summaryrefslogtreecommitdiff
path: root/scripts/fuzz_opt.py
Commit message (Collapse)AuthorAgeFilesLines
* [EH] Fuzz calls from JS by calling wasm exports, sometimes catching (#7067)Alon Zakai2024-11-081-0/+28
| | | | | | | | | | | | | | | | This adds two new imports to fuzzer modules: * call-export, which gets an export index and calls it. * call-export-catch, which does the call in a try-catch, swallowing any error, and returning 1 if it saw an error. The former gives us calls back into the wasm, possibly making various trips between wasm and JS in interesting ways. The latter adds a try-catch which helps fuzz wasm EH. We do these calls using a wasm export index, i.e., the index in the list of exports. This is simple, but it does have the downside that it makes executing the wasm sensitive to changes in exports (e.g. wasm-merge adds more), which requires some handling in the fuzzer.
* [NFC] Refactor fuzzer's can_run_on_feature_opts() (#7066)Alon Zakai2024-11-071-6/+7
| | | | | | | It never used the parameter, so remove that (we always access the features using a global anyhow). But add a new parameter, the wasm file, which does need to be passed in for a later PR (so in this PR it is just for future use).
* [wasm64] Fuzz wasm64 memories (#7064)Alon Zakai2024-11-071-3/+3
| | | | | | | * Remove the code that prevented fuzzing wasm64 test files. * Ignore a run that hits the V8 implementation limit on memory size. * Disable wasm64 fuzzing in wasm2js (like almost all post-MVP features). * Add fuzzer logic to emit a 64-bit memory sometimes. * Fix various places in the fuzzer that assumed 32-bit indexes
* Fix flipped condition on keep_defaults in fuzzer (#7061)Alon Zakai2024-11-061-1/+1
| | | Followup to #7055
* Fuzzer: Handle exported table for wasm-merge (#7055)Alon Zakai2024-11-061-7/+27
| | | | | | When fuzzing wasm-merge, we need to avoid the first module not having an exported table but the second having one, as the way the table operation imports work, they are sensitive to the existence of such an export, so just merging in such an export can alter behavior.
* Fuzz the Table from JS (#7042)Alon Zakai2024-10-311-11/+28
| | | | | Continues the work from #7027 which added throwing from JS, this adds table get/set operations from JS, to further increase our coverage of Wasm/JS interactions (the table can be used from both sides).
* wasm-split: Add fuzzer support (#7014)Alon Zakai2024-10-181-2/+109
| | | | | | | | | | | | The support is added but not enabled as this is still finding bugs. The first part here is to add Split testcase handler to the fuzzer, which runs a wasm, then runs it again after splitting it and then linking it at runtime, and checking for different results. The second part is support for linking two modules at runtime in the fuzzer's JS code, that works in tandem with the first part. New options are added to load and link a second wasm, and to pick which exports to run.
* Fuzz Wasm Exceptions in V8 (#6981)Alon Zakai2024-10-021-3/+1
| | | | | The blocking bug https://issues.chromium.org/issues/332931390 has been fixed.
* [NFC] Move optimizeSubsequentStructSet() to a new pass, ↵Alon Zakai2024-09-031-0/+1
| | | | | | | | | | | | | | | | | | | HeapStoreOptimization (#6882) This just moves code out of OptimizeInstructions to the new pass. The existing test is renamed and now runs the new pass instead. The new pass is run right after each --optimize-instructions invocation, so it should not cause any noticeable effects whatsoever, making this NFC. The motivation here is that there is a bug in the pass, see the new testcase added at the end, which shows the bug. It is not practical to fix that bug in OptimizeInstructions since we need more than peephole optimizations to do so. This PR moves the code to a new pass so we can fix it there properly, later. The new pass is named HeapStoreOptimization since the same infrastructure we will need to fix the bug will also help dead store elimination and related things.
* Ignore fp16 in the fuzzer (#6881)Alon Zakai2024-08-291-1/+2
| | | | Add the feature flag in V8 invocations, but also disable the feature as it isn't quite ready yet.
* [Exceptions] Finish interpreter + optimizer support for try_table. (#6814)Sébastien Doeraene2024-08-201-6/+7
| | | | | | * Add interpreter support for exnref values. * Fix optimization passes to support try_table. * Enable the interpreter (but not in V8, see code) on exceptions.
* Add a pass for minimizing recursion groups (#6832)Thomas Lively2024-08-171-0/+1
| | | | | | | | | | | | Most of our type optimization passes emit all non-public types as a single large rec group, which trivially ensures that different types remain different, even if they are optimized to have the same structure. Usually emitting a single large rec group is fine, but it also means that if the module is split, all of the types will need to be repeated in all of the split modules. To better support this use case, add a pass that can split the large rec group back into minimal rec groups, taking care to preserve separate type identities by emitting different permutations of the same group where possible or by inserting unused brand types to differentiate them.
* Monomorphization: Add a flag to control the required improvement (#6837)Alon Zakai2024-08-141-1/+4
| | | | | | | | | | | | | | | | | | | The argument is the minimum benefit we must see for us to decide to optimize, e.g. --monomorphize --pass-arg=monomorphize-min-benefit@50 When the minimum benefit is 50% then if we reduce the cost by 50% through monomorphization then we optimize there. 95% would only optimize when we remove almost all the cost, etc. In practice I see 95% will actually tend to reduce code size overall, as while we add monomorphized versions of functions, we only do so when we remove a lot of work and size, and after inlining we gain benefits. However, 50% or even lower can lead to better benchmark results, in return for larger code size, just like with inlining. To be careful, the default is set to 95%. Previously we optimized whenever we saw any benefit at all, which is the same as requiring a minimum benefit of 0%. Old tests have the flag applied in this PR to set that value, so they do not change.
* [FP16] Disable float 16 fuzzing for now. (#6822)Brendan Dahl2024-08-071-0/+2
|
* [threads] Update the fuzzer for shared types (#6771)Thomas Lively2024-07-181-17/+9
| | | | | | | | Update the fuzzer to both handle shared types in initial contents and create and use new shared types without crashing or producing invalid modules. Since V8 does not have a complete implementation of shared-everything-threads yet, disable fuzzing V8 when shared-everything is enabled. To avoid losing too much coverage of V8, disable shared-everything in the fuzzer more frequently than other features.
* Validate features for types used in element segments (#6769)Thomas Lively2024-07-181-0/+1
|
* Validate features for types used in tables (#6768)Thomas Lively2024-07-181-0/+1
| | | | We previously special-cased things like GC types, but switch to a more general solution of detecting what features a table's type requires.
* [threads] ref.i31_shared requires shared-everything in validation (#6767)Thomas Lively2024-07-181-0/+1
|
* [threads] Simplify and generalize reftype writing without GC (#6766)Thomas Lively2024-07-181-1/+1
| | | | | | Similar to #6765, but for types instead of heap types. Generalize the logic for transforming written reference types to types that are supported without GC so that it will automatically handle shared types and other new types correctly.
* [threads] Simplify and generalize heap type writing without GC (#6765)Thomas Lively2024-07-171-0/+1
| | | | | | | | | | We represent `ref.null`s as having bottom heap types, even when GC is not enabled. Bottom heap types are a feature of the GC proposal, so in that case the binary writer needs to write the corresponding top type instead. We previously had separate logic for this for each type hierarchy in the binary writer, but that did not handle shared types and would not have automatically handled other new types, either. Simplify and generalize the implementation and test that we can write `ref.null`s of shared types without GC enabled.
* [threads] Fix shared ref.eq and disallow mixed-shareability (#6763)Thomas Lively2024-07-171-0/+1
| | | | | | | Update the validator to reject mixed-shareability ref.eq, although this is still under discussion in https://github.com/WebAssembly/shared-everything-threads/issues/76. Fix the implementation of `Literal::operator==` to work properly with shared i31ref.
* [threads] Validate all features required by ref.null (#6757)Thomas Lively2024-07-161-0/+2
| | | | | | | `ref.null` of shared types should only be allowed when shared-everything is enabled, but we were previously checking only that reference types were enabled when validating `ref.null`. Update the code to check all features required by the null type and factor out shared logic for printing lists of missing feature options in error messages.
* [NFC][threads] Ignore type-ssa-shared.wast in fuzzer (#6754)Thomas Lively2024-07-161-0/+1
| | | | The fuzzer does not yet properly handle initial contents containing shared types.
* [threads] ref.i31_shared (#6735)Thomas Lively2024-07-121-0/+1
| | | | | | | Implement `ref.i31_shared` the new instruction for creating references to shared i31s. Implement binary and text parsing and emitting as well as interpretation. Copy the upstream spec test for i31 and modify it so that all the heap types are shared. Comment out some parts that we do not yet support.
* [StackIR] Allow StackIR to be disabled from the commandline (#6725)Alon Zakai2024-07-101-0/+1
| | | | | | | | | Normally we use it when optimizing (above a certain level). This lets the user prevent it from being used even then. Also add optimization options to wasm-metadce so that this is possible there as well and not just in wasm-opt (this also opens the door to running more passes in metadce, which may be useful later).
* [threads] Ignore shared-array.wast in fuzzer initial contents (#6706)Thomas Lively2024-06-261-0/+1
|
* [threads] Validate shared-polymorphic instructions (#6702)Thomas Lively2024-06-251-0/+1
| | | | Such as `ref.eq`, `i31.get_{s,u}`, and `array.len`. Also validate that struct and array operations work on shared structs and arrays.
* [threads] Binary reading and writing of shared composite types (#6664)Thomas Lively2024-06-141-0/+4
| | | | Also update the parser so that implicit type uses are not matched with shared function types.
* Fuzzer: Stop testing with TurboFan as Turboshaft is rolling out and is ↵Alon Zakai2024-05-281-7/+0
| | | | faster (#6623)
* Fix binary emitting of br_if with a refined value by emitting a cast (#6510)Alon Zakai2024-05-161-1/+18
| | | | | | | | | | | | | | | | This makes us compliant with the wasm spec by adding a cast: we use the refined type for br_if fallthrough values, and the wasm spec uses the branch target. If the two differ, we add a cast after the br_if to make things match. Alternatively we could match the wasm spec's typing in our IR, but we hope the wasm spec will improve here, and so this is will only be temporary in that case. Even if not, this is useful because by using the most refined type in the IR we optimize in the best way possible, and only suffer when we emit fixups in the binary, but in practice those cases are very rare: br_if is almost always dropped rather than used, in real-world code (except for fuzz cases and exploits). We check carefully when a br_if value is actually used (and not dropped) and its type actually differs, and it does not already have a cast. The last condition ensures that we do not keep adding casts over repeated roundtripping.
* Fuzzer: Add another stringview subtyping error message to ignore (#6575)Alon Zakai2024-05-091-0/+1
|
* Fuzzer: Stop emitting nullable stringviews (#6574)Alon Zakai2024-05-081-0/+3
| | | | | | | | | | | | | As of https://chromium-review.googlesource.com/c/v8/v8/+/5471674 V8 requires stringviews to be non-nullable. It might be possible to make that change in our IR, or to remove views entirely, but for now this PR makes the fuzzer stop emitting nullable stringviews as a workaround to allow us to fuzz current V8. There are still rare corner cases where this pattern is emitted, that we have not tracked down, and so this also makes the fuzzer ignore the error for now.
* Re-enable fuzzing of text round trips (#6560)Thomas Lively2024-04-291-2/+1
| | | The bug that had been preventing this fuzzing no longer reproduces.
* [Strings] Add the string heaptype to core fuzzer places (#6527)Alon Zakai2024-04-231-1/+2
| | | | | | | With this we emit strings spontaneously (as opposed to just getting them from initial contents). The relevant -ttf test has been tweaked slightly to show the impact of this change: now there are some string.new/const in the output.
* Fuzzer: Do not run other VMs if the Binaryen interpreter hits a VM ↵Alon Zakai2024-04-101-10/+19
| | | | | | | | | limitation (#6483) The VM limitation might be an OOM (which can change due to opts) or an atomic wait (which can hang on proper VMs with support). We already avoided running VMs on the optimized wasm in this case, but we still ran them on the original wasm, which this changes, mainly to avoid that atomic wait situation.
* [NFC] Fix fuzzer counting of ignored runs due to many errors (#6444)Alon Zakai2024-03-271-4/+12
| | | | | | When the interpreter sees that most exports simply trap we mark the iteration as ignored. But we run the interpreter on the before wasm and also the after wasm, so we were incrementing that counter by 2 each time, which could be misleading.
* [Strings] Represent string values as WTF-16 internally (#6418)Thomas Lively2024-03-221-3/+0
| | | | | | | | | | | | | | | | WTF-16, i.e. arbitrary sequences of 16-bit values, is the encoding of Java and JavaScript strings, and using the same encoding makes the interpretation of string operations trivial, even when accounting for non-ascii characters. Specifically, use little-endian WTF-16. Re-encode string constants from WTF-8 to WTF-16 in the parsers, then back to WTF-8 in the writers. Update the constructor for string `Literal`s to interpret the string as WTF-16 and store a sequence of WTF-16 code units, i.e. 16-bit integers. Update `Builder::makeConstantExpression` accordingly to convert from the new `Literal` string representation back to a WTF-16 string. Update the interpreter to remove the logic for detecting non-ascii characters and bailing out. The naive implementations of all the string operations are correct now that our string encoding matches the JS string encoding.
* Update file name in INITIAL_CONTENTS_IGNORE (#6425)Thomas Lively2024-03-221-1/+1
| | | | The test file was renamed, but the fuzzer still used the old name in INITIAL_CONTENTS_IGNORE.
* [Strings] Implement stringview_wtf16.slice (#6404)Alon Zakai2024-03-191-1/+2
|
* Typed continuations: suspend instructions (#6393)Frank Emrich2024-03-191-0/+1
| | | | | | | | | | | | | | | | | | | | | This PR is part of a series that adds basic support for the [typed continuations/wasmfx proposal](https://github.com/wasmfx/specfx). This particular PR adds support for the `suspend` instruction for suspending with a given tag, documented [here](https://github.com/wasmfx/specfx/blob/main/proposals/continuations/Overview.md#instructions). These instructions are of the form `(suspend $tag)`. Assuming that `$tag` is defined with _n_ `param` types `t_1` to `t_n`, the instruction consumes _n_ arguments of types `t_1` to `t_n`. Its result type is the same as the `result` type of the tag. Thus, the folded textual representation looks like `(suspend $tag arg1 ... argn)`. Support for the instruction is implemented in both the old and the new wat parser. Note that this PR does not implement validation of the new instruction. This PR also fixes finalization of `cont.new`, `cont.bind` and `resume` nodes in those cases where any of their children are unreachable.
* Fuzzer: Fix up null outputs in wasm2js optimized builds (#6374)Alon Zakai2024-03-081-0/+15
| | | | | | | | This is fallout from #6310 where we moved to use fuzz_shell.js for all fuzzing purposes. That script doesn't know wasm types, all it has on the JS side is the number of arguments to a function, and it passes in null for them all regardless of their type. That normally works fine - null is cast to the right type upon use - but in wasm2js optimized builds we can remove casts, which can make that noticeable.
* Fuzzer: Standardize notation for exception prefixes (#6369)Alon Zakai2024-03-051-2/+8
| | | | | | | | | We had exception: in one and exception thrown: in another. Making those consistent allows fuzz_shell.js to print the exception after that prefix, which makes debugging easier sometimes. Also canonicalize tag names. Like funcref names, JS VMs print out the internal name, which can change after opts, so canonicalize it.
* Fuzzer: Ignore fuzz testcases that make VMs run out of stack (#6376)Alon Zakai2024-03-041-8/+19
| | | | | | | | | | | | | | | When the stack runs out is observable and optimizations can change it, so we must ignore such testcases. Also add some logic to help debug stuff like this, as suggested by tlively in the past, to add some metrics on the reasons we ignored a testcase. That emits something like this: (ignored 253 iters, for reasons {'too many errors vs calls': 230, '[host limit ': 20, 'uninitialized non-defaultable local': 3}) As a drive by make the metrics print wasm bytes/iter rather than by second (the former is easy to compute from the latter anyhow, and the latter is more interesting I think).
* Typed continuations: cont.bind instructions (#6365)Frank Emrich2024-03-041-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | This PR is part of a series that adds basic support for the [typed continuations/wasmfx proposal](https://github.com/wasmfx/specfx). This particular PR adds support for the `cont.bind` instruction for partially applying continuations, documented [here](https://github.com/wasmfx/specfx/blob/main/proposals/continuations/Overview.md#instructions). In short, these instructions are of the form `(cont.bind $ct_before $ct_after)` where `$ct_before` and `$ct_after` are related continuation types. They must only differ in the number of arguments, where `$ct_before` has _n_ additional parameters as compared to `$ct_after`, for some _n_ ≥ 0. The idea is that `(cont.bind $ct_before $ct_after)` then takes a reference to a continuation of type `$ct_before` as well as _n_ operands and returns a (reference to a) continuation of type `$ct_after`. Thus, the folded textual representation looks like `(cont.bind $ct_before $ct_after arg1 ... argn c)`. Support for the instruction is implemented in both the old and the new wat parser. Note that this PR does not implement validation of the new instruction.
* Fuzz V8 Turboshaft (#6360)Alon Zakai2024-02-281-1/+8
|
* Fuzzer: Separate arguments used to make the fuzz wasm from the opts we run ↵Alon Zakai2024-02-271-8/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | on it (#6357) Before FUZZ_OPTS was used both when doing --translate-to-fuzz/-ttf to generate the wasm from the random bytes and also when later running optimizations to generate a second wasm file for comparison. That is, we ended up doing this, if the opts were -O3: wasm-opt random.input -ttf -o a.wasm -O3 wasm-opt a.wasm -O3 -o b.wasm Now we have a pair a.wasm,b.wasm which we can test. However, we have run -O3 on both which is a little silly - the second -O3 might not actually have anything left to do, which would mean we compare the same wasm to itself. Worse, this is incorrect, as there are things we need to do only during the generation phase, like --denan. We need that in order to generate a valid wasm to test on, but it is "destructive" in itself: when removing NaNs (to avoid nondeterminism) if replaces them with 0, which is different. As a result, running --denan when generating the second wasm from the first could lead to different execution in them. This was always a problem, but became more noticable recently now that DeNaN modifies SIMD operations, as one optimization we do is to replace a memory.copy with v128.load + v128.store, and --denan will make sure the loaded value has no NaNs... To fix this, separate the generation and optimization phase. Instead of wasm-opt random.input -ttf -o a.wasm --denan -O3 wasm-opt a.wasm --denan -O3 -o b.wasm (note how --denan -O3 appears twice), do this: wasm-opt random.input -ttf -o a.wasm --denan wasm-opt a.wasm -O3 -o b.wasm (note how --denan appears in generation, and -O3 in optimization).
* Fuzzer: Handle negative i31s (#6341)Alon Zakai2024-02-231-1/+1
|
* Fuzzer: Ignore V8 errors on uninitialized non-defaultable locals (#6337)Alon Zakai2024-02-221-0/+9
| | | | | | | | | | See #5665 #5599, this is an existing issue and we have a workaround for it using --dce, but it does not always work. I seem to be seeing this in higher frequency since landing recent fuzzer improvements, so ignore it. There is some risk of us missing real bugs here (that we validate and V8 does not), but this is a validation error which is not as serious as a difference in behavior. And this is a long-standing issue that hasn't bitten us yet.
* Typed continuations: cont.new instructions (#6308)Frank Emrich2024-02-221-0/+1
| | | | | | | | | | | | | | | | | This PR is part of a series that adds basic support for the [typed continuations/wasmfx proposal](https://github.com/wasmfx/specfx). This particular PR adds support for the `cont.new` instruction for creating continuations, documented [here(https://github.com/wasmfx/specfx/blob/main/proposals/continuations/Overview.md#instructions). In short, these instructions are of the form `(cont.new $ct)` where `$ct` must be a continuation type. The instruction takes a single (nullable) function reference as its argument, which means that the folded representation of the instruction is of the form `(cont.new $ct (foo ...))`. Support for the instruction is implemented in both the old and the new wat parser. Note that this PR does not implement validation of the new instruction.
* Fuzzer: Adjust feature fuzzing frequency (#6305)Alon Zakai2024-02-221-14/+21
| | | | | | | | | We used to fuzz MVP 1/3, all 1/3, and a mixture 1/3, but that gives far too much priority to the MVP which is increasingly less important. It is also a good idea to give "all" more priority as that enables more initial content to run (the fuzzer will discard initial content if it doesn't validate with the features chosen in the current iteration). Also (NFC) rename POSSIBLE_FEATURE_OPTS to make the code easier to follow.
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-06 14:17:35 +0000