Merge pull request #1147 from WebAssembly/betterfuzz

Fuzzer improvements and some small fixes

1 files changed, 12 insertions, 6 deletions

diff --git a/src/tools/translate-to-fuzz.h b/src/tools/translate-to-fuzz.h
index a7f86af13..307604af6 100644
--- a/src/tools/translate-to-fuzz.h
+++ b/src/tools/translate-to-fuzz.h
@@ -87,7 +87,7 @@ private:
   // the number of runtime iterations (function calls, loop backbranches) we
   // allow before we stop execution with a trap, to prevent hangs. 0 means
   // no hang protection.
-  static const int HANG_LIMIT = 25;
+  static const int HANG_LIMIT = 100;
 
   // Optionally remove NaNs, which are a source of nondeterminism (which makes
   // cross-VM comparisons harder)
@@ -452,14 +452,20 @@ private:
   // make something with no chance of infinite recursion
   Expression* makeTrivial(WasmType type) {
     if (isConcreteWasmType(type)) {
-      return makeConst(type);
+      if (oneIn(2)) {
+        return makeGetLocal(type);
+      } else {
+        return makeConst(type);
+      }
     } else if (type == none) {
       return makeNop(type);
     }
     assert(type == unreachable);
-    return builder.makeReturn(
-      isConcreteWasmType(func->result) ? makeConst(func->result) : nullptr
-    );
+    Expression* ret = nullptr;
+    if (isConcreteWasmType(func->result)) {
+      ret = makeTrivial(func->result);
+    }
+    return builder.makeReturn(ret);
   }
 
   // specific expression creators
@@ -650,7 +656,7 @@ private:
 
   Expression* makeGetLocal(WasmType type) {
     auto& locals = typeLocals[type];
-    if (locals.empty()) return makeTrivial(type);
+    if (locals.empty()) return makeConst(type);
     return builder.makeGetLocal(vectorPick(locals), type);
   }