into base+offset for memory ops (#95) #96) per task spec.
• Long-budget nightly campaigns (1 h / target with corpus persistence), capstone-differential checks, and corpus-reuse by Z3 are tracked on Add cargo-fuzz targets for ARM-backend instruction selection #82 as follow-ups.

How to run locally

rustup toolchain install nightly
cargo install cargo-fuzz
cd fuzz
cargo +nightly fuzz run wasm_to_ir_roundtrip_op_coverage -- -max_total_time=300

Trace: NFR-002
Refs: #82, #93

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!