summaryrefslogtreecommitdiff
path: root/src/tools/fuzzing.h
Commit message (Collapse)AuthorAgeFilesLines
...
* RefFunc: Validate that the type is non-nullable, and avoid possible bugs in ↵Alon Zakai2021-04-081-9/+6
| | | | | | | | the builder (#3790) The builder can receive a HeapType so that callers don't need to set non-nullability themselves. Not NFC as some of the callers were in fact still making it nullable.
* Fuzzer: Do not assume table 0 is funcref, as initial content may include a ↵Alon Zakai2021-04-081-1/+4
| | | | non-funcref table (#3787)
* [RT] Add type to tables and element segments (#3763)Abbas Mashayekh2021-04-061-13/+32
|
* Update SIMD names and opcodes (#3771)Thomas Lively2021-04-051-17/+11
| | | | Also removes experimental SIMD instructions that were not included in the final spec proposal.
* Fix an iterator invalidation error in the fuzzer (#3764)Alon Zakai2021-04-011-2/+8
|
* Fix fuzzer on creating a function with a heaptype of just 'func' (#3738)Alon Zakai2021-03-251-6/+23
| | | Also handle more cases of non-function data types there.
* Fix nondefaultability of Tuple types (#3733)Alon Zakai2021-03-251-2/+3
| | | | | | | This looks like a pre-existing issue to #3731, but the testcase only fails on that PR for a reason I did not investigate in depth, so it should land first. Also fix the check for nondefaultability in the fuzzer.
* [RT] Support expressions in element segments (#3666)Abbas Mashayekh2021-03-241-6/+10
| | | | | | This PR adds support for `ref.null t` as a valid element segment item. The abbreviated format of `(elem ... func $f $g...)` is kept in both printing and binary emitting if all items are `ref.func`s. Public APIs aren't updated in this PR.
* [Wasm GC] Add support for non-nullable types, all except for locals (#3710)Alon Zakai2021-03-231-4/+2
| | | | | | | | | | | | | | | | | | | | | | After this PR we still do not support non-nullable locals. But we no longer turn all types into nullable upon load. In particular, we support non-nullable types on function parameters and struct fields, etc. This should be enough to experiment with optimizations in both binaryen and in VMs regarding non- nullability (since we expect that optimizing VMs can do well inside functions anyhow; it's non-nullability across calls and from data that the VM can't be expected to think about). Let is handled as before, by lowering it into gets and sets. In addition, we turn non-nullable locals into nullable ones, and add a ref.as_non_null on all their gets (to keep the type identical there). This is used not just for loading code with a let but also is needed after inlining. Most of the code changes here are removing FIXMEs for allowing non-nullable types. But there is also code to handle the issues mentioned above. Most of the test updates are removing extra nulls that we added before when we turned all types nullable. A few tests had actual issues, though, and also some new tests are added to cover the code changes here.
* Simplify fuzzer fixup code for names (#3688)Alon Zakai2021-03-151-33/+15
| | | Rather than use delegates.h, we have helpers for scope names.
* Fix fuzz issue with ElementSegment name collisions (#3674)Alon Zakai2021-03-121-12/+10
| | | | | Now that they have names they can collide. All the fuzzer wants is to ensure there is a segment to add to, so if there is one, do not add another.
* [reference-types] Support passive elem segments (#3572)Abbas Mashayekh2021-03-051-22/+33
| | | | | | | | | | | Passive element segments do not belong to any table, so the link between Table and elem needs to be weaker; i.e. an elem may have a table in case of active segments, or simply be a collection of function references in case of passive/declarative segments. This PR takes Table::Segment out and turns it into a first class module element just like tables and functions. It also implements early support for parsing, printing, encoding and decoding passive/declarative elem segments.
* [GC] Fuzzer: Avoid creating tuples with non-defaultable types (#3567)Alon Zakai2021-02-161-3/+7
|
* [GC] Support RTT constants in Builder::makeConstantExpression (#3550)Alon Zakai2021-02-091-7/+1
| | | | This allows the reducer to operate on RTTs, but could help other things too.
* [reference-types] remove single table restriction in IR (#3517)Abbas Mashayekh2021-02-091-23/+34
| | | Adds support for modules with multiple tables. Adds a field for the table name to `CallIndirect` and updates the C/JS APIs accordingly.
* [GC] Avoid replacing non-defaultable types in the fuzzer (#3549)Alon Zakai2021-02-081-2/+10
| | | | We can't arbitrarily replace a non-defaultable type, as it may lead to us needing a temp local for it (say, in a tuple).
* [GC] Small fuzz fixes for GC (#3540)Alon Zakai2021-02-031-35/+49
| | | | | | | | * Fix label fixup code to use delegates-fields. This makes it support BrOn etc. * Add an isRtt() in places RTTs are not supported. * Implement makeConst for arbitrary RTTs. This is enough to get the fuzzer working for more than a few iterations at a time, but no more.
* [GC] Don't emit i31ref in fuzzer (#3531)Alon Zakai2021-02-011-11/+10
| | | | | | | That type is non-nullable, so we need to disable it until we fully support that. Right now if we emit such locals we immediately get a validation error. With this change the fuzzer can run at least a few thousand iterations with no errors once more.
* [GC] RefIsNull => RefIs. (#3516)Alon Zakai2021-01-261-1/+2
| | | | | | | | This internal refactoring prepares us for ref.is_func/data/i31, by renaming the node and adding an "op" field. For now that field must always be "Null" which means it is a ref.is_null. This adjusts the C API to match the new IR shape. The high-level JS API is unchanged.
* Remove exnref and br_on_exn (#3505)Heejin Ahn2021-01-221-22/+1
| | | This removes `exnref` type and `br_on_exn` instruction.
* [GC] Add dataref type (#3500)Alon Zakai2021-01-211-0/+15
| | | | | This is not 100% of everything, but is enough to get tests passing, which includes full binary and text format support, getting all switches to compile without error, and some additions to InstrumentLocals.
* Prototype SIMD extending pairwise add instructions (#3466)Thomas Lively2021-01-051-3/+1
| | | | | | As proposed in https://github.com/WebAssembly/simd/pull/380, using the opcodes used in LLVM and V8. Since these opcodes overlap with the opcodes of i64x2.all_true and i64x2.any_true, which have long since been removed from the SIMD proposal, this PR also removes those instructions.
* Use enums for mutability and nullability (#3443)Thomas Lively2020-12-141-3/+3
| | | | | Previously we were using bools for both of these concepts, but using enums makes the code clearer. In particular, the PR removes many instances of `/*nullability=*/ true`.
* [GC] Add struct.get instruction parsing and execution (#3429)Alon Zakai2020-12-071-18/+22
| | | | | | | | | | | | | | | | | | | | This is the first instruction that uses a GC Struct or Array, so it's where we start to actually need support in the interpreter for those values, which is added here. GC data is modeled as a gcData field on a Literal, which is just a Literals. That is, both a struct and an array are represented as an array of values. The type which is alongside would indicate if it's a struct or an array. Note that the data is referred to using a shared_ptr so it should "just work", but we'll only be able to really test that once we add struct.new and so can verify that references are by reference and not value, etc. As the first instruction to care about i8/16 types (which are only possible in a Struct or Array) this adds support for parsing and emitting them. This PR includes fuzz fixes for some minor things the fuzzer found, including some bad printing of not having ResultTypeName in necessary places (found by the text format roundtripping fuzzer).
* [TypedFunctionReferences] Enable call_ref in fuzzer, and fix minor misc fuzz ↵Alon Zakai2020-11-251-5/+39
| | | | | | | | | | | | | | | | | | | | bugs (#3401) * Count signatures in tuple locals. * Count nested signature types (confirming @aheejin was right, that was missing). * Inlining was using the wrong type. * OptimizeInstructions should return -1 for unhandled types, not error. * The fuzzer should check for ref types as well, not just typed function references, similar to what GC does. * The fuzzer now creates a function if it has no other option for creating a constant expression of a function type, then does a ref.func of that. * Handle unreachability in call_ref binary reading. * S-expression parsing fixes in more places, and add a tiny fuzzer for it. * Switch fuzzer test to just have the metrics, and not print all the fuzz output which changes a lot. Also fix noprint handling which only worked on binaries before. * Fix Properties::getLiteral() to use the specific function type properly, and make Literal's function constructor require that, to prevent future bugs. * Turn all input types into nullable types, for now.
* [TypedFunctionReferences] Implement call_ref (#3396)Alon Zakai2020-11-241-24/+33
| | | | | | | | Includes minimal support in various passes. Also includes actual optimization work in Directize, which was easy to add. Almost has fuzzer support, but the actual makeCallRef is just a stub so far. Includes s-parser support for parsing typed function references types.
* [TypedFunctionReferences] Add Typed Function References feature and use the ↵Alon Zakai2020-11-231-9/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | types (#3388) This adds the new feature and starts to use the new types where relevant. We use them even without the feature being enabled, as we don't know the features during wasm loading - but the hope is that given the type is a subtype, it should all work out. In practice, if you print out the internal type you may see a typed function reference-specific type for a ref.func for example, instead of a generic funcref, but it should not affect anything else. This PR does not support non-nullable types, that is, everything is nullable for now. As suggested by @tlively this is simpler for now and leaves nullability for later work (which will apparently require let or something else, and many passes may need to be changed). To allow this PR to work, we need to provide a type on creating a RefFunc. The wasm-builder.h internal API is updated for this, as are the C and JS APIs, which are breaking changes. cc @dcodeIO We must also write and read function types properly. This PR improves collectSignatures to find all the types, and also to sort them by the dependencies between them (as we can't emit X in the binary if it depends on Y, and Y has not been emitted - we need to give Y's index). This sorting ends up changing a few test outputs. InstrumentLocals support for printing function types that are not funcref is disabled for now, until we figure out how to make that work and/or decide if it's important enough to work on. The fuzzer has various fixes to emit valid types for things (mostly whitespace there). Also two drive-by fixes to call makeTrivial where it should be (when we fail to create a specific node, we can't just try to make another node, in theory it could infinitely recurse). Binary writing changes here to replace calls to a standalone function to write out a type with one that is called on the binary writer object itself, which maintains a mapping of type indexes (getFunctionSignatureByIndex).
* [wasm-builder] Construct module elements as unique_ptrs (#3391)Thomas Lively2020-11-191-9/+9
| | | | | | | | | When Functions, Globals, Events, and Exports are added to a module, if they are not already in std::unique_ptrs, they are wrapped in a new std::unique_ptr owned by the Module. This adds an extra layer of indirection when accessing those elements that can be avoided by allocating those elements as std::unique_ptrs. This PR updates wasm-builder to allocate module elements via std::make_unique rather than `new`. In the future, we should remove the raw pointer versions of Module::add* to encourage using std::unique_ptrs more broadly.
* Use RAII in fuzzer for function context creation (#3296)Alon Zakai2020-10-291-62/+64
| | | Followup to #3276
* Prototype new SIMD multiplications (#3291)Thomas Lively2020-10-281-0/+3
| | | | | | | Including saturating, rounding Q15 multiplication as proposed in https://github.com/WebAssembly/simd/pull/365 and extending multiplications as proposed in https://github.com/WebAssembly/simd/pull/376. Since these are just prototypes, skips adding them to the C or JS APIs and the fuzzer, as well as implementing them in the interpreter.
* Fuzzer: Add an option to fuzz with initial wasm contents (#3276)Alon Zakai2020-10-271-25/+218
| | | | | | | | | | | | | | | | | | | | | | | | | Previously the fuzzer constructed a new random valid wasm file from scratch. The new --initial-fuzz=FILENAME option makes it start from an existing wasm file, and then add random contents on top of that. It also randomly modifies the existing contents, for example tweaking a Const, replacing some nodes with other things of the same type, etc. It also has a chance to replace a drop with a logging (as some of our tests just drop a result, and we match the optimized output's wasm instead of the result; by logging, the fuzzer can check things). The goal is to find bugs by using existing hand-written testcases as a basis. This PR uses the test suite's testcases as initial fuzz contents. This can find issues as they often check for corner cases - they are designed to be "interesting", which random data may be less likely to find. This has found several bugs already, see recent fuzz fixes. I mentioned the first few on Twitter but past 4 I stopped counting... https://twitter.com/kripken/status/1314323318036602880 This required various changes to the fuzzer's generation to account for the fact that there can be existing functions and so forth before it starts to run, so it needs to avoid collisions and so forth.
* Implement i8x16.popcnt (#3286)Thomas Lively2020-10-271-0/+1
| | | | | | As proposed in https://github.com/WebAssembly/simd/pull/379. Since this instruction is still being evaluated for inclusion in the SIMD proposal, this PR does not add support for it to the C/JS APIs or to the fuzzer. This PR also performs a drive-by fix for unrelated instructions in c-api-kitchen-sink.c
* [NFC] `using namespace Abstract` to make matchers more compact (#3284)Thomas Lively2020-10-261-11/+7
| | | | | | | | | This change makes matchers in OptimizeInstructions more compact and readable by removing the explicit `Abstract::` namespace from individual operations. In some cases, this makes multi-line matcher expressions fit on a single line. This change is only possible because it also adds an explicit "RMW" prefix to each element of the `AtomicRMWOp` enumeration. Without that, their names conflicted with the names of Abstract ops.
* Implement v128.{load,store}{8,16,32,64}_lane instructions (#3278)Thomas Lively2020-10-221-0/+1
| | | | | | | These instructions are proposed in https://github.com/WebAssembly/simd/pull/350. This PR implements them throughout Binaryen except in the C/JS APIs and in the fuzzer, where it leaves TODOs instead. Right now these instructions are just being implemented for prototyping so adding them to the APIs isn't critical and they aren't generally available to be fuzzed in Wasm engines.
* Fuzzer: Tweak constants during mutation as well (#3272)Alon Zakai2020-10-211-33/+47
| | | | Move the tweak function to an outer location, and call it from mutate() with some probability.
* Fuzzer: Do not emit random global.get/sets of the hang limit global (#3229)Alon Zakai2020-10-121-3/+16
| | | | | | | | | That global is for internal use. If we emit random sets to it, we could prevent it from doing its job of preventing an infinite loop (normally it decreases each time a loop runs or we recurse, until we reach 0 - if we set it to a nonzero value in that code, that would be bad). Random gets are less of a problem, but may be confusing when debugging a testcase.
* Memory64 fuzzing preparations (#3223)Alon Zakai2020-10-121-7/+13
|
* Refactor naming convention for functions handling tuples (#3196)Max Graey2020-10-091-3/+3
| | | When there are two versions of a function, one handling tuples and the other handling non-tuple values, the previous naming convention was to have "Single" in the name of the non-tuple handling function. This PR simplifies the convention and shortens function names by making the names plural for the tuple-handling version and singular for the non-tuple-handling version.
* Add a little code to prepare exception handling support in fuzzer (#3207)Alon Zakai2020-10-091-4/+6
| | | | | | | fixLabels() in the fuzzer looks for invalid labels and fixes them up, after doing some random changes to existing wasm (which checks for types while doing so, but it may invalidate labels if we remove the target of a branch, for example). This adds trivial support for BrOnExn and Try there.
* Optimize getLoggableTypes in fuzzer, and add isLoggableType (#3208)Alon Zakai2020-10-091-7/+17
| | | | | | | Previously getLoggableType would allocate a vector every time. This caches it. Also add isLoggableType which will need this caching as I will be calling it quite a lot in a future patch to the fuzzer.
* GC: Fuzzing support for i31 (#3169)Daniel Wirtz2020-09-291-8/+31
| | | Integrates `i31ref` types and instructions into the fuzzer, by assuming that `(i31.new (i32.const N))` is constant and hence suitable to be used in global initializers.
* Fuzz with negative zero more often (#3133)Alon Zakai2020-09-211-2/+4
| | | | We did so earlier sometimes, as we would pick 0 and then tweak it with a negation. But that favored positive 0. This makes coverage symmetric.
* GC: Add ref.eq instruction (#3145)Daniel Wirtz2020-09-211-0/+18
| | | With `eqref` now integrated, the `ref.eq` instruction can be implemented. The only valid LHS and RHS value is `(ref.null eq)` for now, but implementation and fuzzer integration is otherwise complete.
* GC: Integrate eqref and i31ref types (#3141)Daniel Wirtz2020-09-191-2/+35
| | | Adds the `eqref` and `i31ref` types to their respective code locations. Implements what can be implemented trivially and otherwise traps with a TODO for now. Integration of `eqref` is mostly complete due to it being nullable, just like `anyref`, but `i31ref` needs to remain disabled in the fuzzer because we are lacking the functionality to create trivial `i31ref` values, i.e. `(i31.new (i32.const 0))`, which is left for follow-ups to implement.
* Add GC feature flag (#3135)Daniel Wirtz2020-09-171-13/+14
| | | Adds the `--enable-gc` feature flag, so far enabling the `anyref` type incl. subtyping, and removes the temporary `--enable-anyref` feature flag that it replaces.
* Add anyref feature and type (#3109)Daniel Wirtz2020-09-101-3/+30
| | | Adds `anyref` type, which is enabled by a new feature `--enable-anyref`. This type is primarily used for testing that passes correctly handle subtype relationships so that the codebase will continue to be prepared for future subtyping. Since `--enable-anyref` is meaningless without also using `--enable-reference-types`, this PR also makes it a validation error to pass only the former (and similarly makes it a validation error to enable exception handling without enabling reference types).
* Update reference types (#3084)Daniel Wirtz2020-09-091-37/+8
| | | | | | | Align with the current state of the reference types proposal: * Remove `nullref` * Remove `externref` and `funcref` subtyping * A `Literal` of a nullable reference type can now represent `null` (previously was type `nullref`) * Update the tests and temporarily comment out those tests relying on subtyping
* Add new compound Signature, Struct and Array types (#3012)Daniel Wirtz2020-08-241-7/+7
| | | | | Extends the `Type` hash-consing infrastructure to handle type-parameterized and constructed types introduced in the typed function references and GC proposals. This should be a non-functional change since the new types are not used anywhere yet. Recursive type construction and canonicalization is also left as future work. Co-authored-by: Thomas Lively <tlively@google.com>
* Use const modifier when dealing with types (#3064)Daniel Wirtz2020-08-201-7/+7
| | | Since they make the code clearer and more self-documenting.
* Replace Type::expand() with an iterator-based approach (#3061)Daniel Wirtz2020-08-191-11/+12
| | | This leads to simpler code and is a prerequisite for #3012, which makes it so that not all `Type`s are backed by vectors that `expand` could return.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-08 04:46:17 +0000