summaryrefslogtreecommitdiff
path: root/scripts/fuzz_opt.py
Commit message (Collapse)AuthorAgeFilesLines
...
* Fuzzer: Allow using initial content with V8 (#6327)Alon Zakai2024-02-221-4/+3
| | | | | | | | | | | | | | | One problem was that spec testcases had exports with names that are not valid to write as JS exports.name. For example an export with a - in the name would end up as exports.foo-bar etc. Since #6310 that is fixed as we do not emit such JS (we use the generic fuzz_shell.js script which iterates over the keys in exports with exports[name]). Also fix a few trivial fuzzer issues that initial content uncovered: - Ignore a wat file with invalid utf-8. - Print string literals in the same way from JS as from C++. - Enable the stringref flag in V8. - Remove tag imports (the same as we do for global and function and other imports).
* Fuzzer: Match the logging of i31ref between JS and C++ (#6335)Alon Zakai2024-02-221-0/+4
| | | | | | | | | | | | | JS engines print i31ref as just a number, so we need a small regex to standardize the representation (similar to what we do for funcrefs on the code above). On the C++ side, make it actually print the i31ref rather than treat it like a generic reference (for whom we only print "object"). To do that we must unwrap an externalized i31 as necessary, and add a case for i31 in the printing logic. Also move that printing logic to its own function, as it was starting to get quite long.
* Fuzzer: Add a pass to prune illegal imports and exports for JS (#6312)Alon Zakai2024-02-201-3/+3
| | | | | | | | | | | | | | | | | | We already have passes to legalize i64 imports and exports, which the fuzzer will run so that we can run wasm files in JS VMs. SIMD and multivalue also pose a problem as they trap on the boundary. In principle we could legalize them as well, but that is substantial effort, so instead just prune them: given a wasm module, remove any imports or exports that use SIMD or multivalue (or anything else that is not legal for JS). Running this in the fuzzer will allow us to not skip running v8 on any testcase we enable SIMD and multivalue for. (Multivalue is allowed in newer VMs, so that part of this PR could be removed eventually.) Also remove the limitation on running v8 with multimemory (v8 now supports that).
* Fuzzer: Remove --emit-js-shell logic and reuse fuzz_shell.js instead (#6310)Alon Zakai2024-02-201-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | We had two JS files that could run a wasm file for fuzzing purposes: * --emit-js-shell, which emitted a custom JS file that runs the wasm. * scripts/fuzz_shell.js, which was a generic file that did the same. Both of those load the wasm and then call the exports in order and print out logging as it goes of their return values (if any), exceptions, etc. Then the fuzzer compares that output to running the same wasm in another VM, etc. The difference is that one was custom for the wasm file, and one was generic. Aside from that they are similar and duplicated a bunch of code. This PR improves things by removing 1 and using 2 in all places, that is, we now use the generic file everywhere. I believe we added 1 because we thought a generic file can't do all the things we need, like know the order of exports and the types of return values, but in practice there are ways to do those things: The exports are in fact in the proper order (JS order of iteration is deterministic, thankfully), and for the type we don't want to print type internals anyhow since that would limit fuzzing --closed-world. We do need to be careful with types in JS (see notes in the PR about the type of null) but it's not too bad. As for the types of params, it's fine to pass in null for them all anyhow (null converts to a number or a reference without error).
* Fuzzer: Remove Asyncify integration (#6309)Alon Zakai2024-02-141-71/+0
| | | | | | | | | | | Fuzzing Asyncify has a significant cost both in terms of the complexity in the fuzzer and the slowness of the fuzzing. In practice it was useful years ago when Asyncify was written but hasn't found anything for a while, and Asyncify is really deprecated given JSPI. For all those reasons, remove it from the fuzzer. We do still have lots of normal coverage of asyncify in lit tests, unit tests, and the Emscripten test suite. Removing this will also make future improvements to the fuzzer simpler.
* Fuzzer: Use a directory for important fuzz testcases (#6297)Alon Zakai2024-02-121-23/+14
| | | | | Users can put files in ./fuzz and they will be fuzzed with high priority. Docs in source and https://github.com/WebAssembly/binaryen/wiki/Fuzzing#helper-scripts
* StringLowering: Start to lower instructions (#6281)Alon Zakai2024-02-061-0/+1
|
* [EH] Support CFGWalker for new EH spec (#6235)Heejin Ahn2024-01-251-0/+1
| | | | | | | | This adds support `CFGWalker` for the new EH instructions (`try_table` and `throw_ref`). `CFGWalker` is used by many different passes, but in the same vein as #3494, this adds tests for `RedundantSetElimination` pass. `rse-eh.wast` file is created from translated and simplified version of `rse-eh-old.wast`, but many tests were removed because we don't have special `catch` block or `delegate` anymore.
* [EH] Add translator from old to new EH instructions (#6210)Heejin Ahn2024-01-231-0/+1
| | | | | | | | | | | | | | | | | | | | This translates the old Phase 3 EH instructions, which include `try`, `catch`, `catch_all`, `delegate`, and `rethrow`, into the new EH instructions, which include `try_table` (with `catch` / `catch_ref` / `catch_all` / `catch_all_ref`) and `throw_ref`, passed at the Oct 2023 CG meeting. This translator can be used as a standalone tool by users of the previous EH toolchain to generate binaries for the new spec without recompiling, and also can be used at the end of the Binaryen pipeline to produce binaries for the new spec while the end-to-end toolchain implementation for the new spec is in progress. While the goal of this pass is not optimization, this tries to a little better than the most naive implementation, namely by omitting a few instructions where possible and trying to minimize the number of additional locals, because this can be used as a standalone translator or the last stage of the pipeline while we can't post-optimize the results because the whole pipeline (-On) is not ready for the new EH.
* Typed continuations: resume instructions (#6083)Frank Emrich2024-01-111-0/+1
| | | | | This PR is part of a series that adds basic support for the [typed continuations proposal](https://github.com/wasmfx/specfx). This particular PR adds support for the `resume` instruction. The most notable missing feature is validation, which is not implemented, yet.
* [EH][test] Split EH tests into old and new spec (#6178)Heejin Ahn2023-12-131-0/+2
| | | | | | | | | This moves tests for the old EH spec to `exception-handling-old.wast` and moves the new `exnref` test into `exception-handling.wast`, onto which I plan to add more tests for the new EH spec. The primary reason for splitting the files is I plan to exclude the new EH test from the fuzzing while the new spec's implementation is in progress, and I don't want to exclude the old EH tests altogether.
* Add an arity immediate to tuple.extract (#6172)Thomas Lively2023-12-121-1/+1
| | | | | | | | Once support for tuple.extract lands in the new WAT parser, this arity immediate will let the parser determine how many values it should pop off the stack to serve as the tuple operand to `tuple.extract`. This will usually coincide with the arity of a tuple-producing instruction on top of the stack, but in the spirit of treating the input as a proper stack machine, it will not have to and the parser will still work correctly.
* Update `tuple.make` text format to include arity (#6169)Thomas Lively2023-12-121-1/+1
| | | | | | | | | | Previously, the number of tuple elements was inferred from the number of s-expression children of the `tuple.make` expression, but that scheme would not work in the new wat parser, where s-expressions are optional and cannot be semantically meaningful. Update the text format to take the number of tuple elements (i.e. the tuple arity) as an immediate. This new format will be able to be implemented in the new parser as follow-on work.
* Typed Continuations: Add cont type (#5998)Frank Emrich2023-10-241-0/+2
| | | | | | | | | This PR is part of a series that adds basic support for the [typed continuations proposal](https://github.com/wasmfx/specfx). This PR adds continuation types, of the form `(cont $foo)` for some function type `$foo`. The only notable changes affecting existing code are the following: - This is the first `HeapType` which has another `HeapType` (rather than, say, a `Type`) as its immediate child. This required fixes to certain traversals that have a flag for being at the toplevel of a type. - Some shared logic for parsing `HeapType`s has been factored out.
* Fuzzer: Add missing simplify-globals* passes (#6025)Alon Zakai2023-10-181-0/+2
|
* Fuzzer: Mark runs where over 50% of functions trap as ignored (#6007)Alon Zakai2023-10-131-3/+18
| | | | | | | | The number of ignored functions is logged out, so this can help us avoid getting into a situation where many testcases just trap most of the time rather than doing anything useful. 50% seems a reasonable cutoff. Even if 50% of functions trap, at least we are getting 50% that don't, so lots of useful work.
* Add an "unsubtyping" optimization (#5982)Thomas Lively2023-10-101-0/+1
| | | | | | | | | | | | | | Add a new pass that analyzes the module to find the minimal subtyping relation that is necessary to maintain the validity and semantics of the program and rewrites the types to use this minimal relation. Besides eliminating references to otherwise-unused intermediate types, this optimization should unlock significant additional optimizing power in other type optimizations that are constrained by having to maintain supertype validity, since after this new optimization there are fewer and more general supertypes. The analysis works by visiting each expression and module element to collect the subtypings that are required to maintain its validity, then, using that as a starting point, iteratively adding new subtypings required by type definitions and casts until reaching a fixed point.
* Add passes to finalize or unfinalize types (#5944)Alon Zakai2023-09-181-0/+2
| | | | | | | | | TypeFinalization finalizes all types that we can, that is, all private types that have no children. TypeUnFinalization unfinalizes (opens) all (private) types. These could be used by first opening all types, optimizing, and then finalizing, as that might find more opportunities. Fixes #5933
* Enable auto_initial_contents by default in fuzz_opt.py (#5943)Thomas Lively2023-09-141-3/+4
| | | | This setting is useful enough that there is basically no reason not to use it. Turn it on by default to save some typing when running the fuzzer.
* Add a simple tuple optimization pass (#5937)Alon Zakai2023-09-141-0/+1
| | | | | | | | | | | In some cases tuples are obviously not needed, such as when they are only used in local operations and make/extract. Such tuples are not used as return values or in control flow structures, so we might as well lower them to individual locals per lane, which other passes can optimize a lot better. I believe LLVM does the same with its own tuples: it lowers them as much as possible, leaving only necessary ones. Fixes #5923
* Do not prompt user on fuzz_opt.py --auto-initial-contents (#5907)Thomas Lively2023-08-291-8/+0
| | | | | Remove the prompt for user confirmation when using the --auto-initial-contents option with the fuzzer. It is not actionable, and it prevents me from going off and doing something else when I build and start the fuzzer in the same command.
* Rename multimemory flag (#5890)Ashley Nelson2023-08-211-4/+4
| | | Renaming the multimemory flag in Binaryen to match its naming in LLVM.
* GUFA: Add a version that casts all of our inferences (#5846)Alon Zakai2023-07-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | GUFA refines existing casts, but does not add new casts for fear of increasing code size and adding more cast operations at runtime. This PR adds a version that does add all those casts, and it looks like at least code size improves rather than regresses, at least on J2Wasm and Kotlin. That is, this pass adds a lot more casts, but subsequent optimizations benefit enough to shrink overall code size. However, this may still not be worthwhile, as even if code size decreases we may end up doing more casts at runtime, and those casts might be hard to remove, e.g.: (call $foo (x) ;; inferred to be non-null ) (func $foo (param (ref null $A) => (call $foo (ref.cast $A (x) ;; add a cast here ) (func $foo (param (ref $A) ;; later pass refines here That new cast cannot be removed after we refine the function parameter. If the function never benefits from the fact that the input is non-null, then the cast is wasted work (e.g. if the function only compares the input to another value). To use this new pass, try --gufa-cast-all rather than --gufa. As with normal GUFA, running the full optimizer afterwards is important, and even more important in order to get rid of as many of the new casts as possible.
* CtorEval Fuzzer: Generalize export regex (#5778)Alon Zakai2023-06-221-1/+1
| | | | | | Just look for export names as "" with some other stuff in the middle. Missing from the old regex: spaces, parens, and probably more. Spaces and parens are used in the test suite, which is how this was noticed by the fuzzer.
* StackIR: Remove nops (#5746)Alon Zakai2023-05-301-0/+2
| | | | | | | No nop instruction is necessary in wasm, so in StackIR we can simply remove them all. Fixes #5745
* Fuzzer: Ignore testcases that V8 OOMs on (#5733)Alon Zakai2023-05-181-0/+3
| | | | We already ignore OOMs in the interpreter. This adds the syntax for V8, which I saw an error on now (on an array.new of a massive size).
* Reintroduce wasm-merge (#5709)Alon Zakai2023-05-161-4/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We used to have a wasm-merge tool but removed it for a lack of use cases. Recently use cases have been showing up in the wasm GC space and elsewhere, as people are using more diverse toolchains together, for example a project might build some C++ code alongside some wasm GC code. Merging those wasm files together can allow for nice optimizations like inlining and better DCE etc., so it makes sense to have a tool for merging. Background: * Removal: #1969 * Requests: * wasm-merge - why it has been deleted #2174 * Compiling and linking wat files #2276 * wasm-link? #2767 This PR is a compete rewrite of wasm-merge, not a restoration of the original codebase. The original code was quite messy (my fault), and also, since then we've added multi-memory and multi-table which makes things a lot simpler. The linking semantics are as described in the "wasm-link" issue #2767 : all we do is merge normal wasm files together and connect imports and export. That is, we have a graph of modules and their names, and each import to a module name can be resolved to that module. Basically, like a JS bundler would do for JS, or, in other words, we do the same operations as JS code would do to glue wasm modules together at runtime, but at compile time. See the README update in this PR for a concrete example. There are no plans to do more than that simple bundling, so this should not really overlap with wasm-ld's use cases. This should be fairly fast as it works in linear time on the total input code. However, it won't be as fast as wasm-ld, of course, as it does build Binaryen IR for each module. An advantage to working on Binaryen IR is that we can easily do some global DCE after merging, and further optimizations are possible later.
* Prune trapping code during TrapsNeverHappen fuzzing (#5717)Alon Zakai2023-05-121-25/+68
| | | | | | | | | This removes the trapping export and all others after it. This avoids a potential infinite loop that can happen when fuzzing TNH, as if TNH is set and a trap happens then the optimizer can cause an iloop, and while that is valid, it would hang the fuzzer. We could check for a timeout, but it is faster and more robust to just remove the code we can't compare anyhow. This uses wasm-metadce to remove the exports from the failing one.
* Fuzzer: Run --dce when GC is enabled (#5677)Alon Zakai2023-04-191-0/+9
| | | | | | | | | | | DCE at the end avoids issues with non-nullable local operations in unreachable code, which is still being discussed. This PR avoids fuzzer errors for now, but we should revert it when we have a proper fix. See * #5599 * #5665 * https://github.com/WebAssembly/function-references/issues/98
* Remove the --hybrid and --nominal command line options (#5669)Thomas Lively2023-04-141-5/+0
| | | | | After this change, the only type system usable from the tools will be the standard isorecursive type system. The nominal type system is still usable via the API, but it will be removed entirely in a follow-on PR.
* Adjust fuzzer frequencies (#5612)Alon Zakai2023-03-311-6/+5
| | | | | | | | | | I ran CheckDeterminism at full throttle overnight (set to 1, and disabled all other things) and it found a bug, so we should focus on that more. Also ctor-eval as there is ongoing work there. I reduced a few other priorities of things that haven't seen bugs in a very long time and are not high priority.
* Switch fuzzer to hybrid typing (#5609)Alon Zakai2023-03-311-1/+1
| | | This is the default, and also used by J2Wasm.
* Fuzz partial-inlining-ifs (#5600)Alon Zakai2023-03-291-0/+4
|
* Fuzzer: Ignore infinite recursion in Asyncify handler (#5596)Alon Zakai2023-03-221-0/+17
|
* Fix misoptimization in TypeMerging (#5572)Thomas Lively2023-03-141-3/+1
| | | | | | | | | | | | TypeMerging previously tried to merge types with their supertypes and siblings in a single step, but this could cause a misoptimization in which a type was merged with its parent's sibling without being merged with its parent, breaking subtyping. Fix the bug by merging with supertypes and siblings separately. Since we now have multiple merging steps, also take the opportunity to run the sibling merging step multiple times to exploit more merging opportunities. Fixes #5556.
* Fuzzer: CompareVMs: Do not compare when hitting a host limitation (#5562)Alon Zakai2023-03-141-2/+18
| | | | | | | For example, we might hit an allocation limit in the wasm, but the optimized wasm might optimize that allocation out. So we need to ignore comparisons in such cases, as we cannot expect the output to be identical. We already do similar things for FuzzExec and #5560 adds it for TrapsNeverHappen; this adds it to CompareVMs.
* TrapsNeverHappen fuzzing: Handle a trap vs a host limitation (#5560)Alon Zakai2023-03-101-0/+8
| | | | | | | | | | If the program tries to allocate an infinite number of objects, but is prevented from doing that by a null pointer trap, then after we run with trapsNeverHappen the trap may fail to occur, and we'll hit the host limitation on allocations. As a result, we'd be comparing one run with a trap and one run that is meant to be ignored (as we ignore runs with host limitations), and before this PR we'd error as we would expect to find the normal output and not the "ignore this host limitation" marker.
* Integrate the heap type fuzzer into the main fuzzer (#5555)Alon Zakai2023-03-091-1/+3
| | | | | | | | | | | | | With this we generate random GC types that may be used in creating instructions later. We don't create many instructions yet, which will be the next step after this. Also add some trivial assertions in some places, that have helped debugging in the past. Stop fuzzing TypeMerging for now due to #5556 , which this PR uncovers.
* Fuzzer: Skip testcases that hit V8's array size limit (#5550)Alon Zakai2023-03-071-2/+8
|
* Fuzzer: Count the number of VM runs we ignore (#5538)Alon Zakai2023-03-011-1/+11
| | | | | If this number ever gets high then we would need to look into why we ignore so much. Right now we seem to end up ignoring much less than 1% which seems ok.
* Fuzzing: Add wasm-ctor-eval fuzzing in fuzz_opt.py (#5523)Alon Zakai2023-02-241-4/+44
| | | | | | After the recent improvements and fixes this is now simple and the fuzzer found no more issues overnight for me. Also adjust some existing frequencies.
* [Wasm GC] Add AbstractTypeRefining pass (#5461)Alon Zakai2023-02-031-0/+2
| | | | | | | | | | | | | | If a type hierarchy has abstract classes in the middle, that is, types that are never instantiated, then we can optimize casts and other operations to them. Say in Java that we have `AbstractList`, and it only has one subclass `IntList` that is ever created, then any place we have an `AbstractList` we must actually have an `IntList`, or a null. (Or, if no subtype is instantiated, then the value must definitely be a null.) The actual implementation does a type mapping, that is, it finds all places using an abstract type and makes them refer to the single instantiated subtype (or null). After that change, no references to the abstract type remain in the program, so this both refines types and also cleans up the type section.
* Skip some new initial content in the fuzzer, with imported memories (#5383)Alon Zakai2023-01-031-0/+3
| | | | | Do not fuzz some new testcases that have imported memories. The fuzzer doesn't seem to have support for that (it errors when it tries to do operations on them, since the import hasn't been created).
* Work around bugs with open world type optimizations (#5367)Thomas Lively2022-12-201-69/+89
| | | | | | | | | | | | | | Since #5347 public types are never updated by type optimizations, but the optimization passes have not yet been updated to take that into account, so they are all buggy under an open world assumption. In #5359 we worked around many closed world validation errors in the fuzzer by treating --closed-world like a feature flag and checking whether it was necessary for fuzzer input, but that did not prevent the type optimization passes from running under an open world, so it did not work around all the potential issues. Work around the problem more thoroughly by not running any type optimization passes in the fuzzer without --closed-world. Also add logic to those passes to error out if they are run without --closed-world and update the tests accordingly.
* Fixed fuzzing of closed-world after #5347 (#5359)Alon Zakai2022-12-161-4/+19
| | | | | An initial content testcase may only work in open world, so check for that using the existing mechanism of checking if such testcases work with out feature flags.
* [Wasm GC] Add TypeMerging pass (#5321)Alon Zakai2022-12-071-0/+1
| | | | | | | | This finds types that can be merged into their super: types that add no fields, and are not used in casts, etc. - so we might as well use the super. This complements TypeSSA, in that it can merge back the new types that TypeSSA created, if we never found a use for them. Without this, TypeSSA can bloat binary size quite a lot (I see 10-20%).
* [Wasm GC] Add TypeSSA pass (#5299)Alon Zakai2022-12-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This creates new nominal types for each (interesting) struct.new. That then allows type-based optimizations to be more precise, as those optimizations will track separate info for each struct.new, in effect. That is kind of like SSA, however, we do not handle merges. For example: x = struct.new $A (5); print(x.value); y = struct.new $A (11); print(y.value); // => // x = struct.new $A.x (5); print(x.value); y = struct.new $A.y (11); print(y.value); After the pass runs each of those struct.new creates a unique type, and type-based analysis can see that 5 or 11 are the only values written in that type (if nothing else writes there). This bloats the type section with the new subtypes, so it is best used with a pass to merge unneeded duplicate types, which a later PR will add. That later PR will exactly merge back in the types created here, which are nominally different but indistinguishable otherwise. This pass is not enabled by default. It's not clear yet where is the best place to do it, as it must be balanced by type merging, but it might be better to do multiple rounds of optimization between the two. Needs more investigation.
* [Wasm GC] Implement closed-world flag (#5303)Alon Zakai2022-11-301-0/+3
| | | | | | | | | | | | | With this change we default to an open world, that is, we do the safe thing by default: we no longer assume a closed world. Users that want a closed world must pass --closed-world. Atm we just do not run passes that assume a closed world. (We might later refine them to find which types don't escape and only optimize those.) The RemoveUnusedModuleElements is an exception in that the closed-world flag influences one part of its operation, but not the rest. Fixes #5292
* [Wasm GC] Start an OptimizeCasts pass and reuse cast values there (#5263)Alon Zakai2022-11-171-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | (some.operation (ref.cast .. (local.get $ref)) (local.get $ref) ) => (some.operation (local.tee $temp (ref.cast .. (local.get $ref)) ) (local.get $temp) ) This can help cases where we cast for some reason but happen to not use the cast value in all places. This occurs in j2wasm in itable calls sometimes: The this pointer is is refined, but the itable may be done with an unrefined pointer, which is less optimizable. So far this is just inside basic blocks, but that is enough for the cast of itable calls and other common patterns I see.
* [Wasm GC] Add Monomorphize pass (#5238)Alon Zakai2022-11-111-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Monomorphization finds cases where we send more refined types to a function than it declares. In such cases we can copy the function and refine the parameters: // B is a subtype of A foo(new B()); function foo(x : A) { ..} => foo_B(new B()); // call redirected to refined copy function foo(x : A) { ..} // unchanged function foo_B(x : B) { ..} // refined copy This increases code size so it may not be worth it in all cases. This initial PR is hopefully enough to start experimenting with this on performance, and so it does not enable the pass by default. This adds two variations of monomorphization, one that always does it, and the default which is "careful": it sees whether monomorphizing lets the refined function actually be better than the original (say, by removing a cast). If there is no improvement then we do not make any changes. This saves a significant amount of code size - on j2wasm the careful version increases by 13% instead of 20% - but it does run more slowly obviously.
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-06 17:42:27 +0000