summaryrefslogtreecommitdiff
path: root/test/lit/exec
Commit message (Collapse)AuthorAgeFilesLines
* Execution results: JS traps on exnref on the boundary (#7147)Alon Zakai2024-12-121-0/+22
| | | Fixes #7145
* Fuzzer: Add call-ref, call-ref-catch imports (#7137)Alon Zakai2024-12-091-1/+198
| | | | | | | | | | | | | | | Similar to call-export*, these imports call a wasm function from outside the module. The difference is that we send a function reference for them to call (rather than an export index). This gives more coverage, first by sending a ref from wasm to JS, and also since we will now try to call anything that is sent. Exports, in comparison, are filtered by the fuzzer to things that JS can handle, so this may lead to more traps, but maybe also some new situations. This also leads to adding more logic to execution-results.h to model JS trapping properly. fuzz_shell.js is refactored to allow sharing code between call-export* and call-ref*.
* [GC] Fix trapping on array.new_data of dropped segments of offset > 0 (#7124)Alon Zakai2024-12-021-0/+21
| | | | Even if the size is 0, if the offset is > 0 then we should trap.
* Fix memory.grow bounds and overflow checks for mem64 (#7112)Thomas Lively2024-11-251-0/+12
| | | | | Previously the interpreter only executed overflow and bounds checks for memory.grow on 32-bit memories. Run the checks on 64-bit memories as well.
* Add nontrapping-fptoint lowering pass (#7016)Derek Schuff2024-11-191-0/+261
| | | | | | | | | | | This pass lowers nontrapping FP to int instructions to implement LLVM's conversion behavior. This means that they are not fully complete lowerings according to the wasm spec, but have the same undefined behavior that LLM does. This keeps the pass simpler and preserves existing behavior when compiling without nontrapping-ft. This will be used in emscripten, so that we can build libraries with nontrapping-fp and lower them away after link if desired.
* Rename memory-copy-fill-lowering pass (#7082)Derek Schuff2024-11-162-2/+2
| | | | Since the resulting code has the same undefined behavior as LLVM, make the pass name reflect that.
* Introduce pass to lower memory.copy and memory.fill (#7021)Derek Schuff2024-11-132-0/+451
| | | | | | | | This pass lowers away memory.copy and memory.fill operations. It generates a function that implements the each of the instructions and replaces the instructions with calls to those functions. It does not handle other bulk memory operations (e.g. passive segments and table operations) because they are not used by emscripten to enable targeting old browsers that don't support bulk memory.
* [EH] Fuzz calls from JS by calling wasm exports, sometimes catching (#7067)Alon Zakai2024-11-081-1/+55
| | | | | | | | | | | | | | | | This adds two new imports to fuzzer modules: * call-export, which gets an export index and calls it. * call-export-catch, which does the call in a try-catch, swallowing any error, and returning 1 if it saw an error. The former gives us calls back into the wasm, possibly making various trips between wasm and JS in interesting ways. The latter adds a try-catch which helps fuzz wasm EH. We do these calls using a wasm export index, i.e., the index in the list of exports. This is simple, but it does have the downside that it makes executing the wasm sensitive to changes in exports (e.g. wasm-merge adds more), which requires some handling in the fuzzer.
* [wasm64] Fix 32-bit address computation in execution of SIMDLoadExtend (#7068)Alon Zakai2024-11-081-0/+13
|
* [wasm64] Make interpreter table methods operate on Address, not Index (#7062)Alon Zakai2024-11-071-10/+45
| | | This allows 64-bit bounds checking to work properly.
* [wasm64] Fix 64-bit memory/table operations in interpreter (#7058)Alon Zakai2024-11-063-0/+113
| | | A bunch of places assumed a 32-bit index.
* Fuzz the Table from JS (#7042)Alon Zakai2024-10-311-1/+60
| | | | | Continues the work from #7027 which added throwing from JS, this adds table get/set operations from JS, to further increase our coverage of Wasm/JS interactions (the table can be used from both sides).
* [EH] Fuzz throws from JS (#7027)Alon Zakai2024-10-232-1/+40
| | | | | | | | | | | We already generated (throw ..) instructions in wasm, but it makes sense to model throws from outside as well, as they cross the module boundary. This adds a new fuzzer import to the generated modules, "throw", that just does a throw from JS etc. Also be more precise about handling fuzzing-support imports in fuzz-exec: we now check that logging functions start with "log*" and error otherwise (this check is now needed given we have "throw", which is not logging). Also fix a minor issue with name conflicts for logging functions by using getValidFunctionName for them, both for logging and for throw.
* [Exceptions] Finish interpreter + optimizer support for try_table. (#6814)Sébastien Doeraene2024-08-203-0/+72
| | | | | | * Add interpreter support for exnref values. * Fix optimization passes to support try_table. * Enable the interpreter (but not in V8, see code) on exceptions.
* Generalize Literal::externalize/internalize for strings and shareability (#6784)Alon Zakai2024-07-291-0/+26
|
* Rename external conversion instructions (#6716)Jérôme Vouillon2024-07-081-1/+1
| | | | | | | | | Rename instructions `extern.internalize` into `any.convert_extern` and `extern.externalize` into `extern.convert_any` to follow more closely the spec. This was changed in https://github.com/WebAssembly/gc/issues/432. The legacy name is still accepted in text inputs and in the C and JS APIs.
* Fix scratch local optimizations when emitting string slice (#6649)Thomas Lively2024-06-111-0/+19
| | | | | | | | | | | | | | | | The binary writing of `stringview_wtf16.slice` requires scratch locals to store the `start` and `end` operands while the string operand is converted to a stringview. To avoid unbounded binary bloat when round-tripping, we detect the case that `start` and `end` are already `local.get`s and avoid using scratch locals by deferring the binary writing of the `local.get` operands until after the stringview conversoins is emitted. We previously optimized the scratch locals for `start` and `end` independently, but this could produce incorrect code in the case where the `local.get` for `start` is deferred but its value is changed by a `local.set` in the code for `end`. Fix the problem by only optimizing to avoid scratch locals in the case where both `start` and `end` are already `local.get`s, so they will still be emitted in the original relative order and they cannot interfere with each other anyway.
* [EH] Rename old EH tests from -old to -legacy (#6627)Heejin Ahn2024-05-283-0/+0
| | | | This renames old EH tests in the form of `-eh-old.wast` to `-eh-legacy.wast`, to be clearer in names.
* Fix TableFill bounds checking (#6621)Alon Zakai2024-05-211-0/+32
| | | The offsets are unsigned.
* [Strings] Remove stringview types and instructions (#6579)Thomas Lively2024-05-151-27/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The stringview types from the stringref proposal have three irregularities that break common invariants and require pervasive special casing to handle properly: they are supertypes of `none` but not subtypes of `any`, they cannot be the targets of casts, and they cannot be used to construct nullable references. At the same time, the stringref proposal has been superseded by the imported strings proposal, which does not have these irregularities. The cost of maintaing and improving our support for stringview types is no longer worth the benefit of supporting them. Simplify the code base by entirely removing the stringview types and related instructions that do not have analogues in the imported strings proposal and do not make sense in the absense of stringviews. Three remaining instructions, `stringview_wtf16.get_codeunit`, `stringview_wtf16.slice`, and `stringview_wtf16.length` take stringview operands in the stringref proposal but cannot be removed because they lower to operations from the imported strings proposal. These instructions are changed to take stringref operands in Binaryen IR, and to allow a graceful upgrade path for users of these instructions, the text and binary parsers still accept but ignore `string.as_wtf16`, which is the instruction used to convert stringrefs to stringviews. The binary writer emits code sequences that use scratch locals and `string.as_wtf16` to keep the output valid. Future PRs will further align binaryen with the imported strings proposal instead of the stringref proposal, for example by making `string` a subtype of `extern` instead of a subtype of `any` and by removing additional instructions that do not have analogues in the imported strings proposal.
* Respect the Web limitation on Table size (#6567)Alon Zakai2024-05-011-0/+28
| | | | | Without this the fuzzer can error on differences in behavior between V8 and us. Also move the limitations constants to their own header.
* [Parser] Enable the new text parser by default (#6371)Thomas Lively2024-04-251-2/+2
| | | | | | | | | | | | | | The new text parser is faster and more standards compliant than the old text parser. Enable it by default in wasm-opt and update the tests to reflect the slightly different results it produces. Besides following the spec, the new parser differs from the old parser in that it: - Does not synthesize `loop` and `try` labels unnecessarily - Synthesizes different block names in some cases - Parses exports in a different order - Parses `nop`s instead of empty blocks for empty control flow arms - Does not support parsing Poppy IR - Produces different error messages - Cannot parse `pop` except as the first instruction inside a `catch`
* [Strings] Implement string.measure_wtf16 in interpreter (#6535)Alon Zakai2024-04-241-0/+12
|
* [Strings] Fuzz and interpret all relevant StringNew methods (#6526)Alon Zakai2024-04-231-0/+86
| | | | This adds fuzzing for string.new_wtf16_array and string.from_code_point. The latter was also missing interpreter support, which this adds.
* [Strings] string.new_wtf16_array should trap if the end index is less than ↵Alon Zakai2024-04-011-0/+69
| | | | the start (#6459)
* Report timeout in interpretation of AtomicWait (#6452)Thomas Lively2024-03-291-1/+1
| | | | | | | To avoid slow-running fuzz cases, we report a host limit when interpreting atomic.wait with any non-zero timeout. However, in the allowed case where the timeout is zero, we were incorrectly interpreting the wait as returning 0, meaning that it was woken up, instead of 2, meaning that the timeout expired. Fix it to return 2.
* [Strings] Escape strings printed by fuzz-exec (#6441)Thomas Lively2024-03-261-3/+35
| | | | | | | | | | | Previously we printed strings as WTF-8 in the output of fuzz-exec, but this could produce invalid unicode output and did not make unprintable characters visible. Fix both these problems by escaping the output, using the JSON string escape procedure since the string to be escaped is WTF-16. Reimplement the same escaping procedure in fuzz_shell.js so that the way we print strings when running on a real JS engine matches the way we print them in our own fuzz-exec interpreter. Fixes #6435.
* StringNew: Trap on OOB start index (#6438)Alon Zakai2024-03-251-0/+53
|
* [Strings] Handle overflow in string.encode_wtf16_array (#6422)Alon Zakai2024-03-221-0/+38
|
* [Strings] Fix StringSlice end computation (#6414)Alon Zakai2024-03-211-0/+15
| | | | | Like JS string slicing, if the end index is out of bounds that is fine, we clamp to the end. This also matches the behavior in V8 and the spec.
* Atomics: Handle timeouts in waits in the (single-threaded) interpreter (#6408)Alon Zakai2024-03-191-0/+21
| | | | | | | | | The interpreter does not run multiple threads, and it was returning 0 from atomic.wait, which means it was woken up. But it is more correct for it to return 2, which means it timed out - which is actually the case, as no other thread exists that can wake it up. However, even that is not good for fuzzing as the timeout may be infinite or large, so just emit a host limit error on any timeout for now, until we actually implement threads.
* [Strings] Implement stringview_wtf16.slice (#6404)Alon Zakai2024-03-191-0/+15
|
* [Strings] Implement string.encode_wtf16_array (#6402)Alon Zakai2024-03-141-0/+68
|
* Implement dropping of active Element Segments (#6343)Alon Zakai2024-02-231-0/+104
| | | | Also rename the existing droppedSegments to droppedDataSegments for clarity.
* Fuzzer: Match the logging of i31ref between JS and C++ (#6335)Alon Zakai2024-02-221-0/+29
| | | | | | | | | | | | | JS engines print i31ref as just a number, so we need a small regex to standardize the representation (similar to what we do for funcrefs on the code above). On the C++ side, make it actually print the i31ref rather than treat it like a generic reference (for whom we only print "object"). To do that we must unwrap an externalized i31 as necessary, and add a case for i31 in the printing logic. Also move that printing logic to its own function, as it was starting to get quite long.
* Fuzzer: Remove --emit-js-shell logic and reuse fuzz_shell.js instead (#6310)Alon Zakai2024-02-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | We had two JS files that could run a wasm file for fuzzing purposes: * --emit-js-shell, which emitted a custom JS file that runs the wasm. * scripts/fuzz_shell.js, which was a generic file that did the same. Both of those load the wasm and then call the exports in order and print out logging as it goes of their return values (if any), exceptions, etc. Then the fuzzer compares that output to running the same wasm in another VM, etc. The difference is that one was custom for the wasm file, and one was generic. Aside from that they are similar and duplicated a bunch of code. This PR improves things by removing 1 and using 2 in all places, that is, we now use the generic file everywhere. I believe we added 1 because we thought a generic file can't do all the things we need, like know the order of exports and the types of return values, but in practice there are ways to do those things: The exports are in fact in the proper order (JS order of iteration is deterministic, thankfully), and for the type we don't want to print type internals anyhow since that would limit fuzzing --closed-world. We do need to be careful with types in JS (see notes in the PR about the type of null) but it's not too bad. As for the types of params, it's fine to pass in null for them all anyhow (null converts to a number or a reference without error).
* Strings: Add some interpreter support (#6304)Alon Zakai2024-02-141-0/+31
| | | | | | | This adds just enough support to be able to --fuzz-exec a small but realistic fuzz testcase from Java. To that end, just implement the minimal ops we need, which are all related to JS-style strings.
* Update lit tests to parse with the new parser (#6290)Thomas Lively2024-02-081-0/+1
| | | | | | | | | Get as many of the lit tests as possible to parse with the new parser, mostly by moving declared module items to be after imports. Also fix a bug in the new parser's pop validation to allow supertypes of the expected type. The two big issues that still prevent some lit tests from working correctly under the new parser are missing support for symbolic field names and missing support for source map annotations.
* [EH] Rename -eh lit test names to -eh-old (#6227)Heejin Ahn2024-01-223-0/+0
| | | | | | | This renames all existing EH lit tests with filenames `*eh*` to `*eh-old*`. This is a prep work so that we can add tests for the new EH spec using `*eh*`. The reason I'm trying to split old and new EH test files is we don't support fuzzing for the new EH yet and I wouldn't want to exclude old EH tests from fuzzing too because of that.
* Drop support for non-standard quoted function names (#6188)Thomas Lively2023-12-2015-60/+55
| | | | | | | | | | | | | | | | | | We previously supported a non-standard `(func "name" ...` syntax for declaring functions exported with the quoted name. Since that is not part of the standard text format, drop support for it, replacing it with the standard `(func $name (export "name") ...` syntax instead. Also replace our other usage of the quoted form in our text output, which was where we quoted names containing characters that are not allowed to appear in standard names. To handle that case, adjust our output from `"$name"` to `$"name"`, which is the standards-track way of supporting such names. Also fix how we detect non-standard name characters to match the spec. Update the lit test output generation script to account for these changes, including by making the `$` prefix on names mandatory. This causes the script to stop interpreting declarative element segments with the `(elem declare ...` syntax as being named "declare", so prevent our generated output from regressing by counting "declare" as a name in the script.
* Fix handling of exported imported functions (#6044)Alon Zakai2023-10-241-0/+14
| | | | | | | | Two trivial places did not handle that case, and assumed an exported function was actually defined (and not imported). Also add some const stuff to fix compilation after this change. This was discovered by #6026
* Work around a gcc 13 issue with signbit that made us not compute fmin of -0 ↵Alon Zakai2023-10-041-0/+117
| | | | properly (#5994)
* Replace i31.new with ref.i31 everywhere (#5931)Thomas Lively2023-09-131-4/+4
| | | | | Replace i31.new with ref.i31 in the printer, tests, and source code. Continue parsing i31.new for the time being to allow a graceful transition. Also update the JS API to reflect the new instruction name.
* Use the standard syntax for ref.cast, ref.test and array.new_fixed (#5894)Jérôme Vouillon2023-08-231-1/+1
| | | | | | | | | * Update text output for `ref.cast` and `ref.test` * Update text output for `array.new_fixed` * Update tests with new syntax for `ref.cast` and `ref.test` * Update tests with new `array.new_fixed` syntax
* Limit printing of Literal[s] in a general way (#5792)Alon Zakai2023-06-281-0/+43
| | | | | | | | Previously we limited printing in a single Literals. But we can have infinitely recursive GC literals, or just huge graphs even without infinite recursion where no single Literals is that big (but we still get exponential blowup). This PR adds a general limit on how much we print once we start to print a Literal or Literals.
* Fix pop assertion (#5777)Alon Zakai2023-06-201-0/+28
| | | Subtypes are allowed as well, not just exact matches, in the pop value's type.
* [Wasm GC] Ignore GC cycle leaks in LSan (#5686)Alon Zakai2023-04-241-0/+28
| | | | | Leaks happen since we use std::shared_ptr which does not handle cycles. But since Binaryen isn't used in long-running code it's probably find to just let them leak, and ignore them in LSan, for now.
* Remove the --hybrid and --nominal command line options (#5669)Thomas Lively2023-04-141-1/+1
| | | | | After this change, the only type system usable from the tools will be the standard isorecursive type system. The nominal type system is still usable via the API, but it will be removed entirely in a follow-on PR.
* Fuzzer: Ignore host limits (#5536)Alon Zakai2023-03-011-0/+27
| | | | | We can't just skip host limits (#5534) but must also ignore execution at that point, as optimizations can change the results if they change whether we reach a host limit.
* Parse and print `array.new_fixed` (#5527)Thomas Lively2023-02-281-1/+1
| | | | | | | | | This is a (more) standard name for `array.init_static`. (The full upstream name in the spec repo is `array.new_canon_fixed`, but I'm still hoping we can drop `canon` from all the instruction names and it doesn't appear elsewhere in Binaryen). Update all the existing tests to use the new name and add a test specifically to ensure the old name continues parsing.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-11 15:02:40 +0000