intermediate changes

ref:cde9a383711a11544ce7e107a78147fb96cc4029

13 files changed, 1368 insertions, 0 deletions

diff --git a/library/cpp/scheme/tests/fuzz_ops/fuzz_ops.cpp b/library/cpp/scheme/tests/fuzz_ops/fuzz_ops.cpp
new file mode 100644
index 0000000000..facde50f5a
--- /dev/null
+++ b/library/cpp/scheme/tests/fuzz_ops/fuzz_ops.cpp
@@ -0,0 +1,6 @@
+#include <library/cpp/scheme/tests/fuzz_ops/lib/fuzz_ops.h>
+
+extern "C" int LLVMFuzzerTestOneInput(const ui8* wireData, const size_t wireSize) {
+    NSc::NUt::FuzzOps({(const char*)wireData, wireSize}, false);
+    return 0;
+}
diff --git a/library/cpp/scheme/tests/fuzz_ops/lib/fuzz_ops.cpp b/library/cpp/scheme/tests/fuzz_ops/lib/fuzz_ops.cpp
new file mode 100644
index 0000000000..8a7facba24
--- /dev/null
+++ b/library/cpp/scheme/tests/fuzz_ops/lib/fuzz_ops.cpp
@@ -0,0 +1,37 @@
+#include "fuzz_ops.h"
+#include "vm_apply.h"
+#include "vm_defs.h"
+#include "vm_parse.h"
+
+#include <library/cpp/bit_io/bitinput.h>
+
+#include <library/cpp/scheme/scheme.h>
+#include <library/cpp/scheme/scimpl_private.h>
+
+#include <util/generic/maybe.h>
+
+namespace NSc::NUt {
+
+    void FuzzOps(TStringBuf wire, bool log) {
+        if (log) {
+            NImpl::GetTlsInstance<NImpl::TSelfLoopContext>().ReportingMode = NImpl::TSelfLoopContext::EMode::Stderr;
+        }
+
+        // We start with a single TValue node
+        TVMState st {wire, 1, 0};
+
+        while (auto act = ParseNextAction(st)) {
+            if (log) {
+                Cerr << " STATE: " << st.ToString() << Endl;
+                Cerr << "ACTION: " << (act ? act->ToString() : TString("(empty)")) << Endl;
+            }
+
+            if (!ApplyNextAction(st, *act)) {
+                break;
+            }
+            if (!NSc::TValue::DefaultValue().IsNull()) {
+                std::terminate();
+            }
+        }
+    }
+}
diff --git a/library/cpp/scheme/tests/fuzz_ops/lib/fuzz_ops.h b/library/cpp/scheme/tests/fuzz_ops/lib/fuzz_ops.h
new file mode 100644
index 0000000000..26ba42eaef
--- /dev/null
+++ b/library/cpp/scheme/tests/fuzz_ops/lib/fuzz_ops.h
@@ -0,0 +1,7 @@
+#pragma once
+
+#include <util/generic/strbuf.h>
+
+namespace NSc::NUt {
+    void FuzzOps(TStringBuf wire, bool log);
+}
diff --git a/library/cpp/scheme/tests/fuzz_ops/lib/vm_apply.cpp b/library/cpp/scheme/tests/fuzz_ops/lib/vm_apply.cpp
new file mode 100644
index 0000000000..ada7b8854f
--- /dev/null
+++ b/library/cpp/scheme/tests/fuzz_ops/lib/vm_apply.cpp
@@ -0,0 +1,302 @@
+#include "vm_apply.h"
+
+namespace NSc::NUt {
+
+#define Y_GEN_TRY_OP(op) \
+    if (!op) { return false; }
+
+#define Y_GEN_SRC_OP(op, arg, st, act) \
+    switch (act.GetSrc(arg).Type) { \
+    case TSrc::T_LREF__POS: \
+        op(st.LRef(act.GetSrc(arg).Pos)); \
+        break; \
+    case TSrc::T_CREF__POS: \
+        op(st.CRef(act.GetSrc(arg).Pos)); \
+        break; \
+    case TSrc::T_RREF__POS: \
+        op(st.RRef(act.GetSrc(arg).Pos)); \
+        break; \
+    default: \
+        Y_FAIL(); \
+    }
+
+
+#define Y_GEN_SRC_TRY_OP(op, arg, st, act) \
+    if (st.CRef(act.GetSrc(arg).Pos).IsSameOrAncestorOf(st.Current())) { \
+        return false; \
+    } \
+    Y_GEN_SRC_OP(op, arg, st, act);
+
+
+#define Y_GEN_DST_OP(op, arg, st, act) \
+    switch (act.GetDst(arg).Type) { \
+    case TDst::T_CREATE_BACK_LREF: \
+        Y_GEN_TRY_OP(st.TryPushBack(op)) \
+        break; \
+    case TDst::T_CREATE_BACK_CREF: \
+        Y_GEN_TRY_OP(st.TryPushBack(std::as_const(op))) \
+        break; \
+    case TDst::T_CREATE_BACK_RREF: \
+        Y_GEN_TRY_OP(st.TryPushBack(std::move(op))) \
+        break; \
+    case TDst::T_CREATE_FRONT_LREF: \
+        Y_GEN_TRY_OP(st.TryPushFront(op)) \
+        break; \
+    case TDst::T_CREATE_FRONT_CREF: \
+        Y_GEN_TRY_OP(st.TryPushFront(std::as_const(op))) \
+        break; \
+    case TDst::T_CREATE_FRONT_RREF: \
+        Y_GEN_TRY_OP(st.TryPushFront(std::move(op))) \
+        break; \
+    case TDst::T_LREF__POS: \
+        st.LRef(act.GetDst(arg).Pos) = op; \
+        break; \
+    case TDst::T_CREF__POS: \
+        st.LRef(act.GetDst(arg).Pos) = std::as_const(op); \
+        break; \
+    case TDst::T_RREF__POS: \
+        st.LRef(act.GetDst(arg).Pos) = std::move(op); \
+        break; \
+    default: \
+        Y_FAIL(); \
+    }
+
+
+#define Y_GEN_REF_OP(op, arg, st, act) \
+    switch (act.GetRef(arg).Type) { \
+    case TRef::T_CREATE_BACK: \
+        Y_GEN_TRY_OP(st.TryPushBack(op)) \
+        break; \
+    case TRef::T_CREATE_FRONT: \
+        Y_GEN_TRY_OP(st.TryPushFront(op)) \
+        break; \
+    case TRef::T_REF__POS: \
+        st.LRef(act.GetRef(arg).Pos) = op; \
+        break; \
+    default: \
+        Y_FAIL(); \
+    }
+
+#define Y_GEN_PTR_OP(op, arg, st, act) \
+    if (auto* r = (op)) { \
+        switch (act.GetRef(arg).Type) { \
+        case TRef::T_CREATE_BACK: \
+            Y_GEN_TRY_OP(st.TryPushBack(*r)) \
+            break; \
+        case TRef::T_CREATE_FRONT: \
+            Y_GEN_TRY_OP(st.TryPushFront(*r)) \
+            break; \
+        case TRef::T_REF__POS: \
+            st.LRef(act.GetRef(arg).Pos) = *r; \
+            break; \
+        default: \
+            Y_FAIL(); \
+        } \
+    }
+
+    bool ApplyNextAction(TVMState& st, TVMAction act) {
+        switch (act.Type) {
+        case VMA_JMP__POS:
+            st.Pos = act.GetPos(0);
+            return true;
+
+        case VMA_CREATE_BACK:
+            Y_GEN_TRY_OP(st.TryPushBack())
+            return true;
+
+        case VMA_CREATE_BACK__SRC:
+            switch (act.GetSrc(0).Type) {
+            case TSrc::T_LREF__POS:
+                Y_GEN_TRY_OP(st.TryPushBack(st.LRef(act.GetSrc(0).Pos)))
+                break;
+            case TSrc::T_CREF__POS:
+                Y_GEN_TRY_OP(st.TryPushBack(st.CRef(act.GetSrc(0).Pos)))
+                break;
+            case TSrc::T_RREF__POS:
+                Y_GEN_TRY_OP(st.TryPushBack(st.RRef(act.GetSrc(0).Pos)))
+                break;
+            default:
+                Y_FAIL();
+            }
+
+            return true;
+
+        case VMA_CREATE_FRONT:
+            Y_GEN_TRY_OP(st.TryPushFront())
+            return true;
+
+        case VMA_CREATE_FRONT__SRC:
+            switch (act.GetSrc(0).Type) {
+            case TSrc::T_LREF__POS:
+                Y_GEN_TRY_OP(st.TryPushFront(st.LRef(act.GetSrc(0).Pos)))
+                break;
+            case TSrc::T_CREF__POS:
+                Y_GEN_TRY_OP(st.TryPushFront(st.CRef(act.GetSrc(0).Pos)))
+                break;
+            case TSrc::T_RREF__POS:
+                Y_GEN_TRY_OP(st.TryPushFront(st.RRef(act.GetSrc(0).Pos)))
+                break;
+            default:
+                Y_FAIL();
+            }
+            return true;
+
+        case VMA_DESTROY_BACK:
+            return st.TryPopBack();
+
+        case VMA_DESTROY_FRONT:
+            return st.TryPopFront();
+
+        case VMA_ASSIGN__SRC:
+            Y_GEN_SRC_OP(st.Current() = , 0, st, act);
+            return true;
+
+        case VMA_SET_STRING__IDX:
+            st.Current().SetString(act.GetString(0));
+            return true;
+
+        case VMA_SET_INT_NUMBER__IDX:
+            st.Current().SetIntNumber(act.GetIntNumber(0));
+            return true;
+
+        case VMA_SET_DICT:
+            st.Current().SetDict();
+            return true;
+
+        case VMA_SET_ARRAY:
+            st.Current().SetArray();
+            return true;
+
+        case VMA_SET_NULL:
+            st.Current().SetNull();
+            return true;
+
+        case VMA_GET_JSON:
+            st.Current().ToJson();
+            return true;
+
+        case VMA_ARRAY_CLEAR:
+            st.Current().ClearArray();
+            return true;
+
+        case VMA_ARRAY_PUSH:
+            st.Current().Push();
+            return true;
+
+        case VMA_ARRAY_PUSH__SRC:
+            Y_GEN_SRC_TRY_OP(st.Current().Push, 0, st, act);
+            return true;
+
+        case VMA_ARRAY_PUSH__DST:
+            Y_GEN_DST_OP(st.Current().Push(), 0, st, act);
+            return true;
+
+        case VMA_ARRAY_POP__REF:
+            Y_GEN_REF_OP(st.Current().Pop(), 0, st, act);
+            return true;
+
+        case VMA_ARRAY_INSERT__IDX:
+            st.Current().Insert(act.GetIdx(0));
+            return true;
+
+        case VMA_ARRAY_INSERT__IDX_SRC:
+            Y_GEN_SRC_TRY_OP(st.Current().Insert(act.GetIdx(0)) = , 1, st, act);
+            return true;
+
+        case VMA_ARRAY_INSERT__IDX_DST:
+            Y_GEN_DST_OP(st.Current().Insert(act.GetIdx(0)), 1, st, act);
+            return true;
+
+        case VMA_ARRAY_DELETE__IDX_REF:
+            Y_GEN_REF_OP(st.Current().Delete(act.GetIdx(0)), 1, st, act);
+            return true;
+
+        case VMA_ARRAY_GET__IDX_REF:
+            Y_GEN_REF_OP(st.Current().Get(act.GetIdx(0)), 1, st, act);
+            return true;
+
+        case VMA_ARRAY_GET_OR_ADD__IDX:
+            st.Current().GetOrAdd(act.GetIdx(0));
+            return true;
+
+        case VMA_ARRAY_GET_OR_ADD__IDX_SRC:
+            Y_GEN_SRC_TRY_OP(st.Current().GetOrAdd(act.GetIdx(0)) = , 1, st, act);
+            return true;
+
+        case VMA_ARRAY_GET_OR_ADD__IDX_DST:
+            Y_GEN_DST_OP(st.Current().GetOrAdd(act.GetIdx(0)), 1, st, act);
+            return true;
+
+        case VMA_ARRAY_GET_NO_ADD__IDX_REF:
+            Y_GEN_PTR_OP(st.Current().GetNoAdd(act.GetIdx(0)), 1, st, act);
+            return true;
+
+        case VMA_DICT_CLEAR:
+            st.Current().ClearDict();
+            return true;
+
+        case VMA_DICT_DELETE__IDX:
+            st.Current().Delete(act.GetKey(0));
+            return true;
+
+        case VMA_DICT_DELETE__IDX_REF:
+            Y_GEN_REF_OP(st.Current().Delete(act.GetKey(0)), 1, st, act);
+            return true;
+
+        case VMA_DICT_GET__IDX_REF:
+            Y_GEN_REF_OP(st.Current().Get(act.GetKey(0)), 1, st, act);
+            return true;
+
+        case VMA_DICT_GET_OR_ADD__IDX:
+            st.Current().GetOrAdd(act.GetKey(0));
+            return true;
+
+        case VMA_DICT_GET_OR_ADD__IDX_SRC:
+            Y_GEN_SRC_TRY_OP(st.Current().GetOrAdd(act.GetKey(0)) = , 1, st, act);
+            return true;
+
+        case VMA_DICT_GET_OR_ADD__IDX_DST:
+            Y_GEN_DST_OP(st.Current().GetOrAdd(act.GetKey(0)), 1, st, act);
+            return true;
+
+        case VMA_DICT_GET_NO_ADD__IDX_REF:
+            Y_GEN_PTR_OP(st.Current().GetNoAdd(act.GetKey(0)), 1, st, act);
+            return true;
+
+        case VMA_MERGE_UPDATE__POS:
+            st.Current().MergeUpdate(st.LRef(act.GetPos(0)));
+            return true;
+
+        case VMA_MERGE_REVERSE__POS:
+            st.Current().ReverseMerge(st.LRef(act.GetPos(0)));
+            return true;
+
+        case VMA_MERGE_COPY_FROM__POS:
+            st.Current().CopyFrom(st.LRef(act.GetPos(0)));
+            return true;
+
+        case VMA_SWAP__POS:
+            st.Current().Swap(st.LRef(act.GetPos(0)));
+            return true;
+
+        case VMA_EQUAL__POS_POS:
+            TValue::Equal(st.CRef(act.GetPos(0)), st.CRef(act.GetPos(1)));
+            return true;
+
+        case VMA_SELECT_NO_ADD__PATH_REF:
+            Y_GEN_REF_OP(st.Current().TrySelect(act.GetPath(0)), 1, st, act);
+            return true;
+
+        case VMA_SELECT_OR_ADD__PATH_REF:
+            Y_GEN_PTR_OP(st.Current().TrySelectOrAdd(act.GetPath(0)), 1, st, act);
+            return true;
+
+        case VMA_SELECT_AND_DELETE__PATH_REF:
+            Y_GEN_REF_OP(st.Current().TrySelectAndDelete(act.GetPath(0)), 1, st, act);
+            return true;
+
+        default:
+            Y_FAIL();
+        }
+    }
+}
diff --git a/library/cpp/scheme/tests/fuzz_ops/lib/vm_apply.h b/library/cpp/scheme/tests/fuzz_ops/lib/vm_apply.h
new file mode 100644
index 0000000000..82906b53fb
--- /dev/null
+++ b/library/cpp/scheme/tests/fuzz_ops/lib/vm_apply.h
@@ -0,0 +1,9 @@
+#pragma once
+
+#include "vm_defs.h"
+
+namespace NSc::NUt {
+
+    bool ApplyNextAction(TVMState& st, TVMAction act);
+
+}
diff --git a/library/cpp/scheme/tests/fuzz_ops/lib/vm_defs.cpp b/library/cpp/scheme/tests/fuzz_ops/lib/vm_defs.cpp
new file mode 100644
index 0000000000..55a971d9e4
--- /dev/null
+++ b/library/cpp/scheme/tests/fuzz_ops/lib/vm_defs.cpp
@@ -0,0 +1,168 @@
+#include "vm_defs.h"
+
+#include <util/generic/xrange.h>
+#include <util/string/builder.h>
+
+namespace NSc::NUt {
+    namespace {
+        TStringBuf GetStringByIdx(ui32 idx) {
+            static const TStringBuf strings[TIdx::ValueCount] {{}, "a", "aa", "aaa"};
+            return strings[idx % TIdx::ValueCount];
+        }
+    }
+
+
+    TVMState::TVMState(TStringBuf wire, ui32 memSz, ui32 pos)
+        : Input(wire)
+        , Memory(memSz)
+        , Pos(pos)
+    {}
+
+    bool TVMState::TryPushBack() {
+        if (MayAddMoreMemory()) {
+            Memory.emplace_back();
+            return true;
+        } else {
+            return false;
+        }
+    }
+
+    bool TVMState::TryPushFront() {
+        if (MayAddMoreMemory()) {
+            Pos += 1;
+            Memory.emplace_front();
+            return true;
+        } else {
+            return false;
+        }
+    }
+
+    bool TVMState::TryPopBack() {
+        if (Memory.size() > 1 && Pos < Memory.size() - 1) {
+            Memory.pop_back();
+            return true;
+        } else {
+            return false;
+        }
+    }
+
+    bool TVMState::TryPopFront() {
+        if (Memory.size() > 1 && Pos > 0) {
+            Memory.pop_front();
+            Pos -= 1;
+            return true;
+        } else {
+            return false;
+        }
+    }
+
+    TString TVMState::ToString() const {
+        TStringBuilder b;
+        b << "pos=" << Pos << ";";
+        for (const auto i : xrange(Memory.size())) {
+            b << " " << i << (i == Pos ? "@" : ".") << Memory[i].ToJson().Quote();
+        }
+
+        return b;
+    }
+
+    TString TIdx::ToString() const {
+        return TStringBuilder() << "IDX:" << Idx;
+    }
+
+    TString TPos::ToString() const {
+        return TStringBuilder() << "POS:" << Pos;
+    }
+
+    template <class T>
+    TString RenderToString(TStringBuf name, T type, ui32 pos) {
+        TStringBuilder b;
+        b << name << ":" << type;
+        if ((ui32)-1 != pos) {
+            b << "," << pos;
+        }
+        return b;
+    }
+
+    TString TRef::ToString() const {
+        return RenderToString("REF", Type, Pos);
+    }
+
+    TString TSrc::ToString() const {
+        return RenderToString("SRC", Type, Pos);
+    }
+
+    TString TDst::ToString() const {
+        return RenderToString("DST", Type, Pos);
+    }
+
+    TString TPath::ToString() const {
+        return TStringBuilder() << "PATH:" << Path.Quote();
+    }
+
+
+    TRef TVMAction::GetRef(ui32 arg) const noexcept {
+        return std::get<TRef>(Arg[arg]);
+    }
+
+    TSrc TVMAction::GetSrc(ui32 arg) const noexcept {
+        return std::get<TSrc>(Arg[arg]);
+    }
+
+    TDst TVMAction::GetDst(ui32 arg) const noexcept {
+        return std::get<TDst>(Arg[arg]);
+    }
+
+    ui32 TVMAction::GetPos(ui32 arg) const noexcept {
+        return std::get<TPos>(Arg[arg]).Pos;
+    }
+
+    ui32 TVMAction::GetIdx(ui32 arg) const noexcept {
+        return std::get<TIdx>(Arg[arg]).Idx;
+    }
+
+    TStringBuf TVMAction::GetKey(ui32 arg) const noexcept {
+        return GetString(arg);
+    }
+
+    TStringBuf TVMAction::GetString(ui32 arg) const noexcept {
+        return GetStringByIdx(GetIdx(arg));
+    }
+
+    i64 TVMAction::GetIntNumber(ui32 arg) const noexcept {
+        return GetIdx(arg);
+    }
+
+    TStringBuf TVMAction::GetPath(ui32 arg) const noexcept {
+        return std::get<TPath>(Arg[arg]).Path;
+    }
+
+
+    struct TActionPrinter {
+        TActionPrinter(IOutputStream& out)
+            : Out(out)
+        {}
+
+        bool operator()(const std::monostate&) const {
+            return true;
+        }
+        //TIdx, TPos, TRef, TSrc, TDst, TPath
+        template <class T>
+        bool operator()(const T& t) const {
+            Out << "; " << t.ToString();
+            return false;
+        }
+        IOutputStream& Out;
+    };
+
+    TString TVMAction::ToString() const {
+        TStringBuilder out;
+        out << Type;
+        for (const auto& arg : Arg) {
+            if (std::visit(TActionPrinter(out.Out), arg)) {
+                break;
+            }
+        }
+        return out;
+    }
+}
diff --git a/library/cpp/scheme/tests/fuzz_ops/lib/vm_defs.h b/library/cpp/scheme/tests/fuzz_ops/lib/vm_defs.h
new file mode 100644
index 0000000000..9a0ddf7351
--- /dev/null
+++ b/library/cpp/scheme/tests/fuzz_ops/lib/vm_defs.h
@@ -0,0 +1,277 @@
+#pragma once
+
+#include <library/cpp/bit_io/bitinput.h>
+#include <library/cpp/scheme/scheme.h>
+
+#include <util/generic/deque.h>
+#include <util/generic/maybe.h>
+#include <util/generic/variant.h>
+#include <util/string/builder.h>
+
+namespace NSc::NUt {
+
+    enum EVMAction {
+        VMA_JMP__POS                    /* "pos=POS" */,
+
+        VMA_CREATE_BACK                 /* "TValue()->emplace_back" */,
+        VMA_CREATE_BACK__SRC            /* "TValue(SRC)->emplace_back" */,
+        VMA_CREATE_FRONT                /* "TValue()->emplace_front,pos+=1" */,
+        VMA_CREATE_FRONT__SRC           /* "TValue(SRC)->emplace_front,pos+=1" */,
+
+        VMA_DESTROY_BACK                /* "pop_back" */,
+        VMA_DESTROY_FRONT               /* "pop_front,pos-=1" */,
+
+        VMA_ASSIGN__SRC                 /* "operator=(SRC)" */,
+
+        VMA_SET_STRING__IDX             /* "SetString(str[IDX])" */,
+        VMA_SET_INT_NUMBER__IDX         /* "SetIntNumber(IDX)" */,
+        VMA_SET_DICT                    /* "SetDict()" */,
+        VMA_SET_ARRAY                   /* "SetArray()" */,
+        VMA_SET_NULL                    /* "SetNull()" */,
+
+        VMA_GET_JSON                    /* "ToJson()" */,
+
+        VMA_ARRAY_CLEAR                 /* "ClearArray()" */,
+        VMA_ARRAY_PUSH                  /* "Push()" */,
+        VMA_ARRAY_PUSH__SRC             /* "Push()=SRC" */,
+        VMA_ARRAY_PUSH__DST             /* "Push()->DST" */,
+        VMA_ARRAY_POP                   /* "Pop()" */,
+        VMA_ARRAY_POP__REF              /* "Pop()->REF" */,
+        VMA_ARRAY_INSERT__IDX           /* "Insert(IDX)" */,
+        VMA_ARRAY_INSERT__IDX_SRC       /* "Insert(IDX)=SRC" */,
+        VMA_ARRAY_INSERT__IDX_DST       /* "Insert(IDX)->DST" */,
+        VMA_ARRAY_DELETE__IDX           /* "Delete(IDX)" */,
+        VMA_ARRAY_DELETE__IDX_REF       /* "Delete(IDX)->REF" */,
+        VMA_ARRAY_GET__IDX_REF          /* "Get(IDX)->REF" */,
+        VMA_ARRAY_GET_OR_ADD__IDX       /* "GetOrAdd(IDX)" */,
+        VMA_ARRAY_GET_OR_ADD__IDX_SRC   /* "GetOrAdd(IDX)=SRC" */,
+        VMA_ARRAY_GET_OR_ADD__IDX_DST   /* "GetOrAdd(IDX)->DST" */,
+        VMA_ARRAY_GET_NO_ADD__IDX_REF   /* "GetNoAdd(IDX)->REF" */,
+
+        VMA_DICT_CLEAR                  /* "ClearDict()" */,
+        VMA_DICT_DELETE__IDX            /* "Delete(str[IDX])" */,
+        VMA_DICT_DELETE__IDX_REF        /* "Delete(str[IDX])->REF" */,
+        VMA_DICT_GET__IDX_REF           /* "Get(str[IDX])->REF" */,
+        VMA_DICT_GET_OR_ADD__IDX        /* "GetOrAdd(str[IDX])" */,
+        VMA_DICT_GET_OR_ADD__IDX_SRC    /* "GetOrAdd(str[IDX])=SRC" */,
+        VMA_DICT_GET_OR_ADD__IDX_DST    /* "GetOrAdd(str[IDX])->DST" */,
+        VMA_DICT_GET_NO_ADD__IDX_REF    /* "GetNoAdd(str[IDX])->REF" */,
+
+        VMA_MERGE_UPDATE__POS           /* "MergeUpdate(POS)" */,
+        VMA_MERGE_REVERSE__POS          /* "ReverseMerge(POS)" */,
+        VMA_MERGE_COPY_FROM__POS        /* "CopyFrom(POS)" */,
+
+        VMA_SWAP__POS                   /* "Swap(POS)" */,
+        VMA_EQUAL__POS_POS              /* "Equal(POS, POS)" */,
+
+        VMA_SELECT_NO_ADD__PATH_REF      /* "TrySelect(PATH)->REF" */,
+        VMA_SELECT_OR_ADD__PATH_REF      /* "TrySelectOrAdd(PATH)->REF" */,
+        VMA_SELECT_AND_DELETE__PATH_REF  /* "TrySelectAndDelete(PATH)->REF" */,
+
+        VMA_COUNT,
+    };
+
+
+    struct TVMState {
+        NBitIO::TBitInput Input;
+        TDeque<TValue> Memory { 1 };
+        ui32 Pos = 0;
+
+        static const ui32 MaxMemory = 16;
+
+    public:
+        explicit TVMState(TStringBuf wire, ui32 memSz, ui32 pos);
+
+        TValue& Current() {
+            return Memory[Pos];
+        }
+
+        TValue& LRef(ui32 pos) {
+            return Memory[pos];
+        }
+
+        const TValue& CRef(ui32 pos) {
+            return Memory[pos];
+        }
+
+        TValue&& RRef(ui32 pos) {
+            return std::move(Memory[pos]);
+        }
+
+        [[nodiscard]]
+        bool TryPushBack();
+
+        template <class T>
+        [[nodiscard]]
+        bool TryPushBack(T&& t) {
+            if (MayAddMoreMemory()) {
+                Memory.emplace_back(std::forward<T>(t));
+                return true;
+            } else {
+                return false;
+            }
+        }
+
+        [[nodiscard]]
+        bool TryPushFront();
+
+        template <class T>
+        [[nodiscard]]
+        bool TryPushFront(T&& t) {
+            if (MayAddMoreMemory()) {
+                Pos += 1;
+                Memory.emplace_front(std::forward<T>(t));
+                return true;
+            } else {
+                return false;
+            }
+        }
+
+        [[nodiscard]]
+        bool TryPopBack();
+
+        [[nodiscard]]
+        bool TryPopFront();
+
+        TString ToString() const;
+
+    private:
+        [[nodiscard]]
+        bool MayAddMoreMemory() const noexcept {
+            return Memory.size() < MaxMemory;
+        }
+    };
+
+
+    struct TIdx {
+        ui32 Idx = -1;
+        static const ui32 ValueCount = 4;
+
+    public:
+        TString ToString() const;
+    };
+
+
+    struct TPos {
+        ui32 Pos = -1;
+        static const ui32 ValueCount = TVMState::MaxMemory;
+
+    public:
+        TString ToString() const;
+    };
+
+
+    struct TRef : public TPos {
+        enum EType {
+            T_CREATE_FRONT  /* "emplace_front(RES),pos+=1" */,
+            T_CREATE_BACK   /* "emplace_back(RES)" */,
+            T_REF__POS      /* "pos@(RES)" */,
+            T_COUNT
+        };
+
+        EType Type = T_COUNT;
+        static const ui32 TypeCount = T_COUNT;
+
+    public:
+        TString ToString() const;
+    };
+
+
+    struct TSrc : public TPos {
+        enum EType {
+            T_LREF__POS     /* "pos@(TValue&)" */,
+            T_CREF__POS     /* "pos@(const TValue&)" */,
+            T_RREF__POS     /* "pos@(TValue&&)" */,
+            T_COUNT
+        };
+
+        EType Type = T_COUNT;
+        static const ui32 TypeCount = T_COUNT;
+
+    public:
+        TString ToString() const;
+    };
+
+
+    struct TDst : public TPos {
+        enum EType {
+            T_CREATE_FRONT_LREF     /* "emplace_front(TValue&),pos+=1" */,
+            T_CREATE_FRONT_CREF     /* "emplace_front(const TValue&),pos+=1" */,
+            T_CREATE_FRONT_RREF     /* "emplace_front(TValue&&),pos+=1" */,
+            T_CREATE_BACK_LREF      /* "emplace_back(TValue&)" */,
+            T_CREATE_BACK_CREF      /* "emplace_back(TValue&),pos+=1" */,
+            T_CREATE_BACK_RREF      /* "emplace_back(TValue&),pos+=1" */,
+            T_LREF__POS             /* "pos@(TValue&)" */,
+            T_CREF__POS             /* "pos@(const TValue&)" */,
+            T_RREF__POS             /* "pos@(TValue&&)" */,
+            T_COUNT
+        };
+
+        EType Type = T_COUNT;
+        static const ui32 TypeCount = T_COUNT;
+
+    public:
+        TString ToString() const;
+    };
+
+
+    struct TPath {
+        TString Path;
+        static const ui32 MaxLength = 32;
+
+    public:
+        TString ToString() const;
+    };
+
+    using TArg = std::variant<std::monostate, TIdx, TPos, TRef, TSrc, TDst, TPath>;
+
+    struct TVMAction {
+        using EType = EVMAction;
+        EVMAction Type = VMA_COUNT;
+        static const ui32 TypeCount = VMA_COUNT;
+
+    public:
+        template <class T>
+        bool SetArg(TMaybe<T> arg) {
+            Y_VERIFY(CurrArg < Y_ARRAY_SIZE(Arg));
+            if (arg) {
+                Arg[CurrArg++] = *arg;
+                return true;
+            } else {
+                return false;
+            }
+        }
+
+    public:
+        TRef GetRef(ui32 arg) const noexcept;
+
+        TSrc GetSrc(ui32 arg) const noexcept;
+
+        TDst GetDst(ui32 arg) const noexcept;
+
+
+        ui32 GetPos(ui32 arg) const noexcept;
+
+        ui32 GetIdx(ui32 arg) const noexcept;
+
+        TStringBuf GetKey(ui32 arg) const noexcept;
+
+        TStringBuf GetString(ui32 arg) const noexcept;
+
+        i64 GetIntNumber(ui32 arg) const noexcept;
+
+        TStringBuf GetPath(ui32 arg) const noexcept;
+
+        TString ToString() const;
+
+    private:
+        TArg Arg[2];
+        ui32 CurrArg = 0;
+    };
+
+    [[nodiscard]]
+    inline ui32 GetCountWidth(ui32 cnt) {
+        return MostSignificantBit(cnt - 1) + 1;
+    }
+
+}
diff --git a/library/cpp/scheme/tests/fuzz_ops/lib/vm_parse.cpp b/library/cpp/scheme/tests/fuzz_ops/lib/vm_parse.cpp
new file mode 100644
index 0000000000..a03f5aef53
--- /dev/null
+++ b/library/cpp/scheme/tests/fuzz_ops/lib/vm_parse.cpp
@@ -0,0 +1,265 @@
+#include "vm_parse.h"
+
+namespace NSc::NUt {
+#define Y_TRY_READ_BITS(state, out, bits, res) do { if (!state.Input.Read(out, bits)) { return res; } } while (false)
+#define Y_TRY_READ_BITS_BOOL(state, out, bits) Y_TRY_READ_BITS(state, out, bits, false)
+#define Y_TRY_READ_BITS_MAYBE(state, out, bits) Y_TRY_READ_BITS(state, out, bits, Nothing())
+
+    TMaybe<TIdx> ParseIdx(TVMState& st) {
+        static_assert(IsPowerOf2(TIdx::ValueCount));
+        static const auto bits = GetCountWidth(TIdx::ValueCount);
+
+        TIdx idx;
+        if (!st.Input.Read(idx.Idx, bits)) {
+            return Nothing();
+        }
+        return idx;
+    }
+
+    namespace {
+        bool DoParsePos(TVMState& st, TPos& pos) {
+            static const auto bits = GetCountWidth(TPos::ValueCount);
+            const ui32 sz = st.Memory.size();
+
+            ui32 neg = -1;
+            Y_TRY_READ_BITS_BOOL(st, neg, 1);
+
+            ui32 delta = -1;
+            Y_TRY_READ_BITS_BOOL(st, delta, bits);
+
+            if (neg) {
+                if (st.Pos < delta) {
+                    return false;
+                }
+                pos.Pos = st.Pos - delta;
+            } else {
+                if (st.Pos + delta >= sz) {
+                    return false;
+                }
+                pos.Pos = st.Pos + delta;
+            }
+
+            return true;
+        }
+
+        template <class T>
+        bool DoParseType(TVMState& state, T& res) {
+            static const auto bits = GetCountWidth(T::TypeCount);
+
+            ui32 type = -1;
+            if (state.Input.Read(type, bits) && type < T::TypeCount) {
+                res.Type = (typename T::EType)(type);
+                return true;
+            } else {
+                return false;
+            }
+        }
+    }
+
+    TMaybe<TPos> ParsePos(TVMState& state) {
+        TPos res;
+        if (DoParsePos(state, res)) {
+            return res;
+        }
+        return Nothing();
+    }
+
+    TMaybe<TRef> ParseRef(TVMState& state) {
+        TRef ref;
+        if (!DoParseType(state, ref)) {
+            return Nothing();
+        }
+
+        switch (ref.Type) {
+        case TRef::T_REF__POS:
+            if (!DoParsePos(state, ref)) {
+                return Nothing();
+            }
+            [[fallthrough]];
+        case TRef::T_CREATE_FRONT:
+        case TRef::T_CREATE_BACK:
+            return ref;
+        default:
+            Y_FAIL();
+        }
+    }
+
+    TMaybe<TSrc> ParseSrc(TVMState& state) {
+        TSrc src;
+        if (!DoParseType(state, src)) {
+            return Nothing();
+        }
+
+        switch (src.Type) {
+        case TSrc::T_LREF__POS:
+        case TSrc::T_CREF__POS:
+        case TSrc::T_RREF__POS:
+            if (!DoParsePos(state, src)) {
+                return Nothing();
+            }
+            return src;
+        default:
+            Y_FAIL();
+        }
+    }
+
+    TMaybe<TDst> ParseDst(TVMState& state) {
+        TDst dst;
+        if (!DoParseType(state, dst)) {
+            return Nothing();
+        }
+
+        switch (dst.Type) {
+        case TDst::T_LREF__POS:
+        case TDst::T_CREF__POS:
+        case TDst::T_RREF__POS:
+            if (!DoParsePos(state, dst)) {
+                return Nothing();
+            }
+            [[fallthrough]];
+        case TDst::T_CREATE_FRONT_LREF:
+        case TDst::T_CREATE_FRONT_CREF:
+        case TDst::T_CREATE_FRONT_RREF:
+        case TDst::T_CREATE_BACK_LREF:
+        case TDst::T_CREATE_BACK_CREF:
+        case TDst::T_CREATE_BACK_RREF:
+            return dst;
+        default:
+            Y_FAIL();
+        }
+    }
+
+    TMaybe<TPath> ParsePath(TVMState& state) {
+        static const ui32 bits = GetCountWidth(TPath::MaxLength);
+        TPath path;
+
+        ui32 len = -1;
+        Y_TRY_READ_BITS_MAYBE(state, len, bits);
+        while (len--) {
+            ui8 c;
+            Y_TRY_READ_BITS_MAYBE(state, c, 8);
+            path.Path.push_back(c);
+        }
+        return path;
+    }
+
+    TMaybe<TVMAction> ParseNextAction(TVMState& state) {
+        TVMAction res;
+
+        if (!DoParseType(state, res)) {
+            return Nothing();
+        }
+
+        switch (res.Type) {
+        case VMA_CREATE_BACK:
+        case VMA_CREATE_FRONT:
+        case VMA_DESTROY_BACK:
+        case VMA_DESTROY_FRONT:
+
+        case VMA_SET_DICT:
+        case VMA_SET_ARRAY:
+        case VMA_SET_NULL:
+        case VMA_GET_JSON:
+
+        case VMA_ARRAY_CLEAR:
+        case VMA_ARRAY_PUSH:
+        case VMA_DICT_CLEAR:
+            return res;
+
+        case VMA_JMP__POS:
+        case VMA_MERGE_UPDATE__POS:
+        case VMA_MERGE_REVERSE__POS:
+        case VMA_MERGE_COPY_FROM__POS:
+        case VMA_SWAP__POS:
+            if (res.SetArg(ParsePos(state))) {
+                return res;
+            } else {
+                return Nothing();
+            }
+
+        case VMA_ARRAY_POP__REF:
+            if (res.SetArg(ParseRef(state))) {
+                return res;
+            } else {
+                return Nothing();
+            }
+
+        case VMA_SET_STRING__IDX:
+        case VMA_SET_INT_NUMBER__IDX:
+        case VMA_ARRAY_INSERT__IDX:
+        case VMA_ARRAY_GET_OR_ADD__IDX:
+        case VMA_DICT_GET_OR_ADD__IDX:
+            if (res.SetArg(ParseIdx(state))) {
+                return res;
+            } else {
+                return Nothing();
+            }
+
+        case VMA_CREATE_BACK__SRC:
+        case VMA_CREATE_FRONT__SRC:
+        case VMA_ASSIGN__SRC:
+        case VMA_ARRAY_PUSH__SRC:
+            if (res.SetArg(ParseSrc(state))) {
+                return res;
+            } else {
+                return Nothing();
+            }
+
+        case VMA_ARRAY_PUSH__DST:
+            if (res.SetArg(ParseDst(state))) {
+                return res;
+            } else {
+                return Nothing();
+            }
+
+        case VMA_ARRAY_DELETE__IDX_REF:
+        case VMA_ARRAY_GET__IDX_REF:
+        case VMA_ARRAY_GET_NO_ADD__IDX_REF:
+        case VMA_DICT_DELETE__IDX_REF:
+        case VMA_DICT_GET__IDX_REF:
+        case VMA_DICT_GET_NO_ADD__IDX_REF:
+            if (res.SetArg(ParseIdx(state)) && res.SetArg(ParseRef(state))) {
+                return res;
+            } else {
+                return Nothing();
+            }
+
+        case VMA_ARRAY_INSERT__IDX_SRC:
+        case VMA_ARRAY_GET_OR_ADD__IDX_SRC:
+        case VMA_DICT_GET_OR_ADD__IDX_SRC:
+            if (res.SetArg(ParseIdx(state)) && res.SetArg(ParseSrc(state))) {
+                return res;
+            } else {
+                return Nothing();
+            }
+
+        case VMA_ARRAY_INSERT__IDX_DST:
+        case VMA_ARRAY_GET_OR_ADD__IDX_DST:
+        case VMA_DICT_GET_OR_ADD__IDX_DST:
+            if (res.SetArg(ParseIdx(state)) && res.SetArg(ParseDst(state))) {
+                return res;
+            } else {
+                return Nothing();
+            }
+
+        case VMA_EQUAL__POS_POS:
+            if (res.SetArg(ParsePos(state)) && res.SetArg(ParsePos(state))) {
+                return res;
+            } else {
+                return Nothing();
+            }
+
+        case VMA_SELECT_NO_ADD__PATH_REF:
+        case VMA_SELECT_OR_ADD__PATH_REF:
+        case VMA_SELECT_AND_DELETE__PATH_REF:
+            if (res.SetArg(ParsePath(state)) && res.SetArg(ParseRef(state))) {
+                return res;
+            } else {
+                return Nothing();
+            }
+
+        default:
+            return Nothing();
+        }
+    }
+}
diff --git a/library/cpp/scheme/tests/fuzz_ops/lib/vm_parse.h b/library/cpp/scheme/tests/fuzz_ops/lib/vm_parse.h
new file mode 100644
index 0000000000..b4aba4e4d4
--- /dev/null
+++ b/library/cpp/scheme/tests/fuzz_ops/lib/vm_parse.h
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "vm_defs.h"
+
+namespace NSc::NUt {
+
+    TMaybe<TIdx> ParseIdx(TVMState& st);
+    TMaybe<TPos> ParsePos(TVMState& state);
+    TMaybe<TRef> ParseRef(TVMState& state);
+    TMaybe<TSrc> ParseSrc(TVMState& state);
+    TMaybe<TDst> ParseDst(TVMState& state);
+    TMaybe<TPath> ParsePath(TVMState& state);
+
+    TMaybe<TVMAction> ParseNextAction(TVMState& state);
+
+}
diff --git a/library/cpp/scheme/tests/fuzz_ops/lib/ya.make b/library/cpp/scheme/tests/fuzz_ops/lib/ya.make
new file mode 100644
index 0000000000..279a2ca2d4
--- /dev/null
+++ b/library/cpp/scheme/tests/fuzz_ops/lib/ya.make
@@ -0,0 +1,23 @@
+LIBRARY()
+
+OWNER(
+    g:blender
+    g:middle
+    g:upper
+    velavokr
+)
+
+GENERATE_ENUM_SERIALIZATION(vm_defs.h)
+
+SRCS(
+    fuzz_ops.cpp
+    vm_apply.cpp
+    vm_defs.cpp
+    vm_parse.cpp
+)
+
+PEERDIR(
+    library/cpp/scheme
+)
+
+END()
diff --git a/library/cpp/scheme/tests/fuzz_ops/ut/vm_parse_ut.cpp b/library/cpp/scheme/tests/fuzz_ops/ut/vm_parse_ut.cpp
new file mode 100644
index 0000000000..ce3786a671
--- /dev/null
+++ b/library/cpp/scheme/tests/fuzz_ops/ut/vm_parse_ut.cpp
@@ -0,0 +1,225 @@
+#include <library/cpp/scheme/tests/fuzz_ops/lib/vm_parse.h>
+#include <library/cpp/testing/unittest/registar.h>
+
+Y_UNIT_TEST_SUITE(TestParseNextAction) {
+    using namespace NSc::NUt;
+
+    Y_UNIT_TEST(TestWidth) {
+        UNIT_ASSERT_VALUES_EQUAL(GetCountWidth(TIdx::ValueCount), 2);
+        UNIT_ASSERT_VALUES_EQUAL(GetCountWidth(TPos::ValueCount), 4);
+        UNIT_ASSERT_VALUES_EQUAL(GetCountWidth(TRef::TypeCount), 2);
+        UNIT_ASSERT_VALUES_EQUAL(GetCountWidth(TSrc::TypeCount), 2);
+        UNIT_ASSERT_VALUES_EQUAL(GetCountWidth(TDst::TypeCount), 4);
+        UNIT_ASSERT_VALUES_EQUAL(GetCountWidth(TPath::MaxLength), 5);
+        UNIT_ASSERT_VALUES_EQUAL(GetCountWidth(TVMAction::TypeCount), 6);
+    }
+
+    Y_UNIT_TEST(TestParseIdx) {
+        {
+            TVMState st{"", 1, 0};
+            UNIT_ASSERT(!ParseIdx(st));
+        }
+        {
+            TVMState st{"\x03", 1, 0};
+            auto idx = ParseIdx(st);
+            UNIT_ASSERT(idx);
+            UNIT_ASSERT_VALUES_EQUAL(idx->Idx, 3);
+        }
+    }
+
+    void DoTestParsePosFailure(const TStringBuf inp, const ui32 memSz, const ui32 curPos) {
+        TVMState st{inp, memSz, curPos};
+        UNIT_ASSERT(!ParsePos(st));
+    }
+
+    [[nodiscard]]
+    ui32 DoTestParsePosSuccess(TVMState& st) {
+        const auto pos = ParsePos(st);
+        UNIT_ASSERT(pos);
+        return pos->Pos;
+    }
+
+    [[nodiscard]]
+    ui32 DoTestParsePosSuccess(const TStringBuf inp, const ui32 memSz, const ui32 curPos) {
+        TVMState st{inp, memSz, curPos};
+        return DoTestParsePosSuccess(st);
+    }
+
+    Y_UNIT_TEST(TestParsePos) {
+        DoTestParsePosFailure("", 1, 0);
+
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParsePosSuccess(TStringBuf("\x00"sv), 1, 0), 0);
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParsePosSuccess(TStringBuf("\x01"sv), 1, 0), 0);
+
+        DoTestParsePosFailure(TStringBuf("\x02"sv), 1, 0);
+        DoTestParsePosFailure(TStringBuf("\x03"sv), 2, 0);
+
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParsePosSuccess(TStringBuf("\x02"sv), 2, 0), 1);
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParsePosSuccess(TStringBuf("\x03"sv), 2, 1), 0);
+
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParsePosSuccess(TStringBuf("\x0E"sv), 8, 0), 7);
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParsePosSuccess(TStringBuf("\x0F"sv), 8, 7), 0);
+
+        {
+            TVMState st{TStringBuf("\xDE\x7B"), 16, 0};
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParsePosSuccess(st), 15);
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParsePosSuccess(st), 15);
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParsePosSuccess(st), 15);
+            UNIT_ASSERT(!ParsePos(st));
+        }
+        {
+            TVMState st{TStringBuf("\xFF\x7F"), 16, 15};
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParsePosSuccess(st), 0);
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParsePosSuccess(st), 0);
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParsePosSuccess(st), 0);
+            UNIT_ASSERT(!ParsePos(st));
+        }
+    }
+
+    void DoTestParseRefFailure(const TStringBuf inp, const ui32 memSz, const ui32 curPos) {
+        TVMState st{inp, memSz, curPos};
+        UNIT_ASSERT(!ParseRef(st));
+    }
+
+    [[nodiscard]]
+    auto DoTestParseRefSuccess(TVMState& st) {
+        const auto ref = ParseRef(st);
+        UNIT_ASSERT(ref);
+        return std::make_pair(ref->Pos, ref->Type);
+    }
+
+    [[nodiscard]]
+    auto DoTestParseRefSuccess(const TStringBuf inp, const ui32 memSz, const ui32 curPos) {
+        TVMState st{inp, memSz, curPos};
+        return DoTestParseRefSuccess(st);
+    }
+
+    Y_UNIT_TEST(TestParseRef) {
+        DoTestParseRefFailure("", 1, 0);
+
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseRefSuccess(TStringBuf("\x00"sv), 1, 0), std::make_pair((ui32)-1, TRef::T_CREATE_FRONT));
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseRefSuccess(TStringBuf("\x01"sv), 1, 0), std::make_pair((ui32)-1, TRef::T_CREATE_BACK));
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseRefSuccess(TStringBuf("\x0A"sv), 2, 0), std::make_pair(1u, TRef::T_REF__POS));
+
+        DoTestParseRefFailure(TStringBuf("\x12"), 1, 0);
+        DoTestParseRefFailure(TStringBuf("\x03"sv), 1, 0);
+
+        {
+            TVMState st{TStringBuf("\x7A\x7D"), 16, 0};
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParseRefSuccess(st), std::make_pair(15u, TRef::T_REF__POS));
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParseRefSuccess(st), std::make_pair(15u, TRef::T_REF__POS));
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParseRefSuccess(st), std::make_pair((ui32)-1, TRef::T_CREATE_BACK));
+            UNIT_ASSERT(!ParseRef(st));
+        }
+    }
+
+    void DoTestParseSrcFailure(const TStringBuf inp, const ui32 memSz, const ui32 curPos) {
+        TVMState st{inp, memSz, curPos};
+        UNIT_ASSERT(!ParseSrc(st));
+    }
+
+    [[nodiscard]]
+    auto DoTestParseSrcSuccess(TVMState& st) {
+        const auto src = ParseSrc(st);
+        UNIT_ASSERT(src);
+        return std::make_pair(src->Pos, src->Type);
+    }
+
+    [[nodiscard]]
+    auto DoTestParseSrcSuccess(const TStringBuf inp, const ui32 memSz, const ui32 curPos) {
+        TVMState st{inp, memSz, curPos};
+        return DoTestParseSrcSuccess(st);
+    }
+
+    Y_UNIT_TEST(TestParseSrc) {
+        DoTestParseSrcFailure("", 1, 0);
+
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseSrcSuccess(TStringBuf("\x08"sv), 2, 0), std::make_pair(1u, TSrc::T_LREF__POS));
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseSrcSuccess(TStringBuf("\x09"sv), 2, 0), std::make_pair(1u, TSrc::T_CREF__POS));
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseSrcSuccess(TStringBuf("\x0A"sv), 2, 0), std::make_pair(1u, TSrc::T_RREF__POS));
+
+        DoTestParseSrcFailure(TStringBuf("\x03"sv), 1, 0);
+
+        {
+            TVMState st{TStringBuf("\x7A\x7D"), 16, 0};
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParseSrcSuccess(st), std::make_pair(15u, TSrc::T_RREF__POS));
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParseSrcSuccess(st), std::make_pair(15u, TSrc::T_RREF__POS));
+            UNIT_ASSERT(!ParseSrc(st));
+        }
+    }
+
+    void DoTestParseDstFailure(const TStringBuf inp, const ui32 memSz, const ui32 curPos) {
+        TVMState st{inp, memSz, curPos};
+        UNIT_ASSERT(!ParseDst(st));
+    }
+
+    [[nodiscard]]
+    auto DoTestParseDstSuccess(TVMState& st) {
+        const auto dst = ParseDst(st);
+        UNIT_ASSERT(dst);
+        return std::make_pair(dst->Pos, dst->Type);
+    }
+
+    [[nodiscard]]
+    auto DoTestParseDstSuccess(const TStringBuf inp, const ui32 memSz, const ui32 curPos) {
+        TVMState st{inp, memSz, curPos};
+        return DoTestParseDstSuccess(st);
+    }
+
+    Y_UNIT_TEST(TestParseDst) {
+        DoTestParseDstFailure("", 1, 0);
+
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseDstSuccess(TStringBuf("\x00"sv), 1, 0), std::make_pair((ui32)-1, TDst::T_CREATE_FRONT_LREF));
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseDstSuccess(TStringBuf("\x01"sv), 1, 0), std::make_pair((ui32)-1, TDst::T_CREATE_FRONT_CREF));
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseDstSuccess(TStringBuf("\x02"sv), 1, 0), std::make_pair((ui32)-1, TDst::T_CREATE_FRONT_RREF));
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseDstSuccess(TStringBuf("\x03"sv), 1, 0), std::make_pair((ui32)-1, TDst::T_CREATE_BACK_LREF));
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseDstSuccess(TStringBuf("\x04"sv), 1, 0), std::make_pair((ui32)-1, TDst::T_CREATE_BACK_CREF));
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseDstSuccess(TStringBuf("\x05"sv), 1, 0), std::make_pair((ui32)-1, TDst::T_CREATE_BACK_RREF));
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseDstSuccess(TStringBuf("\x26\x00"sv), 2, 0), std::make_pair(1u, TDst::T_LREF__POS));
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseDstSuccess(TStringBuf("\x27\x00"sv), 2, 0), std::make_pair(1u, TDst::T_CREF__POS));
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParseDstSuccess(TStringBuf("\x28\x00"sv), 2, 0), std::make_pair(1u, TDst::T_RREF__POS));
+
+        DoTestParseDstFailure(TStringBuf("\x06"sv), 1, 0);
+        DoTestParseDstFailure(TStringBuf("\x09\x00"sv), 1, 0);
+
+        {
+            TVMState st{TStringBuf("\x14\xE7\x09"sv), 16, 0};
+            // 4=4
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParseDstSuccess(st), std::make_pair((ui32)-1, TDst::T_CREATE_BACK_CREF));
+            // 4=8
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParseDstSuccess(st), std::make_pair((ui32)-1, TDst::T_CREATE_FRONT_CREF));
+            // 4+1+4=17
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParseDstSuccess(st), std::make_pair(15u, TDst::T_CREF__POS));
+            // 4=21
+            UNIT_ASSERT_VALUES_EQUAL(DoTestParseDstSuccess(st), std::make_pair((ui32)-1, TDst::T_CREATE_BACK_CREF));
+            UNIT_ASSERT(!ParseDst(st));
+        }
+    }
+
+    void DoTestParsePathFailure(const TStringBuf inp, const ui32 memSz, const ui32 curPos) {
+        TVMState st{inp, memSz, curPos};
+        UNIT_ASSERT(!ParsePath(st));
+    }
+
+    [[nodiscard]]
+    auto DoTestParsePathSuccess(TVMState& st) {
+        const auto path = ParsePath(st);
+        UNIT_ASSERT(path);
+        return path->Path;
+    }
+
+    [[nodiscard]]
+    auto DoTestParsePathSuccess(const TStringBuf inp, const ui32 memSz, const ui32 curPos) {
+        TVMState st{inp, memSz, curPos};
+        return DoTestParsePathSuccess(st);
+    }
+
+    Y_UNIT_TEST(TestParsePath) {
+        DoTestParsePathFailure("", 1, 0);
+
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParsePathSuccess(TStringBuf("\x00"sv), 1, 0), TStringBuf(""));
+        UNIT_ASSERT_VALUES_EQUAL(DoTestParsePathSuccess(TStringBuf("\x21\x0C"sv), 1, 0), TStringBuf("a"));
+
+        DoTestParsePathFailure("\x22\x0C", 1, 0);
+    }
+};
diff --git a/library/cpp/scheme/tests/fuzz_ops/ut/ya.make b/library/cpp/scheme/tests/fuzz_ops/ut/ya.make
new file mode 100644
index 0000000000..5c933518ea
--- /dev/null
+++ b/library/cpp/scheme/tests/fuzz_ops/ut/ya.make
@@ -0,0 +1,15 @@
+UNITTEST()
+
+OWNER(velavokr)
+
+PEERDIR(
+    library/cpp/testing/unittest
+    library/cpp/scheme
+    library/cpp/scheme/tests/fuzz_ops/lib
+)
+
+SRCS(
+    vm_parse_ut.cpp
+)
+
+END()
diff --git a/library/cpp/scheme/tests/fuzz_ops/ya.make b/library/cpp/scheme/tests/fuzz_ops/ya.make
new file mode 100644
index 0000000000..025241ef20
--- /dev/null
+++ b/library/cpp/scheme/tests/fuzz_ops/ya.make
@@ -0,0 +1,18 @@
+FUZZ()
+
+OWNER(
+    g:blender
+    g:middle
+    g:upper
+    velavokr
+)
+
+SRCS(
+    fuzz_ops.cpp
+)
+
+PEERDIR(
+    library/cpp/scheme/tests/fuzz_ops/lib
+)
+
+END()