diff options
Diffstat (limited to 'src/tools')
-rw-r--r-- | src/tools/fuzzing/heap-types.cpp | 39 | ||||
-rw-r--r-- | src/tools/tool-options.h | 4 | ||||
-rw-r--r-- | src/tools/wasm-fuzz-types.cpp | 56 |
3 files changed, 37 insertions, 62 deletions
diff --git a/src/tools/fuzzing/heap-types.cpp b/src/tools/fuzzing/heap-types.cpp index 24054572d..e58c7f51d 100644 --- a/src/tools/fuzzing/heap-types.cpp +++ b/src/tools/fuzzing/heap-types.cpp @@ -65,8 +65,7 @@ struct HeapTypeGeneratorImpl { // Set up the subtype relationships. Start with some number of root types, // then after that start creating subtypes of existing types. Determine the // top-level kind of each type in advance so that we can appropriately use - // types we haven't constructed yet. For simplicity, always choose a - // supertype to bea previous type, which is valid in all type systems. + // types we haven't constructed yet. typeKinds.reserve(builder.size()); supertypeIndices.reserve(builder.size()); Index numRoots = 1 + rand.upTo(builder.size()); @@ -90,31 +89,23 @@ struct HeapTypeGeneratorImpl { // Initialize the recursion groups. recGroupEnds.reserve(builder.size()); - if (getTypeSystem() != TypeSystem::Isorecursive) { - // Recursion groups don't matter and we can choose children as though we - // had a single large recursion group. - for (Index i = 0; i < builder.size(); ++i) { - recGroupEnds.push_back(builder.size()); - } - } else { - // We are using isorecursive types, so create groups. Choose an expected - // group size uniformly at random, then create groups with random sizes on - // a geometric distribution based on that expected size. - size_t expectedSize = 1 + rand.upTo(builder.size()); - Index groupStart = 0; - for (Index i = 0; i < builder.size(); ++i) { - if (i == builder.size() - 1 || rand.oneIn(expectedSize)) { - // End the old group and create a new group. - Index newGroupStart = i + 1; - builder.createRecGroup(groupStart, newGroupStart - groupStart); - for (Index j = groupStart; j < newGroupStart; ++j) { - recGroupEnds.push_back(newGroupStart); - } - groupStart = newGroupStart; + // Create isorecursive recursion groups. Choose an expected group size + // uniformly at random, then create groups with random sizes on a geometric + // distribution based on that expected size. + size_t expectedSize = 1 + rand.upTo(builder.size()); + Index groupStart = 0; + for (Index i = 0; i < builder.size(); ++i) { + if (i == builder.size() - 1 || rand.oneIn(expectedSize)) { + // End the old group and create a new group. + Index newGroupStart = i + 1; + builder.createRecGroup(groupStart, newGroupStart - groupStart); + for (Index j = groupStart; j < newGroupStart; ++j) { + recGroupEnds.push_back(newGroupStart); } + groupStart = newGroupStart; } - assert(recGroupEnds.size() == builder.size()); } + assert(recGroupEnds.size() == builder.size()); // Create the heap types. for (; index < builder.size(); ++index) { diff --git a/src/tools/tool-options.h b/src/tools/tool-options.h index 4e9d85d00..a6e57a76e 100644 --- a/src/tools/tool-options.h +++ b/src/tools/tool-options.h @@ -182,10 +182,6 @@ struct ToolOptions : public Options { void applyFeatures(Module& module) const { module.features.enable(enabledFeatures); module.features.disable(disabledFeatures); - // Non-default type systems only make sense with GC enabled. - if (!module.features.hasGC() && getTypeSystem() == TypeSystem::Nominal) { - Fatal() << "Nominal typing is only allowed when GC is enabled"; - } } private: diff --git a/src/tools/wasm-fuzz-types.cpp b/src/tools/wasm-fuzz-types.cpp index ce393d133..0dc9f9d17 100644 --- a/src/tools/wasm-fuzz-types.cpp +++ b/src/tools/wasm-fuzz-types.cpp @@ -228,11 +228,6 @@ void Fuzzer::checkCanonicalization() { // Check that structural canonicalization is working correctly by building the // types again, choosing randomly between equivalent possible children for // each definition from both the new and old sets of built types. - if (getTypeSystem() == TypeSystem::Nominal) { - // No canonicalization to check. - return; - } - TypeBuilder builder(types.size()); // Helper for creating new definitions of existing types, randomly choosing @@ -274,36 +269,29 @@ void Fuzzer::checkCanonicalization() { // Set up recursion groups and record group ends to ensure we only select // valid children. recGroupEnds.reserve(builder.size()); - if (getTypeSystem() != TypeSystem::Isorecursive) { - // No rec groups. - for (size_t i = 0; i < builder.size(); ++i) { - recGroupEnds.push_back(builder.size()); + // Set up recursion groups + std::optional<RecGroup> currGroup; + size_t currGroupStart = 0; + auto finishGroup = [&](Index end) { + builder.createRecGroup(currGroupStart, end - currGroupStart); + for (Index i = currGroupStart; i < end; ++i) { + recGroupEnds.push_back(end); } - } else { - // Set up recursion groups - std::optional<RecGroup> currGroup; - size_t currGroupStart = 0; - auto finishGroup = [&](Index end) { - builder.createRecGroup(currGroupStart, end - currGroupStart); - for (Index i = currGroupStart; i < end; ++i) { - recGroupEnds.push_back(end); - } - currGroupStart = end; - }; - for (Index i = 0; i < types.size(); ++i) { - auto type = types[i]; - if (type.isBasic()) { - continue; - } - auto newGroup = type.getRecGroup(); - if (!currGroup || newGroup != currGroup || - type == types[currGroupStart]) { - finishGroup(i); - currGroup = newGroup; - } + currGroupStart = end; + }; + for (Index i = 0; i < types.size(); ++i) { + auto type = types[i]; + if (type.isBasic()) { + continue; + } + auto newGroup = type.getRecGroup(); + if (!currGroup || newGroup != currGroup || + type == types[currGroupStart]) { + finishGroup(i); + currGroup = newGroup; } - finishGroup(builder.size()); } + finishGroup(builder.size()); // Copy the original types for (; index < types.size(); ++index) { @@ -349,7 +337,7 @@ void Fuzzer::checkCanonicalization() { assert(old.isBasic()); return {OldHeapType{old}}; } - if (!old.isBasic() && getTypeSystem() == TypeSystem::Isorecursive) { + if (!old.isBasic()) { // Check whether this child heap type is supposed to be a self-reference // into the recursion group we are defining. If it is, we must use the // corresponding type in the new recursion group, since anything else @@ -514,7 +502,7 @@ void Fuzzer::checkInhabitable() { } // TODO: We could also check that the transformed types are the same as the // original types up to nullability. - } else if (getTypeSystem() == TypeSystem::Isorecursive) { + } else { // Verify the produced inhabitable types are the same as the original types // (which also implies that they are indeed inhabitable). if (types.size() != inhabitable.size()) { |