Fuzz

Mark a generated value as useful after the property has held.

Total application allocations the platform has served this process so far. Private measurement ownership containers are excluded from all counters.

Read it before and after a region of code and subtract to count that region's allocations. Counts every roc_alloc and roc_realloc; a reallocation counts as one allocation.

The absolute value is meaningless across runs -- the counter is process-wide and the fuzzer reuses the process for millions of inputs -- so always assert on a difference, never on the raw number.

Allocations served but not yet freed.

A region that frees everything it allocates leaves this unchanged. Use it to assert that a property does not leak; see expect_no_leaks!.

roc_realloc calls the platform has served this process so far.

Like alloc_count!, it is process-wide and never reset, so only a difference across a region is meaningful.

roc_dealloc calls the platform has served this process so far.

A reallocation frees the block it replaces without counting a deallocation. Only a difference across a region is meaningful.

Bytes requested from the platform's allocator this process so far.

An allocation adds its requested length and a reallocation adds the full new length it asks for, whether it grows or shrinks the block. A deallocation adds nothing, and a zero-length request adds zero. This is allocator traffic: it is not the heap still in use, the process's resident memory, or the bytes a reallocation copies. A request the allocator cannot serve ends the process, so every request a completed region made is counted. Arithmetic overflow fails explicitly rather than wrapping or saturating. Only a difference across a region is meaningful.

Native scope engine entry point. Prefer start_measure! or measure!.

Native scope engine completion. Invalid or out-of-order scopes fail.

Internal ownership fence preparation. The following return container is platform bookkeeping and is excluded from every allocation observation.

Complete a region while the opaque return container owns every returned value. Transfers that container back unchanged; applications use measure!.

Start a manual window using the same engine as measure!.

Run body! once and automatically record its named allocation statistics. Nested windows are inclusive; the returned value is alive at the boundary.

Record a direct event in the current logical trace region.

Require both named events and every first occurrence before every second. Register before any direct event or completed child region occurs.

Require exactly count occurrences in the current region. Register first.

Forbid an event in the current region. Register before events begin.

Register all rules before emitting events. Validation is independent of the bounded diagnostic trace, so truncation cannot hide a violation.

Crash unless body! performs at most limit allocations.

This is the allocation analogue of a property assertion: it turns a silent performance regression, such as a builtin that stops mutating a uniquely owned value in place, into a fuzz failure.

Crash unless body! performs at least limit allocations.

This is useful for copy-on-write invariants: an operation on shared storage must allocate rather than mutate an alias in place.

Crash unless body! frees everything it allocated.

The result is dropped before the balance is read, so a value that is still alive does not read as a leak.

Discard a generated value that is outside the property's valid domain.

Prefer generators that produce valid inputs directly. Use reject for preconditions that are awkward or expensive to encode in a generator.

Declare a source-authored typed example. Use a zero-argument maker such as make: || Input.{ bytes: [], radix: 10 } to avoid retaining fixtures.

Declare a retained witness using its original bytes and recorded form. Logical rendering never replaces entropy or storage-sensitive artifacts.

Encode a logical value as a mutable corpus seed using platform format v1. Float encoding preserves signed zero, infinities and NaN equivalence; Roc canonicalizes NaN payloads. Use integer bit inputs for payload assertions. On nightly-2026-10-27-de79a0f, derived Dict keys containing records or tuples require --specialize=no because the default compiler backend crashes while specializing those codecs. Scalar and tag keys work with the default backend.

Frame generator entropy while preserving its storage-shape decisions.

Build a fuzz target using the input type's statically dispatched generator.

The input type must define generator_for : FuzzEncoding -> Generator(a). For each fuzzer input, target generates one value, calls test, and uses show when a person asks the runner to render that saved input.

Build a target from an explicit generator.

This is useful for a one-off structural input that does not need a nominal generator_for method. Prefer target when the input type owns its generation policy.

Effectful sibling of target_with.

Use this when the property itself needs the platform's allocation counters, for example to assert that a builtin mutates a uniquely owned value in place instead of reallocating.

Effectful sibling of from_bytes.

Adapt an existing List(U8) -> U8 quality target.

Zero keeps the input; a nonzero byte rejects it. A crash or failed expect remains a failure. New targets usually prefer typed inputs and examples.

Generate the same value without consuming any input bytes.

Transform the value produced by a generator while preserving its state.

Generate two values in sequence and combine them.

Roc's { first: gen_a, second: gen_b }.Fuzz record-builder syntax lowers to this combinator and chains it for larger records. Calling map2 directly is useful for tuples and custom constructors.

Generate any U8 value.

Generate a U8 in the inclusive range from low through high.

The generator crashes if low is greater than high.

Generate any U64 value.

Generate a U64 in the inclusive range from low through high.

The generator crashes if low is greater than high.

Generate an F32, biased toward the values that break float code.

About half of all generated values come from a fixed table of boundary values: quiet, negative, and signalling NaN; positive and negative infinity; positive and negative zero; the smallest and largest subnormals; the smallest normal; 1.0 and -1.0; the machine epsilon; F32.highest and F32.lowest; and 2^24, the first magnitude at which consecutive integers stop being representable. The other half are arbitrary IEEE 754 bit patterns, which are almost always huge or tiny magnitudes.

The generator always consumes five bytes, so composing it into a record does not shift the input bytes that later fields decode. Exhausted input produces 0.0. Use f32_in when the target needs a finite value within known bounds.

Generate a finite F32 in the inclusive range from low through high.

Both endpoints are reachable. Unlike f32, this generator never produces NaN or an infinity. It crashes if either bound is not finite or if low is greater than high.

Generate an F64, biased toward the values that break float code.

About half of all generated values come from a fixed table of boundary values: quiet, negative, and signalling NaN; positive and negative infinity; positive and negative zero; the smallest and largest subnormals; the smallest normal; 1.0 and -1.0; the machine epsilon; F64.highest and F64.lowest; and 2^53, the first magnitude at which consecutive integers stop being representable. The other half are arbitrary IEEE 754 bit patterns, which are almost always huge or tiny magnitudes.

The generator always consumes nine bytes, so composing it into a record does not shift the input bytes that later fields decode. Exhausted input produces 0.0. Use f64_in when the target needs a finite value within known bounds.

Generate a finite F64 in the inclusive range from low through high.

Both endpoints are reachable. Unlike f64, this generator never produces NaN or an infinity. It crashes if either bound is not finite or if low is greater than high.

Generate a byte list with a length and allocation shape chosen from input.

Use raw_bytes when the target must receive every fuzzer byte unchanged.

Generate the complete fuzzer input as one byte list without decoding it.

This is mainly useful for migration and byte-format targets. Typed targets usually get better mutations and clearer properties from smaller generators composed into their real input shape.

Generate a valid UTF-8 Str with varied length and allocation shape.

Generate a list containing at most max_len values.

Lengths range from zero through max_len, inclusive. max_len limits the decoded list length; the runner's maximum raw input size is configured separately.