summaryrefslogtreecommitdiff
path: root/src/tools/fuzzing.h
Commit message (Collapse)AuthorAgeFilesLines
* Add new compound Signature, Struct and Array types (#3012)Daniel Wirtz2020-08-241-7/+7
| | | | | Extends the `Type` hash-consing infrastructure to handle type-parameterized and constructed types introduced in the typed function references and GC proposals. This should be a non-functional change since the new types are not used anywhere yet. Recursive type construction and canonicalization is also left as future work. Co-authored-by: Thomas Lively <tlively@google.com>
* Use const modifier when dealing with types (#3064)Daniel Wirtz2020-08-201-7/+7
| | | Since they make the code clearer and more self-documenting.
* Replace Type::expand() with an iterator-based approach (#3061)Daniel Wirtz2020-08-191-11/+12
| | | This leads to simpler code and is a prerequisite for #3012, which makes it so that not all `Type`s are backed by vectors that `expand` could return.
* Prepare for compound types that are single but not basic (#3046)Daniel Wirtz2020-08-171-12/+15
| | | | | | | | | | | | | | As a follow-up to https://github.com/WebAssembly/binaryen/pull/3012#pullrequestreview-459686171 this PR prepares for the new compound Signature, Struct and Array types that are single but not basic. This includes: * Renames `Type::getSingle` to `Type::getBasic` (NFC). Previously, its name was not representing its implementation (`isSingle` excluded `none` and `unreachable` while `getSingle` didn't, i.e. `getSingle` really was `getBasic`). Note that a hypothetical `Type::getSingle` cannot return `ValueType` anyway (new compound types are single but don't map to `ValueType`), so I figured it's best to skip implementing it until we actually need it. * Marks locations where we are (still) assuming that all single types are basic types, as suggested in https://github.com/WebAssembly/binaryen/pull/3012#discussion_r465356708, but using a macro, so we get useful errors once we start implementing the new types and can quickly traverse the affected locations. The macro is added where * there used to be a `switch (type.getSingle())` or similar that handled any basic type (NFC), but in the future will also have to handle single types that are not basic types. * we are not dealing with `Unary`, `Binary`, `Load`, `Store` or `AtomicXY` instructions, since these don't deal with compound types anyway.
* Implement prototype v128.load{32,64}_zero instructions (#3011)Thomas Lively2020-08-031-0/+4
| | | | | | | | Specified in https://github.com/WebAssembly/simd/pull/237. Since these are just prototypes necessary for benchmarking, this PR does not add support for these instructions to the fuzzer or the C or JS APIs. This PR also renumbers the QFMA instructions that previously used the opcodes for these new instructions. The renumbering matches the renumbering in V8 and LLVM.
* Better const fuzzing (#2972)Alon Zakai2020-07-301-14/+35
| | | | | | | | Tweak floating-point numbers with not just a +-1 integer, but also a float in [-1, 1]. Apply a tweak to powers of 2 as well. This found bugs in various codebases, see WebAssembly/spec#1224
* Add a builder.makeConst helper template (#2971)Alon Zakai2020-07-211-23/+18
|
* Rename anyref to externref to match proposal change (#2900)Jay Phelps2020-06-101-15/+16
| | | | | | | anyref future semantics were changed to only represent opaque host values, and thus renamed to externref. [Chromium](https://bugs.chromium.org/p/v8/issues/detail?id=7748#c360) was just updated to today (not yet released). I couldn't find a Mozilla bugzilla ticket mentioning externref so I don't immediately know if they've updated yet. https://github.com/WebAssembly/reference-types/pull/87
* DeNaN pass (#2877)Alon Zakai2020-05-271-103/+55
| | | | | | This moves the fuzzer de-NaN logic out into a separate pass. This is cleaner and also better since the old way would de-NaN once, but then the reducer could generate code with nans. The new way lets us de-NaN while reducing.
* Fuzz frequency tuning (#2806)Alon Zakai2020-04-271-97/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We had some ad-hoc tuning of which nodes to emit more frequently in the fuzzer, but it wasn't very good. Things like loads and stores for example were far too rare. Also it wasn't easy to adjust the frequencies. This adds a simple way to adjust them, by passing a size_t which is the "weight" of that node. Then it just makes that number of copies of it, making it more likely to be picked. Example output comparison: node before after ================================ binary 281 365 block 898 649 break 278 144 call 182 290 call_indirect 9 42 const 808 854 drop 43 92 global.get 440 398 global.set 223 171 if 335 254 load 22 84 local.get 429 301 local.set 434 211 loop 176 99 nop 117 54 return 264 197 select 8 33 store 1 39 unary 405 304 unreachable 1 2 Lots of noise here obviously, but there are large increases for loads and stores compared to before. Also add a testcase of random data of the typical size the fuzzer runs, and print metrics on it. This might help us get a feel for how future tuning changes affect frequencies.
* Fix issues with Types and Features (#2773)Thomas Lively2020-04-161-1/+3
| | | | | | | | | 1. Only emit exnref as part of a subtype if exception-handling is enabled in the fuzzer. 2. Correctly report that funcref and nullref require reference-types to be enabled. 3. Re-enable multivalue as a normal feature in the fuzzer. Possibly fixes #2770.
* Fix OOB fuzzing (#2769)Alon Zakai2020-04-161-9/+15
| | | | | | | | | We should only do weird changes to the fuzz code if we allow out of bounds operations, because the OOB checks are generated as we build the IR, and changing them can remove the checks. (we fuzz 50% of the time with and 50% without OOBs, so this doesn't really hurt us)
* Emit tuples in the fuzzer (#2695)Thomas Lively2020-04-151-108/+170
| | | | | | | | Emit tuple.make, tuple.extract, and multivalue control flow, and tuple locals and globals when multivalue is enabled. Also slightly refactors the top-level `makeConcrete` function to be more selective about what it tries to make based on the requested type to reduce the number of trivial nodes created because the requested type is incompatible with the requested node.
* Remove duplicate Type:: prefixes (NFC) (#2753)Heejin Ahn2020-04-121-6/+6
| | | | | | | | | These seem to be accidentally introduced in when we enforced use of `Type::` on type names in #2434. By the way TIL this actually compiles, and don't know why: ``` Type::Type::Type::Type::Type::Type::Type::Type::none ```
* Fix multivalue event fuzzing (#2748)Thomas Lively2020-04-101-2/+0
| | | | | The fuzzer was previously unconditionally emitting one event parameter more than it was supposed to, which meant multivalue events were emitted when multivalue was not enabled.
* Do not emit multivalue events in fuzzer (#2723)Thomas Lively2020-04-031-2/+3
| | | | | | Unless the multivalue feature is enabled. The validation for events recently changed to disallow events returning multiple items unless the multivalue feature is enabled, but the fuzzer was not updated accordingly. This PR fixes the glitch.
* Avoid an infinite loop in `-ttf` generation (#2637)Alex Crichton2020-02-041-1/+1
| | | | | | | | | | | | | | | We've been throwing some fuzzing at some wasm implementations recently and one of our strategies is to use `wasm-opt -ttf` with the fuzzer's input to generate a wasm module. Some of our tests, though, have been failing due to out-of-memory while `wasm-opt` is generating a module. This loop appears to be infinitely executing since the input just-so-happens that `oneIn(3)` returns true for every byte of the input file, or at least enough such that when the xor factor is merged in it at least generates very long sequence of `true`. It looks like elsewhere in the file when `while (oneIn(N))` is used it's also guarded by `!finishedInput`, so I've added a similar guard here as well.
* Remove implicit conversion operators from Type (#2577)Thomas Lively2020-01-081-13/+13
| | | | | | | | | | * Remove implicit conversion operators from Type Now types must be explicitly converted to uint32_t with Type::getID or to ValueType with Type::getVT. This fixes #2572 for switches that use Type::getVT. * getVT => getSingle
* [NFC] Enforce use of `Type::` on type names (#2434)Thomas Lively2020-01-071-314/+321
|
* [NFC] Clean up unnecessary `template`s in calls 🧹🧹🧹 (#2394)Thomas Lively2020-01-071-3/+3
|
* Use FeatureSet instead of FeatureSet::Feature(NFC) (#2562)Heejin Ahn2020-01-021-22/+20
| | | | | This uses `FeatureSet` in place of `FeatureSet::Feature` when possible, making it possible for functions take a set of multiple features as one argument.
* Add support for reference types proposal (#2451)Heejin Ahn2019-12-301-71/+182
| | | | | | | | | | | | This adds support for the reference type proposal. This includes support for all reference types (`anyref`, `funcref`(=`anyfunc`), and `nullref`) and four new instructions: `ref.null`, `ref.is_null`, `ref.func`, and new typed `select`. This also adds subtype relationship support between reference types. This does not include table instructions yet. This also does not include wasm2js support. Fixes #2444 and fixes #2447.
* Make local.tee's type its local's type (#2511)Heejin Ahn2019-12-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to the current spec, `local.tee`'s return type should be the same as its local's type. (Discussions on whether we should change this rule is going on in WebAssembly/reference-types#55, but here I will assume this spec does not change. If this changes, we should change many parts of Binaryen transformation anyway...) But currently in Binaryen `local.tee`'s type is computed from its value's type. This didn't make any difference in the MVP, but after we have subtype relationship in #2451, this can become a problem. For example: ``` (func $test (result funcref) (local $0 anyref) (local.tee $0 (ref.func $test) ) ) ``` This shouldn't validate in the spec, but this will pass Binaryen validation with the current `local.tee` implementation. This makes `local.tee`'s type computed from the local's type, and makes `LocalSet::makeTee` get a type parameter, to which we should pass the its corresponding local's type. We don't embed the local type in the class `LocalSet` because it may increase memory size. This also fixes the type of `local.get` to be the local type where `local.get` and `local.set` pair is created from `local.tee`.
* Remove FunctionType (#2510)Thomas Lively2019-12-111-33/+28
| | | | | | | | | | | | | | | | | Function signatures were previously redundantly stored on Function objects as well as on FunctionType objects. These two signature representations had to always be kept in sync, which was error-prone and needlessly complex. This PR takes advantage of the new ability of Type to represent multiple value types by consolidating function signatures as a pair of Types (params and results) stored on the Function object. Since there are no longer module-global named function types, significant changes had to be made to the printing and emitting of function types, as well as their parsing and manipulation in various passes. The C and JS APIs and their tests also had to be updated to remove named function types.
* Add string parameter to WASM_UNREACHABLE (#2499)Sam Clegg2019-12-051-37/+37
| | | | | This works more like llvm's unreachable handler in that is preserves information even in release builds.
* Convert to using DEBUG macros (#2497)Sam Clegg2019-12-041-2/+1
| | | | | | This means that debugging/tracing can now be enabled and controlled centrally without managing and passing state around the codebase.
* Remove FunctionType from Event (#2466)Thomas Lively2019-11-251-9/+3
| | | | | | | | | This is the start of a larger refactoring to remove FunctionType entirely and store types and signatures directly on the entities that use them. This PR updates BrOnExn and Events to remove their use of FunctionType and makes the BinaryWriter traverse the module and collect types rather than using the global FunctionType list. While we are collecting types, we also sort them by frequency as an optimization. Remaining uses of FunctionType in Function, CallIndirect, and parsing will be removed in a future PR.
* Multivalue type creation and inspection (#2459)Thomas Lively2019-11-221-14/+14
| | | | | | | | | | | | | Adds the ability to create multivalue types from vectors of concrete value types. All types are transparently interned, so their representation is still a single uint32_t. Types can be extracted into vectors of their component parts, and all the single value types expand into vectors containing themselves. Multivalue types are not yet used in the IR, but their creation and inspection functionality is exposed and tested in the C and JS APIs. Also makes common type predicates methods of Type and improves the ergonomics of type printing.
* Improve type selection in fuzzer (#2424)Heejin Ahn2019-11-061-27/+27
| | | | | | | | | - Adds `items` function for `FeatureOptions` so we can get a vector of eligible types - Replaces hardcoded enumeration of MVP types with `getConcreteTypes`, which also adds v128 type to the list if SIMD is enabled - Removes `getType()` function; this does not seem to be used anywhere - Renames `vectorPick` with `pick` - Use the absolute path for d8 in the fuzzer
* Add i32x4.dot_i16x8_s (#2420)Thomas Lively2019-11-041-0/+1
| | | | | This experimental instruction is specified in https://github.com/WebAssembly/simd/pull/127 and is being implemented to enable further investigation of its performance impact.
* Add SIMD integer min and max instructions (#2416)Thomas Lively2019-11-011-0/+12
| | | As proposed in https://github.com/WebAssembly/simd/pull/27.
* v8x16.swizzle (#2368)Thomas Lively2019-10-031-1/+2
| | | | As specified at https://github.com/WebAssembly/simd/blob/master/proposals/simd/SIMD.md#swizzling-using-variable-indices.
* SIMD load and extend instructions (#2353)Thomas Lively2019-09-241-2/+16
| | | | | | Adds support for the new load and extend instructions. Also updates from C++11 to C++17 in order to use generic lambdas in the interpreter implementation.
* v128.andnot instruction (#2355)Thomas Lively2019-09-241-0/+1
| | | | | As specified at https://github.com/WebAssembly/simd/pull/102. Also fixes bugs in the JS API for other SIMD bitwise operators.
* vNxM.load_splat instructions (#2350)Thomas Lively2019-09-231-1/+26
| | | | | | | Introduces a new instruction class, `SIMDLoad`. Implements encoding, decoding, parsing, printing, and interpretation of the load and splat instructions, including in the C and JS APIs. `v128.load` remains in the `Load` instruction class for now because the interpreter code expects a `Load` to be able to load any memory value type.
* SIMD narrowing and widening operations (#2341)Thomas Lively2019-09-141-2/+14
|
* QFMA/QFMS instructions (#2328)Thomas Lively2019-09-031-6/+13
| | | | | | | | | Renames the SIMDBitselect class to SIMDTernary and adds the new {f32x4,f64x2}.qfm{a,s} ternary instructions. Because the SIMDBitselect class is no more, this is a backwards-incompatible change to the C interface. The new instructions are not yet used in the fuzzer because they are not yet implemented in V8. The corresponding LLVM commit is https://reviews.llvm.org/rL370556.
* Add atomic.fence instruction (#2307)Heejin Ahn2019-08-271-1/+5
| | | | | | | This adds `atomic.fence` instruction: https://github.com/WebAssembly/threads/blob/master/proposals/threads/Overview.md#fence-operator This also fix bugs in `atomic.wait` and `atomic.notify` instructions in binaryen.js and adds tests for them.
* Add initial support for anyref as an opaque type (#2294)Jay Phelps2019-08-201-7/+27
| | | | | | | | | | | | | Another round of trying to push upstream things from my fork. This PR only adds support for anyref itself as an opaque type. It does NOT implement the full [reference types proposal](https://github.com/WebAssembly/reference-types/blob/master/proposals/reference-types/Overview.md)--so no table.get/set/grow/etc or ref.null, ref.func, etc. Figured it was easier to review and merge as we go, especially if I did something fundamentally wrong. *** I did put it under the `--enable-reference-types` flag as I imagine that even though this PR doesn't complete the full feature set, it probably is the right home. Lmk if not. I'll also be adding a few github comments to places I want to point out/question.
* Fuzz all feature flags, and fix another SignExt issue in the fuzzer (#2259)Alon Zakai2019-07-241-1/+1
|
* Put Extend* opcodes behind SignExt feature. fixes #2257 (#2258)Alon Zakai2019-07-241-1/+1
|
* Finalize tail call support (#2246)Thomas Lively2019-07-231-8/+15
| | | | Adds tail call support to fuzzer and makes small changes to handle return calls in multiple utilities and passes. Makes larger changes to DAE and inlining passes to properly handle tail calls.
* Rename except_ref type to exnref (#2224)Heejin Ahn2019-07-141-23/+23
| | | | In WebAssembly/exception-handling#79 we agreed to rename `except_ref` type to `exnref`.
* Bysyncify: Fuzzing (#2192)Alon Zakai2019-07-011-0/+2
| | | | | | | | Gets fuzzing support for Bysyncify working. * Add the python to run the fuzzing on bysyncify. * Add a JS script to load and run a testcase with bysyncify support. The code has all the runtime support for sleep/resume etc., which it does on calls to imports at random in a deterministic manner. * Export memory from fuzzer so JS can access it. * Fix tiny builder bug with makeExport.
* Add event section (#2151)Heejin Ahn2019-05-311-0/+25
| | | | | | | | | | | | | | | | | | This adds support for the event and the event section, as specified in https://github.com/WebAssembly/exception-handling/blob/master/proposals/Exceptions.md#changes-to-the-binary-model. Wasm events are features that suspend the current execution and transfer the control flow to a corresponding handler. Currently the only supported event kind is exceptions. For events, this includes support for - Binary file reading/writing - Wast file reading/writing - Binaryen.js API - Fuzzer - Validation - Metadce - Passes: metrics, minify-imports-and-exports, remove-unused-module-elements
* Reflect instruction renaming in code (#2128)Heejin Ahn2019-05-211-32/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - Reflected new renamed instruction names in code and tests: - `get_local` -> `local.get` - `set_local` -> `local.set` - `tee_local` -> `local.tee` - `get_global` -> `global.get` - `set_global` -> `global.set` - `current_memory` -> `memory.size` - `grow_memory` -> `memory.grow` - Removed APIs related to old instruction names in Binaryen.js and added APIs with new names if they are missing. - Renamed `typedef SortedVector LocalSet` to `SetsOfLocals` to prevent name clashes. - Resolved several TODO renaming items in wasm-binary.h: - `TableSwitch` -> `BrTable` - `I32ConvertI64` -> `I32WrapI64` - `I64STruncI32` -> `I64SExtendI32` - `I64UTruncI32` -> `I64UExtendI32` - `F32ConvertF64` -> `F32DemoteI64` - `F64ConvertF32` -> `F64PromoteF32` - Renamed `BinaryenGetFeatures` and `BinaryenSetFeatures` to `BinaryenModuleGetFeatures` and `BinaryenModuleSetFeatures` for consistency.
* Add a fuzzer option to not emit code with OOB loads/indirect calls (#2113)Alon Zakai2019-05-171-2/+8
| | | | | This is useful for wasm2js, as we don't emit traps for OOB loads etc. like wasm (like we don't trap on bad float-to-int, as it's too hard in JS, and it's undefined behavior in C anyhow). It may also help general fuzzing, as those traps may make other interesting patterns less likely. Also add more wasm2js support in the fuzzer, which includes using this no-OOB option.
* Add except_ref type (#2081)Heejin Ahn2019-05-071-2/+34
| | | | This adds except_ref type, which is a part of the exception handling proposal.
* clang-tidy braces changes (#2075)Alon Zakai2019-05-011-51/+102
| | | Applies the changes in #2065, and temprarily disables the hook since it's too slow to run on a change this large. We should re-enable it in a later commit.
* Apply format changes from #2048 (#2059)Alon Zakai2019-04-261-512/+1042
| | | Mass change to apply clang-format to everything. We are applying this in a PR by me so the (git) blame is all mine ;) but @aheejin did all the work to get clang-format set up and all the manual work to tidy up some things to make the output nicer in #2048
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-17 21:27:47 +0000