Comment by pfdietz

The Csmith paper. The follow-on paper about Creduce is also worth reading. Creduce takes valid programs and reduces them to smaller valid programs, using some predicate (does this shell script finish with an error code?). This allows hits by Csmith to be greatly minimized automatically. Maintaining validity during shrinking is the central problem.