[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZN1f0KFwHzkcRRRABSlrbOWd5BEy2LAKXWRM7gTwZrk":3},{"item":4,"related":51},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":39,"sourceName":40,"sourceUrl":41,"status":42,"seoTitle":43,"seoDescription":44,"canonicalUrl":45,"isFeatured":46,"sno":47,"sortOrder":48,"publishedAt":49,"updatedAt":50,"createdAt":50},"eb7f95cb-b835-4505-a6c4-8a6ff846d510","article","Coverage-guided Fuzzing：让测试输入朝“新路径”前进","coverage-guided-fuzzing-ai-coding","覆盖率引导模糊测试根据程序走过的新路径保留输入，帮助 AI 生成代码主动暴露异常数据和隐藏崩溃。","## Coverage-guided Fuzzing：让测试输入朝“新路径”前进\n\n模糊测试通常会向程序输入大量自动生成或随机变异的数据，观察是否出现崩溃、超时或异常结果。Coverage-guided Fuzzing，覆盖率引导模糊测试，则进一步记录每个输入走过的代码区域，优先保留那些能触达新路径的输入。\n\n## 为什么不是单纯随机\n\n随机输入可能一直停留在程序入口附近，因为它们无法满足格式、长度或校验条件。覆盖率引导的工具会观察输入是否让程序进入了新的基本块或分支。如果一个变异让程序走得更深，它就可能被加入语料库，成为后续变异的种子。\n\n这是一种反馈循环：生成输入，运行程序，记录覆盖范围，保留有价值的输入，再继续变异。随着语料库增长，测试可能逐渐探索到更少被触达的路径。\n\n## AI 生成代码为什么需要它\n\nAI 往往会优先实现正常输入和常见场景，而解析器、文件上传、协议处理、压缩解码等代码真正容易出问题的地方，常在异常长度、奇怪编码、嵌套结构和截断数据上。模糊测试不需要模型提前列出所有边界样例，可以主动尝试输入空间。\n\n它特别适合与 AI 协作：AI 可以先写一个清晰的 fuzz target，说明如何把字节输入交给目标函数；工具负责大量变异；人和 AI 再根据崩溃样本缩小原因并修复。发现一个失败输入后，还应把它保存为回归测试，避免未来再次出现。\n\n## 覆盖率高不等于没有 Bug\n\n覆盖率只表示执行到了哪些代码，不表示每条路径的结果都正确。某些错误需要特定状态、时序或外部服务才能触发，单纯扩大覆盖范围也未必发现。模糊测试还可能生成大量重复样本，需要控制运行时间和语料库规模。\n\n## 适合从哪里开始\n\n优先选择输入边界清晰、可重复运行、不会产生不可控副作用的函数，比如解析器、编码解码器、配置读取器和数据转换器。先让 AI 写出输入约束与失败处理，再把工具加入 CI 或定期任务。\n\nLLVM 对覆盖率引导模糊测试的实现方式有详细说明，见 [libFuzzer 官方文档](https:\u002F\u002Fllvm.org\u002Fdocs\u002FLibFuzzer.html)。","\u002Fuploads\u002F2026-09-14\u002F3d4184f7-9b88-4c30-b7c5-79b5f7438598.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31,35],{"id":24,"name":25,"slug":26},"0848beb4-db26-4fb8-b391-f852a11be192","AI编程","ai-coding",{"id":28,"name":29,"slug":30},"144abe77-0dc6-4f66-a176-20bddb1c0bfa","编程","coding",{"id":32,"name":33,"slug":34},"63b56667-dcdb-4b8b-bcbe-c405143a7ec2","测评","test",{"id":36,"name":37,"slug":38},"07b0ad92-5bba-481c-a567-6ae6d32c2122","Bug","bug","官方资料","LLVM libFuzzer","https:\u002F\u002Fllvm.org\u002Fdocs\u002FLibFuzzer.html","published","Coverage-guided Fuzzing 是什么？让 AI 编程主动找 Bug","了解覆盖率引导模糊测试如何变异输入、探索新路径并发现 AI 生成代码中的崩溃。",null,false,54,0,"2026-09-14T00:00:00.000Z","2026-09-14T15:01:47.869Z",[52,61,69],{"id":53,"type":6,"title":54,"slug":55,"summary":56,"coverUrl":57,"authorName":14,"sno":58,"publishedAt":59,"createdAt":60},"88cd83c5-bb5f-411a-85bf-1eefdcacebf4","AI 代码审查能不能替代人类 Code Review","ai-code-review-human-review","AI 很适合做第一轮代码审查，却不一定理解业务语义、风险取舍和变更完整性。本文梳理 AI 审查的强项与盲区，并给出自动检查、AI 建议和人工批准的三层协作方式。","\u002Fuploads\u002F2026-09-13\u002F1ff872e2-ecfe-4bd4-9dd1-327a09a8f6dc.jpg",41,"2026-09-13T00:00:00.000Z","2026-09-13T11:55:47.724Z",{"id":62,"type":6,"title":63,"slug":64,"summary":65,"coverUrl":66,"authorName":14,"sno":67,"publishedAt":49,"createdAt":68},"9ad033ff-1bd4-49bd-b843-635ae2c48eaa","Property-based Testing：不要只测试几个例子","property-based-testing-ai-coding","性质测试通过描述输入输出应保持的规律，自动生成大量边界样本，帮助发现 AI 生成代码中隐藏的错误。","\u002Fuploads\u002F2026-09-14\u002Ff5f43a98-2205-40be-b69c-cba464cac309.jpg",43,"2026-09-14T15:01:45.728Z",{"id":70,"type":6,"title":71,"slug":72,"summary":73,"coverUrl":74,"authorName":14,"sno":75,"publishedAt":59,"createdAt":76},"e958c89d-ebf2-4e02-ad21-b66cf10efa07","AI 写出来的测试靠谱吗？测试通过就代表没问题吗","ai-generated-tests-are-not-proof","AI 可以快速生成测试，但绿色结果只说明当前输入触发了当前断言。本文拆解 AI 测试最常见的遗漏，介绍如何用行为表、真实数据和故障注入判断测试是否真的在保护产品。","\u002Fuploads\u002F2026-09-13\u002F04a1c4c6-4a18-4122-9fb7-e8c237fdee9c.jpg",47,"2026-09-13T11:55:46.344Z"]