From e3c923554ce6f586b5fa9fe4fc76cf8780e287b0 Mon Sep 17 00:00:00 2001 From: Alon Zakai Date: Thu, 16 Feb 2023 14:36:02 -0800 Subject: Fuzzer: Be more careful with unreachable code (#5498) Half the time, never add any unreachable code. This ensures we run the most code we possibly can half the time, at least. --- src/tools/fuzzing/fuzzing.cpp | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) (limited to 'src/tools/fuzzing/fuzzing.cpp') diff --git a/src/tools/fuzzing/fuzzing.cpp b/src/tools/fuzzing/fuzzing.cpp index af2a34078..37de3d1da 100644 --- a/src/tools/fuzzing/fuzzing.cpp +++ b/src/tools/fuzzing/fuzzing.cpp @@ -31,6 +31,11 @@ namespace { TranslateToFuzzReader::TranslateToFuzzReader(Module& wasm, std::vector&& input) : wasm(wasm), builder(wasm), random(std::move(input), wasm.features) { + + // Half the time add no unreachable code so that we'll execute the most code + // as possible with no early exits. + allowAddingUnreachableCode = oneIn(2); + // - funcref cannot be logged because referenced functions can be inlined or // removed during optimization // - there's no point in logging anyref because it is opaque @@ -724,9 +729,10 @@ void TranslateToFuzzReader::mutate(Function* func) { Modder(Module& wasm, TranslateToFuzzReader& parent) : wasm(wasm), parent(parent) { - // Half the time, never replace with an unreachable. The other half, do it - // sometimes (but even so, only rarely, see below). - allowUnreachable = parent.oneIn(2); + // If the parent allows it then sometimes replace with an unreachable, and + // sometimes not. Even if we allow it, only do it in certain functions + // (half the time) and only do it rarely (see below). + allowUnreachable = parent.allowAddingUnreachableCode && parent.oneIn(2); } void visitExpression(Expression* curr) { -- cgit v1.2.3