There is a special case, if "id" attribute is specified in the expand rule, check if there is an already expanded symbol with same id (check in variable_ids[]). If there is one, expanded symbol with the same id is appended to ret_parts[]. If there is no previously expanded symbol with the same id, expanded symbol is saved in the variable_ids['id' value].

Also if symbol has "beforeoutput" attribute, which is one way to call a function when expanding the symbol, expansion result is passed on to the function so that the function can do other work with the expansion result like saving the generated int value.

Lets look at how the function expands the right hand side of the rule.

Symbol is 'text' Expand with the actual text value

Rule is for code line and symbol creates a new tag Generate a new variable name with a predefine format (e.g. fuzzvar00001) Append the new variable's name and type to new_vars[] If newly generated variable's type is same as the type of symbol we are currently expanding, append the variable's name to the ret_vars[]. Final expanded string is '/* newvar{' + var_name + ':' + var_type + '} */ var ' + var_name

Symbol is a constant type Expand the constant type with predefine constant list

Symbol is a builtin type Expand the symbol using predefined builtin type generator

Symbol is a function call Expand with result of function execution

For all other symbols Recursively expand the symbols by calling _generate() with increasing recursion_depth by one



Each expanded result of the right hand side symbols is appended to ret_parts[].

Next, after expanding the symbols in the right hand side of the rule, function checks for all the newly generated variables which are interesting types. Each interesting typed new variables are passed on to the function self._add_variable().

self._add_variable() adds newly generated variable information to the generator context.

If currently adding variable type is not already in the context, it is added to the context['variables'].

Then checks if variable type has interesting lines, or expansion rules that are not creating new

To the context['interesting_lines'], it adds interesting lines of the adding variable type which is not already in the context. Also variable's name is appended to the context['variables'][var_type].

Lastly if there are parent types that this variable type inherits from, its parent type is also added to the context by recursively calling self._add_variable(var_name, parent_type, context).

All the newly generated variables are filled in a line of format like below and appended to the context['lines'] along with final expanded rule.