diff-fuzzer

A differential testing + fuzzing framework, written in Rust.

Reported upstream

Across two domains — burn's tensor backends, and four ONNX runtimes compared on single-node models — nine reports filed and eight fixes merged, two of them written by other people in response to the report.

report	project	subject	outcome
burn-001	tracel-ai/burn	matmul returns inf against NaN when products overflow	#5284 filed
burn-003	tracel-ai/burn	conv2d padded positions become NaN with a non-finite weight	#5385 fixed, by another contributor
tract-001	sonos/tract	Sign(-0.0) returns -0.0 where ONNX specifies 0	#2670 → #2671 merged
tract-003	sonos/tract	DynamicQuantizeLinear rounds ties away from zero	#2672 merged
candle-001	huggingface/candle	Reshape ignores allowzero=1, and infers -1 against the wrong volume	#3907 → #3908 merged
onnxruntime-001	microsoft/onnxruntime	Where returns +0.0 for a selected -0.0, on both branches	#32191 → #32192 approved, awaiting merge
tract-002	sonos/tract	Reshape ignores allowzero, so a literal zero-length dimension is overwritten	#2699 merged
tract-005	sonos/tract	Reshape hangs or panics on a target shape inference cannot resolve	#2707 → #2708 merged
tract-004	sonos/tract	integer Div and Mod panic on MIN / -1, where Mul already wraps	#2712 → #2713 merged

Two of the four fixes were written by other people. burn-003 was filed as a question, labelled bug by a maintainer, and closed by someone else's pull request, Fix non-finite padding in Flex conv fast paths. The report did the work of establishing that the divergence was real, which mechanism produced it on each backend, and that a control with a finite weight agreed; the fix followed from that without needing us.

And a fix merged that this project did not write. The tract-001 pull request carried a comment that the neighbouring quantized Sign path looked wrong at zero too — flagged explicitly as untested, and kept out of the diff. A maintainer fixed exactly that in #2673, with a quantized regression test. Asking rather than bundling an unverified guess is what turned it into a separate, better-tested change than either of us would have written alone.

Background Information

• Language: Rust
• Software types: tensor libraries (the burn framework's burn-flex, burn-tch and burn-wgpu backends), ONNX runtimes (onnx.reference, ONNX Runtime, tract, candle-onnx), and SQL engines (SQLite, DuckDB).