summaryrefslogtreecommitdiff
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
* Use Names instead of indices to identify segments (#5618)Thomas Lively2023-04-04133-100807/+100821
| | | | | | | | | | All top-level Module elements are identified and referred to by Name, but for historical reasons element and data segments were referred to by index instead. Fix this inconsistency by using Names to refer to segments from expressions that use them. Also parse and print segment names like we do for other elements. The C API is partially converted to use names instead of indices, but there are still many functions that refer to data segments by index. Finishing the conversion can be done in the future once it becomes necessary.
* [Wasm GC] Fix CoalesceLocals i31 local.get removal (#5619)Alon Zakai2023-04-041-2/+36
| | | | When removing a local.get we must replace it with something of the identical type, and not make it non-nullable.
* [Wasm GC] Fuzz RefCast (#5617)Alon Zakai2023-04-031-32/+34
|
* [Wasm GC] Avoid refining in TypeUpdating unreachability propagation (#5616)Alon Zakai2023-04-031-0/+70
| | | | | That code should only propagate unreachability, and not refine. If it refines when we call finalize() then other code around it might end up invalid (as it could be partially refined; see testcase).
* [Wasm GC] Parse (sub $super _) for array, func, and struct (#5515)Andy Wingo2023-04-031-3/+3
| | | | The pretty-printer will still serialize these using the old func_subtype, array_subtype, and struct_subtype syntax, though.
* Do not treat `atomic.fence` as using a memory (#5603)Thomas Lively2023-03-292-34/+13
| | | | | | | | | * Do not treat `atomic.fence` as using a memory Update RemoveUnusedModuleElements so that it no longer keeps the memory alive due to an `atomic.fence` instruction and update validation to allow modules to use `atomic.fence` without a memory. * update wasm2js tests
* [NFC] Port remove-unused-module-elements_all-features.wast to lit (#5602)Thomas Lively2023-03-293-585/+572
| | | | | | | | | * [NFC] Simplify initialization in RemoveUnusedModuleElements.cpp Use copy-list-initialization to shorten the code and reduce visual redundancy. * [NFC] Port remove-unused-module-elements_all-features.wast to lit Port the test automatically using scripts/port_passes_tests_to_lit.py.
* Support memory64 in MemoryPacking (#5605)Thomas Lively2023-03-291-0/+47
| | | | | | Fix the relevant pointer and size expressions produced by MemoryPacking to be i64s when working with 64-bit memories. Fixes #5578.
* [Wasm GC] Fix detection of externalize/internalize as constant (#5592)Alon Zakai2023-03-201-0/+83
| | | | | | | | | | | | Both isValidInConstantExpression and isSingleConstantExpression must look recursively at the internals of a RefAs that externalizes and internalizes, or else we might do something like externalize a local.get, which is not constant. getLiteral must handle externalize/internalize as well, and return a properly- modified literal. Without these fixes the testcase hits different internal assertions, and we either fail to recognize something is constant or not, or think that it is but fail to produce a literal for it.
* Ensure a deterministic order in the type names section (#5590)Alon Zakai2023-03-201-32/+38
| | | | | | | | | Before this PR we iterated over an unordered set. Replace that with an iteration on a vector. (Also, the value in the set was not even used, so this should even be faster.) Add random names in the fuzzer to types, the lack of which is I believe the reason this was not detected before.
* [Exceptions] Fix error on bad delegate index (#5587)Alon Zakai2023-03-172-0/+17
| | | | Fixes #5584
* [Wasm GC] Allow extern.externalize in globals (#5585)Alon Zakai2023-03-171-1/+31
| | | | | | | | | | This fixes wasm-ctor-eval on evalling a GC data structure that contains a field initialized with an externalized value. Per the spec this is a constant instruction and I verified that V8 allows this. Also add missing validation in wasm-ctor-eval of the output (which makes debugging this kind of thing a little easier).
* [Wasm GC] wasm-ctor-eval: Handle externalized data (#5582)Alon Zakai2023-03-161-0/+59
|
* Handle ReturnCall in MergeSimilarFunctions (#5581)Alon Zakai2023-03-161-1/+79
| | | | Fixes #5580
* [Wasm GC] Fuzz ref.test (#5577)Alon Zakai2023-03-161-33/+30
|
* Add bulk-array.wast spec test outline (#5568)Thomas Lively2023-03-161-0/+225
| | | | | | | | | Add spec/bulk-array.wast, which contains an outline of the tests that will be necessary for the upcoming bulk array instructions: array.copy (already implemented), array.fill, array.init_data, and array.init_elem. Although the test file does not actually contain any tests yet, it contains some setup code defining types, globals, and element segments that the tests will use. Fix miscellaneous bugs in parsing, validation, and printing to allow this setup code to run without issues.
* Support interpretation of extern.externalize and extern.internalize (#5576)Thomas Lively2023-03-161-26/+26
| | | | | | | To allow the external and internal reference values to be differentiated yet round-trippable, set the `Literal` type to externref on external references, but keep the gcData the same for both. The only exception is for i31 references, for which the externalized version gets a `gcData` that contains a copy of the original i31 literal.
* Fuzzer: Generate both immutable and mutable globals (#5575)Alon Zakai2023-03-152-63/+60
|
* Fuzzer: Pick interesting subtypes in getSubType(HeapType) (#5573)Alon Zakai2023-03-151-31/+35
|
* Fix misoptimization in TypeMerging (#5572)Thomas Lively2023-03-141-31/+164
| | | | | | | | | | | | TypeMerging previously tried to merge types with their supertypes and siblings in a single step, but this could cause a misoptimization in which a type was merged with its parent's sibling without being merged with its parent, breaking subtyping. Fix the bug by merging with supertypes and siblings separately. Since we now have multiple merging steps, also take the opportunity to run the sibling merging step multiple times to exploit more merging opportunities. Fixes #5556.
* [Wasm GC] Properly handle packed field truncation in StructNew (#5570)Alon Zakai2023-03-131-0/+18
|
* Fuzzer: Avoid emitting massive nested structs (#5564)Alon Zakai2023-03-131-34/+33
| | | | | | | | | | | The nesting limit of around 20 was enough to cause exponential blowup. A 20K input file lead to a 2GB wasm in one case I saw (!) which takes many seconds to fuzz. Instead, reduce the limit, and also check if random tells us that the random input is done; when that's done we should stop, which limits us to O(input size). Also do this for non-nullable types, and handle that in globals (we cannot emit a RefAsNulNull there, so switch the global type if necessary).
* Fuzzer: Limit array sizes (#5569)Alon Zakai2023-03-131-32/+34
| | | | | | Even with a 1% chance of a huge array, there is a second problem aside from hitting an allocation failure, which is DoS - building such a huge array of Literals takes noticeable time in the fuzzer. Instead, just limit array max sizes, which is consistent with what we do for struct sizes etc.
* Make constant expression validation stricter (#5557)Thomas Lively2023-03-1016-127/+96
| | | | | | | | | | Previously we treated global.get as a constant expression and only additionally verified that the target globals were immutable in some cases. But global.get of a mutable global is never a constant expression, and further, only imported globals are available in constant expressions unless GC is enabled. Fix constant expression validation to only allow global.get of immutable, imported globals, and fix all the invalid tests.
* Fuzzer: Emit fewer uninhabitable types in getSubType (#5563)Alon Zakai2023-03-101-31/+29
| | | | Only rarely return an uninhabitable subtype of an inhabitable one. This avoids a major source of uninhabitability and immediate traps.
* Fuzzer: Emit nulls with low probability in makeConstCompoundRef (#5559)Alon Zakai2023-03-101-32/+36
| | | | In particular, the removed code path here that did a RefAsNonNull of a null was causing a lot of code to just trap.
* Emit the fuzzer hashMemory function after modifications (#5558)Alon Zakai2023-03-092-64/+59
| | | | | | | | | | Previously we emitted it early, and would then modify it in random ways like other initial content. But this function is called frequently during execution, so if we were unlucky and modded that function to trap then basically all other functions would trap as well. After fixing this, some places assert on not having any functions or types to pick a random one from, so fix those places too.
* Integrate the heap type fuzzer into the main fuzzer (#5555)Alon Zakai2023-03-091-34/+39
| | | | | | | | | | | | | With this we generate random GC types that may be used in creating instructions later. We don't create many instructions yet, which will be the next step after this. Also add some trivial assertions in some places, that have helped debugging in the past. Stop fuzzing TypeMerging for now due to #5556 , which this PR uncovers.
* Fuzzer: Pick from existing heap types in the module (#5539)Alon Zakai2023-03-081-33/+31
|
* CodePushing: Pushing into an if may require non-nullable fixups (#5551)Alon Zakai2023-03-071-29/+76
| | | | | | | | | | | | | | | This became an issue because the timeline was this: * We added non-nullable locals support. At the time, obviously CodePushing did not require any fixups for that, since it just moved code forward in a single block (and not past any uses). So we marked the pass as not needing such fixups. * We added pushing of code into ifs. But moving code into an if can affect non-nullable validation since it is based on block scoping. So we need to remove the mark on the pass, which will make it check and apply fixups as necessary. See the testcase for an example.
* SignatureRefining: Skip types with supertypes for now (#5548)Alon Zakai2023-03-061-0/+30
| | | We'd need to handle contravariance to optimize them.
* [Wasm GC] Skip types with subtypes in SignatureRefining (#5544)Alon Zakai2023-03-031-0/+22
| | | | | | | For now just skip them, to avoid problems. In the future we should look into modifying their children, when possible. Fixes #5463
* Note function signature param/result features for validation (#5542)Alon Zakai2023-03-032-0/+26
| | | | | | | | As with #5535, this was not noticed because it can only happen on very small modules where the param/result type appears nowhere else but in a function signature. Use generic heap type scanning, which also scans into struct and array types etc.
* Fix type printing in the type fuzzer (#5543)Thomas Lively2023-03-032-37/+37
| | | | | | In #5437 we updated type printing so that printing a heap type would print its name in addition to its contents. We had already been separately printing type names in the type fuzzer, so after that change we were printing each type name twice. Remove the redundant printing in the fuzzer to fix the error.
* Add a fuzzer utility for ensuring types are inhabitable (#5541)Thomas Lively2023-03-032-0/+58
| | | | | | | | | | | | | | Some valid GC types, such as non-nullable references to bottom heap types and types that contain non-nullable references to themselves, are uninhabitable, meaning it is not possible to construct values of those types. This can cause problems for the fuzzer, which generally needs to be able to construct values of arbitrary types. To simplify things for the fuzzer, introduce a utility for transforming type graphs such that all their types are inhabitable. The utility performs a DFS to find cycles of non-nullable references and breaks those cycles by introducing nullability. The new utility is itself fuzzed in the type fuzzer.
* getHeapTypeCounts() must note select types for references (#5540)Alon Zakai2023-03-032-2/+28
| | | | Without this we hit an assertion on trying to write the binary, on a missing heap type.
* Fuzzer: Ignore host limits (#5536)Alon Zakai2023-03-011-0/+27
| | | | | We can't just skip host limits (#5534) but must also ignore execution at that point, as optimizations can change the results if they change whether we reach a host limit.
* Validation: Function types with multiple results require multivalue (#5535)Alon Zakai2023-03-011-0/+19
| | | | | | This was not noticed before because normally if there is a function type with multiple results then there is also a function with that property. But it is possible to make small testcases without such a function, and one might be imported etc., so we do need to validate this.
* JSPI - Replace function table references with JSPI'ed wrapper. (#5519)Brendan Dahl2023-03-011-0/+34
| | | | This makes it possible to get the JSPI'ed version of the function from the function table.
* Parse and print `array.new_fixed` (#5527)Thomas Lively2023-02-2819-70/+99
| | | | | | | | | This is a (more) standard name for `array.init_static`. (The full upstream name in the spec repo is `array.new_canon_fixed`, but I'm still hoping we can drop `canon` from all the instruction names and it doesn't appear elsewhere in Binaryen). Update all the existing tests to use the new name and add a test specifically to ensure the old name continues parsing.
* [NFC] Internally rename `ArrayInit` to `ArrayNewFixed` (#5526)Thomas Lively2023-02-284-9/+9
| | | | | | | | To match the standard instruction name, rename the expression class without changing any parsing or printing behavior. A follow-on PR will take care of the functional side of this change while keeping support for parsing the old name. This change will allow `ArrayInit` to be used as the expression class for the upcoming `array.init_data` and `array.init_elem` instructions.
* Emit source map information for control flow structures (#5524)Alon Zakai2023-02-281-1/+2
| | | | | With this, the sourcemap testcase outputs the exact same thing as the input. Followup to #5504
* [wasm2js] Fix atomic notify to take an unsigned count (#5525)Thomas Lively2023-02-273-4/+4
| | | | | Without this fix, the common idiom of using `INT_MAX` in C source to mean an unlimited number of waiters should be woken up actually compiled down to an argument of -1 in JS, causing zero waiters to be woken.
* [wasm-ctor-eval] Properly handle multiple ctors with GC (#5522)Alon Zakai2023-02-242-4/+82
| | | | | | | | | | Before, a single ctor with GC worked, but any subsequent ones simply dropped the globals from the previous ones, because we were missing an addGlobal in an important place. Also, we can get confused about which global names are in use in the module, so fix that as well by storing them directly (we keep removing and re-adding globals, so we can't use the normal module mechanism to find which names are in use).
* Memory flattening cannot be done in the presence of DataDrop (#5521)Alon Zakai2023-02-241-0/+38
| | | | Like MemoryInit, this instruction cares about segment identity, so merging segments into one big one for flattening is disallowed.
* Fix sourcemap nesting in reading and writing (#5504)JesseCodeBones2023-02-242-1/+47
| | | | The stack logic was incorrect, and led to source locations being emitted on parents instead of children.
* Fix validation of DataDrop (#5517)Alon Zakai2023-02-231-0/+13
| | | Fixes #5511
* [Fuzzer] Simplify the hang limit mechanism (#5513)Alon Zakai2023-02-235-90/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously the idea was that we started with HANG_LIMIT = 10 or so, and we'd decrement it by one in each potentially-recursive call and loop entry. When we reached 0 we'd start to unwind the stack. Then, after we unwound it all the way, we'd reset HANG_LIMIT before calling the next export. That approach adds complexity that each "execution wrapper", like for JS or for --fuzz-exec, had to manually reset HANG_LIMIT. That was done by calling an export. Calls to those exports had to appear in various places, which is sort of a hack. The new approach here does the following when the hang limit reaches zero: It resets HANG_LIMIT, and it traps. The trap unwinds the call stack all the way out. When the next export is called, it will have a fresh hang limit since we reset it before the trap. This does have downsides. Before, we did not always trap when we hit the hang limit but rather we'd emit something unreachable, like a return. The idea was that we'd leave the current function scope at least, so we don't hang forever. That let us still execute a small amount of code "on the way out" as we unwind the stack. I'm not sure it's worth the complexity for that. The advantages of this PR are to simplify the code, and also it makes more fuzzing approaches easy to implement. I'd like to add a wasm-ctor-eval fuzzer, and having to add hacks to call the hang limit init export in it would be tricky. With this PR, the execution model is simple in the fuzzer: The exports are called one by one, in order, and that's it - no extra magic execution needs to be done. Also bump the hang limit from 10 to 100, just to give some more chance for code to run.
* [wasm-ctor-eval] Stop evalling at table.set for now (#5516)Alon Zakai2023-02-231-0/+60
| | | | Until we get full support for serializing table changes, stop evalling so we do not break things.
* [wasm-ctor-eval] Add v128 load/store support (#5512)Alon Zakai2023-02-231-0/+43
|
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-05 19:15:55 +0000