This pair of checks doesn't find all decompiler bugs, of course, but it finds quite a few of them. jsfunfuzz has a few other correctness checks for things like unnecessary parentheses in decompiled code and bogus results from object uneval.

i wonder if this works for all js engines
2014-11-07: Fuzzing JPEGs

With instrumented, generational fuzzing, lesser-known features (e.g., progressive, black-and-white, or arithmetic-coded JPEGs) can be discovered and locked onto without requiring a giant, high-quality corpus of diverse test cases to seed the fuzzer with.

This is how we'll accidentally awaken the elder gods.
2016-01-28: syzkaller is a linux kernel fuzzer, and it is finding TONS of bugs. the whole "given enough eyeballs, all bugs are shallow" is clearly total bs, since there aren't many eyeballs at all. but with this, maybe there's some hope to get a kernel that is substantially more secure and less crashy.
2017-04-10: Windows Uniscribe fuzzing

Among the total of 119 vulnerabilities with CVEs fixed by Microsoft in the March Patch Tuesday a few weeks ago, there were 29 bugs reported by us in the font-handling code of the Uniscribe library. Admittedly the subject of font-related security has already been extensively discussed on this blog both in the context of manual analysis and fuzzing. However, what makes this effort a bit different from the previous ones is the fact that Uniscribe is a little-known user-mode component, which had not been widely recognized as a viable attack vector before, as opposed to the kernel-mode font implementations included in the win32k.sys and ATMFD.DLL drivers. In this post, we outline a brief history and description of Uniscribe, explain how we approached at-scale fuzzing of the library, and highlight some of the more interesting discoveries we have made so far. All the raw reports of the bugs we’re referring to (as they were submitted to Microsoft), together with the corresponding proof-of-concept samples, can be found in the official Project Zero bug tracker. Enjoy!

2017-06-27: this library allows you to use powerful linux fuzzers to fuzz windows, where fuzzing appears to be stuck in the stone age:

library that allows native Linux programs to load and call functions from a Windows DLL. the library will process the relocations and imports, then provide a dlopen-like API. The code supports debugging with gdb (including symbols), basic block coverage collection, and runtime hooking and patching.

this library has found 3 windows defender critical vulnerabilities in 2 months
2026-11-04: Coverage-guided fuzzing and LLM commit-auditing agents have complementary blind spots on Chrome's V8 JavaScript engine

Over 6 months of production runs on V8, BigSleep and Fuzzilli discovered a comparable number of actionable security vulnerabilities (45 vs. 37), with only a 25% production overlap (and ~60% theoretical overlap when BigSleep was tasked with rediscovering 112 historic Fuzzilli bugs from their introducing commits). Rather than substituting for fuzzers on hard targets, bug difficulty correlated across both systems, with complementary blind spots: LLM agents excelled on vulnerabilities requiring complex logical state progressions, specific magic values, or newly added syntax unimplemented in fuzzer mutators, whereas coverage-guided fuzzers dominated in V8’s JIT compilers (such as Maglev SSA phi-node representation conflicts) where 2 optimizations are each locally sound in isolation but cause memory corruption when composed at runtime.