summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Fuzzer: Add an option to fuzz with initial wasm contents (#3276)Alon Zakai2020-10-273-29/+240
| | | | | | | | | | | | | | | | | | | | | | | | | Previously the fuzzer constructed a new random valid wasm file from scratch. The new --initial-fuzz=FILENAME option makes it start from an existing wasm file, and then add random contents on top of that. It also randomly modifies the existing contents, for example tweaking a Const, replacing some nodes with other things of the same type, etc. It also has a chance to replace a drop with a logging (as some of our tests just drop a result, and we match the optimized output's wasm instead of the result; by logging, the fuzzer can check things). The goal is to find bugs by using existing hand-written testcases as a basis. This PR uses the test suite's testcases as initial fuzz contents. This can find issues as they often check for corner cases - they are designed to be "interesting", which random data may be less likely to find. This has found several bugs already, see recent fuzz fixes. I mentioned the first few on Twitter but past 4 I stopped counting... https://twitter.com/kripken/status/1314323318036602880 This required various changes to the fuzzer's generation to account for the fact that there can be existing functions and so forth before it starts to run, so it needs to avoid collisions and so forth.
* Implement i8x16.popcnt (#3286)Thomas Lively2020-10-2714-0/+28
| | | | | | As proposed in https://github.com/WebAssembly/simd/pull/379. Since this instruction is still being evaluated for inclusion in the SIMD proposal, this PR does not add support for it to the C/JS APIs or to the fuzzer. This PR also performs a drive-by fix for unrelated instructions in c-api-kitchen-sink.c
* Rewrite DCE pass (#3274)Alon Zakai2020-10-264-493/+109
| | | | | | | | | | | | | | | | | | | | | | | | | The DCE pass is one of the oldest in binaryen, and had quite a lot of cruft from the changes in unreachability and other stuff in wasm and binaryen's history. This PR rewrites it from scratch, making it about 1/3 the size. I noticed this when looking for places to use code autogeneration. The old version had annoying boilerplate, while the new one avoids any need for it. There may be noticeable differences, as the old pass did more than it needed to. It overlapped with remove-unused-names for some reason I don't remember. The new pass leaves that to the other pass to do. I added another run of remove-unused-names to avoid noticeable differences in optimized builds, but you can see differences in the testcases that only run DCE by itself. (The test differences in this PR are mostly whitespace.) (The overlap is that if a block ended up not needed, that is, all branches to it were removed, the old DCE would remove the block.) This pass is about 15% faster than the old version. However, when adding another run of remove-unused-names the difference basically vanishes, so this isn't a speedup.
* Drop RHS of shift if effective shift is zero (#3209)Max Graey2020-10-261-0/+8
|
* Сonstant value truncation during store operation (#3117)Max Graey2020-10-261-0/+13
|
* [NFC] `using namespace Abstract` to make matchers more compact (#3284)Thomas Lively2020-10-2610-115/+96
| | | | | | | | | This change makes matchers in OptimizeInstructions more compact and readable by removing the explicit `Abstract::` namespace from individual operations. In some cases, this makes multi-line matcher expressions fit on a single line. This change is only possible because it also adds an explicit "RMW" prefix to each element of the `AtomicRMWOp` enumeration. Without that, their names conflicted with the names of Abstract ops.
* Optimize relations of subtractions and zero (#3275)Max Graey2020-10-251-15/+102
|
* OptimizeInstructions: More 64-bit integer patterns (#3015)Max Graey2020-10-231-42/+56
| | | | | Extend ZeroRemover and optimizeAddedConstants to handle 64-bit integers as well. Use Literal.makeFromInt64 to make this easier.
* Fuzzer: Fix wasm2c name mangling (#3228)Alon Zakai2020-10-231-27/+56
| | | | This is necessary for cases where the input has an export name that needs mangling, like a name with - (common in the spec test suite).
* Avoid UB in pow2 func (#3243)Max Graey2020-10-231-1/+1
|
* Handle get/setTempRet0 in fuzzer support (#3279)Alon Zakai2020-10-231-0/+13
| | | | | | | | This avoids it printing a warning and doing nothing for them. It also increases coverage, for checking 64-bit return values, but any such bug would have already been found already, I think (as we ignored the high bits), so likely the fuzzer is not emitting such things when running JS at least.
* Remove now-redundant --mutable-sp flag from finalize (#3273)Sam Clegg2020-10-231-8/+0
|
* Implement v128.{load,store}{8,16,32,64}_lane instructions (#3278)Thomas Lively2020-10-2223-9/+509
| | | | | | | These instructions are proposed in https://github.com/WebAssembly/simd/pull/350. This PR implements them throughout Binaryen except in the C/JS APIs and in the fuzzer, where it leaves TODOs instead. Right now these instructions are just being implemented for prototyping so adding them to the APIs isn't critical and they aren't generally available to be fuzzed in Wasm engines.
* Add float simplifications for absolute binary expressions (#3013)Max Graey2020-10-212-0/+54
|
* Fuzzer: Handle log_execution instrumentation, and warn on unknown imports ↵Alon Zakai2020-10-211-0/+12
| | | | | | | | | | | | | | | | | | | | | | (#3271) log_execution can be useful to run on a fuzz testcase for debugging purposes. This adds support to --fuzz-exec for printing out those values. IOW, this PR allows the following debugging flow: you run wasm-opt --log-execution on the wasm, then run it in the fuzzer, wasm-opt --fuzz-exec[-before] and you get that logging printed out (showing where we enter functions, exit them, etc.). Also, in general --fuzz-exec ignores unknown imports (so that it can be run on more wasm files, for at least some fuzz testing there). This also adds a warning in that case, so it is less surprising (the behavior does not change in this PR).
* SimplifyLocals fuzz fix: Don't be confused by subtype assigns. (#3267)Alon Zakai2020-10-211-4/+11
| | | | | | | | We checked if the type matches when deciding if two locals are equivalent, but if the type didn't match, we forgot to reset any previously equivalent things. So we thought something was equivalent when it wasn't, see the reduced testcase. Fixes #3266
* Fuzzer: Tweak constants during mutation as well (#3272)Alon Zakai2020-10-211-33/+47
| | | | Move the tweak function to an outer location, and call it from mutate() with some probability.
* Remove old/non-working SpillPointers pass (#3261)Sam Clegg2020-10-206-388/+0
| | | | | | | | | And associated stack.h. The current stack.h clearly doesn't work with the llvm back as it assumes the stack grows up, which means non of these has been working or used in a long time. Rather than trying to fix this unused features its probably cleaner to just remove it for now and restore it rom git history if its someone that anyone actually wants to use in the future.
* Optimize signed division when RHS is signed minimum (#3221)Max Graey2020-10-201-0/+17
|
* Avoid name collisions in MemoryPacking (#3265)Alon Zakai2020-10-202-4/+30
| | | | | | | | | Such a collision can happen if we run the pass twice, and somehow it finds more to optimize. To make this easy, add a general utility for getting a unique name based on a root + a numeric suffix to avoid collisions. Fixes the second testcase in #3225
* Warn on memory segment overlaps (#3257)Alon Zakai2020-10-201-0/+2
| | | | | We may fix this eventually, but it appears to not be urgent. For now at least show a warning so toolchains have a chance to see there is something they should fix.
* wasm-reduce: When trying to remove a function, try to replace ref.func ↵Alon Zakai2020-10-191-0/+5
| | | | usages too (#3254)
* Fix validateGlobally usage in validator, and an i64-to-i32 bug hidden by it ↵Alon Zakai2020-10-192-6/+9
| | | | | | | | | | | | | | (#3253) validateGlobally means that we can't do lookups on the module. A few places were missing that, or had it wrong. I think the reason for the wrong usages is that we used to have types on the module, and then removed that, so more is now validatable actually. This uncovered a real bug, where i64-to-32 would ignore an unreachable parameter of a call_indirect. That's bad, since if the type is i64, we need to replace it with two parameters. To fix that, just handle unreachability there, using the existing logic (which skips the call_indirect entirely in this case).
* Inlining fuzz fix: Notice ref.func function references in global inits (#3252)Alon Zakai2020-10-191-1/+7
| | | Such a reference may mean we cannot remove a function after inlining it.
* Optimize comparisons with 0/1 in boolean context (#3240)Max Graey2020-10-183-20/+28
| | | | | | | | | | i32(bool(x)) != 0 ==> i32(bool(x)) i64(bool(x)) & 1 ==> i64(bool(x)) Also: * clean up related matching rules in optimizeWithConstantOnRight * add more explanations about isPowerOf2Float & rename to isPowerOfTwoInvertibleFloat
* Remove now-redundant stack pointer manipulation passes (#3251)Sam Clegg2020-10-187-146/+0
| | | | The use of these passes was removed on the emscripten side in https://github.com/emscripten-core/emscripten/pull/12536.
* Add unmodifiedImportedMemory pass option (#3246)Alon Zakai2020-10-162-1/+17
| | | | | | | | | When set, we can assume an imported memory was not modified before us. That lets us assume it is all zeros and so we can optimize out zeros from memory segments. This does not actually do anything with the flag, just adds it. This is to avoid a rolling problem. Next emscripten can emit it without erroring, and then we can start to use it.
* finalize: remove legacy support for "table" import (#3249)Sam Clegg2020-10-161-7/+0
| | | | | These days we always export the table, except in the case of dynamic linking, and even then we use the name `__indirect_function_table`.
* finalize: add --mutable-sp flag (#3250)Sam Clegg2020-10-151-3/+13
| | | | | | | This flag disables the features of `wasm-emscripten-finalize` the replace the mutable global import of `__stack_pointer`. See the corresponding emscripten change that depends on this one: https://github.com/emscripten-core/emscripten/pull/12536
* finalize: move more functionality behind legacyPIC (#3248)Sam Clegg2020-10-151-9/+11
| | | | | | | Internalizing of the stack pointer is only needed in legacy PIC mode, since in the new PIC mode we support mutable globals. Also the additional ASSIGN_GOT_ENTRIES function only exists in support of the legacy mode.
* Only write explicit names to name section (#3241)Sam Clegg2020-10-154-28/+40
| | | | Fixes: #3226
* Fuzz fix for MemoryPacking on trampled data (#3222)Alon Zakai2020-10-152-3/+150
| | | | | | | | | | | | | I believe originally wasm did not allow overlapping segments, that is, where one memory segment tramples the data from a previous one. But then the spec changed its mind and we allowed it. Binaryen seems to have assumed the original case, and not checked for trampling. If there is a chance of trampling, we cannot optimize out zeros - the zero may have an effect if it tramples data from a previous segment. This does not occur in practice in LLVM output, which is why this wasn't a problem so far, I think. An existing testcase hit this issue, so I split it up.
* Log nested pass names in BINARYEN_PASS_DEBUG=2 (#3214)Alon Zakai2020-10-152-12/+20
| | | | We can't validate or print out the wasm in that case, but at least logging the names as they run can help debug some situations.
* Assign import names consistently between text and binaryn reader (#3238)Sam Clegg2020-10-143-7/+16
| | | | | | | | | The s-parser was assigning numbers names per-type where as the binaryn reader was using the global import count as the number to append. This change switches to use per-element count which I think it preferable as it increases the stability of the auto-generated names. e.g. memory is now always named `$mimport0`.
* [MemoryPacking] Emit the correct segment indices on memory.init (#3239)Thomas Lively2020-10-141-1/+6
| | | | | | | | | | | This PR fixes a bug in which the segment index of a memory.init instruction was incorrect in some circumstances. Specifically, the first segment index used in output memory.init instructions was always the index of the first segment created from splitting up the corresponding input segment. This was incorrect when the input memory.init had an offset that caused it to skip over that first emitted segment so that the first output memory.init should have referred to a subsequent output segment. Fixes #3225.
* Improve partial evaluation (#3236)Max Graey2020-10-141-2/+11
|
* PickLoadSigns fuzz fix: cannot make an atomic operation signed (#3235)Alon Zakai2020-10-131-0/+4
|
* Optimize power of two float divisions (#3018)Max Graey2020-10-133-5/+71
|
* EmscriptenPIC: Remove internalization of GOT entries (#3211)Sam Clegg2020-10-131-82/+3
| | | | | | | wasm-ld now does this better than binaryen and does it by default when linking and executable and optionally with `-Bsymbolic` when linking a shared library. See https://reviews.llvm.org/D89152
* Added Initial Memory64Lowering pass (#3230)Wouter van Oortmerssen2020-10-134-0/+93
| | | | This pass will convert a module with 64-bit loads and stores accessing a 64-bit memory to a regular 32-bit one. Pointers remain 64-bit but are truncated just before use.
* Fix Wasm capitalization in binaryen-c.h comments (#3233)Max Desiatov2020-10-131-2/+2
| | | According to the WebAssembly spec, Wasm is an abbreviation, not an acronym.
* Optimize unsigned divisions when rhs is negative constant (#2991)Max Graey2020-10-131-7/+22
| | | | | | | | `(uint32_t)x / C` --> `x >= C`, where `C > 2^31` `(uint32_t)x / -1` --> `x != -1` and for `shrinkLevel == 0`: `(uint64_t)x / C` --> `uint64_t(x >= C)`, where `C > 2^63` `(uint64_t)x / -1` --> `x != -1`
* Interpreter: Add a limit to how much we try to grow memory, to avoid DOS (#3227)Alon Zakai2020-10-123-5/+16
| | | | | growMemory() now also returns whether we succeeded. Without this it could eventually start to swap etc., which is annoying.
* Fuzzer: Do not emit random global.get/sets of the hang limit global (#3229)Alon Zakai2020-10-121-3/+16
| | | | | | | | | That global is for internal use. If we emit random sets to it, we could prevent it from doing its job of preventing an infinite loop (normally it decreases each time a loop runs or we recurse, until we reach 0 - if we set it to a nonzero value in that code, that would be bad). Random gets are less of a problem, but may be confusing when debugging a testcase.
* Slightly improve validator error text on segments (#3215)Alon Zakai2020-10-121-2/+2
| | | Mentioning if it's a memory or a table segment is convenient.
* Memory64 fuzzing preparations (#3223)Alon Zakai2020-10-121-7/+13
|
* Rename Emscripten EHSjLj functions in wasm backend (#3191)Heejin Ahn2020-10-104-150/+3
| | | | | | | | | | | Now that we are renaming invoke wrappers and `emscripten_longjmp_jmpbuf` in the wasm backend, this deletes all related renaming routines and relevant tests. Depends on #3192. Addresses: #3043 and #3081 Companions: https://reviews.llvm.org/D88697 emscripten-core/emscripten#12399
* RemoveUnusedBrs fuzz fix for switches with a single target and with a value ↵Alon Zakai2020-10-091-5/+12
| | | | | | (#3220) We turn a br_table with a single target into a br, but we reverse the order of the condition and the value when doing so, which we forgot to take into account.
* Refactor naming convention for functions handling tuples (#3196)Max Graey2020-10-0918-43/+73
| | | When there are two versions of a function, one handling tuples and the other handling non-tuple values, the previous naming convention was to have "Single" in the name of the non-tuple handling function. This PR simplifies the convention and shortens function names by making the names plural for the tuple-handling version and singular for the non-tuple-handling version.
* Add a little code to prepare exception handling support in fuzzer (#3207)Alon Zakai2020-10-091-4/+6
| | | | | | | fixLabels() in the fuzzer looks for invalid labels and fixes them up, after doing some random changes to existing wasm (which checks for types while doing so, but it may invalidate labels if we remove the target of a branch, for example). This adds trivial support for BrOnExn and Try there.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-15 11:58:26 +0000