Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions src/tools/fuzzing.h
Original file line number Diff line number Diff line change
Expand Up @@ -228,9 +228,6 @@ class TranslateToFuzzReader {
// All struct fields that are mutable.
std::vector<StructField> mutableStructFields;

// All struct fields that can be waited on.
std::vector<StructField> structWaitFields;

// All arrays that are mutable.
std::vector<HeapType> mutableArrays;

Expand Down Expand Up @@ -550,8 +547,6 @@ class TranslateToFuzzReader {
Expression* makeStructRMW(Type type);
Expression* makeStructCmpxchg(Type type);
Expression* makeStructSet(Type type);
Expression* makeStructWait(Type type);
Expression* makeWaitqueueNotify(Type type);
Expression* makeArrayGet(Type type);
Expression* makeArraySet(Type type);
Expression* makeArrayRMW(Type type);
Expand Down
76 changes: 12 additions & 64 deletions src/tools/fuzzing/fuzzing.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -603,14 +603,11 @@ void TranslateToFuzzReader::setupHeapTypes() {
interestingHeapSubTypes[struct_].push_back(type);
interestingHeapSubTypes[eq].push_back(type);
interestingHeapSubTypes[any].push_back(type);
// Note the mutable fields and fields that can be waited on.
const auto& fields = type.getStruct().fields;
// Note the mutable fields.
auto& fields = type.getStruct().fields;
for (Index i = 0; i < fields.size(); i++) {
if (fields[i].mutable_) {
mutableStructFields.emplace_back(type, i);
}
if (fields[i].isValidControlWord()) {
structWaitFields.emplace_back(type, i);
mutableStructFields.push_back(StructField{type, i});
}
}
break;
Expand Down Expand Up @@ -1920,16 +1917,6 @@ void TranslateToFuzzReader::addHangLimitChecks(Function* func) {
AndInt32, arrayNew->size, builder.makeConst(int32_t(1024 - 1)));
}
}
if (!ATOMIC_WAITS) {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Side note, should this have been on FuzzParams and not on the main class?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess so. This was here before my PR (actually 9 years ago), and it looks like it's a compile-time constant; there's no code path that sets it to true.

I can see if we can refactor this part too.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, sorry, I thought it was part of the diff here...

for (auto* wait : FindAll<StructWait>(func->body).list) {
if (auto* c = wait->timeout->dynCast<Const>()) {
c->value = Literal(int64_t(0));
} else if (wait->timeout->type == Type::i64) {
wait->timeout = builder.makeSequence(builder.makeDrop(wait->timeout),
builder.makeConst(int64_t(0)));
}
}
}
}

void TranslateToFuzzReader::recombine(Function* func) {
Expand Down Expand Up @@ -2914,14 +2901,6 @@ Expression* TranslateToFuzzReader::_makeConcrete(Type type) {
&Self::makeStringEq,
&Self::makeStringMeasure,
&Self::makeStringGet);
options.add(FeatureSet::ReferenceTypes | FeatureSet::GC |
FeatureSet::SharedEverything,
&Self::makeWaitqueueNotify);
if (!structWaitFields.empty()) {
options.add(FeatureSet::ReferenceTypes | FeatureSet::GC |
FeatureSet::SharedEverything,
&Self::makeStructWait);
}
}
if (type == Type::i64) {
options.add(FeatureSet::WideArithmetic | FeatureSet::Multivalue,
Expand Down Expand Up @@ -4444,24 +4423,22 @@ Expression* TranslateToFuzzReader::makeBasicRef(Type type) {
}
WASM_UNREACHABLE("bad switch");
}
case HeapType::waitqueue: {
if (type.isNullable() && oneIn(2)) {
return builder.makeRefNull(HeapTypes::sharedWaitqueue.getBasic(share));
}
return builder.makeWaitqueueNew();
}
case HeapType::none:
case HeapType::noext:
case HeapType::nofunc:
case HeapType::nocont:
case HeapType::noexn:
case HeapType::nowaitqueue: {
case HeapType::noexn: {
auto null = builder.makeRefNull(heapType.getBasic(share));
if (!type.isNullable()) {
return builder.makeRefAs(RefAsNonNull, null);
}
return null;
}

case HeapType::waitqueue:
case HeapType::nowaitqueue: {
WASM_UNREACHABLE("waitqueue is unimplemented in the fuzzer");
}
}
WASM_UNREACHABLE("invalid basic ref type");
}
Expand Down Expand Up @@ -6113,35 +6090,6 @@ Expression* TranslateToFuzzReader::makeStructSet(Type type) {
return builder.makeStructSet(fieldIndex, ref, value, order);
}

Expression* TranslateToFuzzReader::makeStructWait(Type type) {
assert(type == Type::i32);
assert(!structWaitFields.empty());
auto [structType, fieldIndex] = pick(structWaitFields);
auto* ref = makeTrappingRefUse(structType);
auto* waitqueue =
makeTrappingRefUse(Type(HeapTypes::sharedWaitqueue, Nullable));
auto expectedType = structType.getStruct().fields[fieldIndex].type;
if (expectedType.isRef()) {
expectedType = Type(HeapTypes::eq.getBasic(Shared), Nullable);
}
auto* expected = make(expectedType);
Expression* timeout = nullptr;
if (ATOMIC_WAITS && oneIn(2)) {
timeout = make(Type::i64);
} else {
timeout = builder.makeConst(int64_t{0});
}
return builder.makeStructWait(fieldIndex, ref, waitqueue, expected, timeout);
}

Expression* TranslateToFuzzReader::makeWaitqueueNotify(Type type) {
assert(type == Type::i32);
auto* waitqueue =
makeTrappingRefUse(Type(HeapTypes::sharedWaitqueue, Nullable));
auto* count = make(Type::i32);
return builder.makeWaitqueueNotify(waitqueue, count);
}

// Make a bounds check for an array operation, given a ref + index. An optional
// additional length parameter can be provided, which is added to the index if
// so (that is useful for something like array.fill, which operations on not a
Expand Down Expand Up @@ -6776,11 +6724,11 @@ HeapType TranslateToFuzzReader::getSubType(HeapType type) {
case HeapType::nofunc:
case HeapType::nocont:
case HeapType::noexn:
case HeapType::nowaitqueue:
break;
case HeapType::waitqueue:
return pick(HeapTypes::sharedWaitqueue, HeapTypes::sharedNowaitqueue)
.getBasic(share);
case HeapType::nowaitqueue: {
WASM_UNREACHABLE("waitqueue is unimplemented in the fuzzer");
}
}
}
// Look for an interesting subtype.
Expand Down
24 changes: 8 additions & 16 deletions src/tools/fuzzing/heap-types.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -344,9 +344,6 @@ struct HeapTypeGeneratorImpl {
if (features.hasStackSwitching() && share == Unshared) {
bottoms.push_back(HeapType::nocont);
}
if (features.hasSharedEverything() && share == Shared) {
bottoms.push_back(HeapType::nowaitqueue);
}
return rand.pick(bottoms).getBasic(share);
}

Expand All @@ -369,9 +366,6 @@ struct HeapTypeGeneratorImpl {
if (features.hasExceptionHandling() && share == Unshared) {
options.push_back(HeapType::exn);
}
if (features.hasSharedEverything() && share == Shared) {
options.push_back(HeapType::waitqueue);
}
auto ht = rand.pick(options);
return ht.getBasic(share);
}
Expand Down Expand Up @@ -689,11 +683,6 @@ struct HeapTypeGeneratorImpl {
return pickSubStruct(share);
case HeapType::array:
return pickSubArray(share);
case HeapType::waitqueue:
if (rand.oneIn(2)) {
return HeapTypes::sharedNowaitqueue.getBasic(share);
}
return type;
case HeapType::ext:
case HeapType::exn:
case HeapType::string:
Expand All @@ -702,8 +691,11 @@ struct HeapTypeGeneratorImpl {
case HeapType::nofunc:
case HeapType::nocont:
case HeapType::noexn:
case HeapType::nowaitqueue:
return type;
case HeapType::waitqueue:
case HeapType::nowaitqueue: {
WASM_UNREACHABLE("waitqueue is unimplemented in the fuzzer");
}
}
WASM_UNREACHABLE("unexpected type");
}
Expand Down Expand Up @@ -751,7 +743,6 @@ struct HeapTypeGeneratorImpl {
case HeapType::exn:
case HeapType::cont:
case HeapType::any:
case HeapType::waitqueue:
break;
case HeapType::eq:
candidates.push_back(HeapTypes::any.getBasic(share));
Expand All @@ -777,9 +768,10 @@ struct HeapTypeGeneratorImpl {
case HeapType::noexn:
candidates.push_back(HeapTypes::exn.getBasic(share));
break;
case HeapType::nowaitqueue:
candidates.push_back(HeapTypes::sharedWaitqueue.getBasic(share));
break;
case HeapType::waitqueue:
case HeapType::nowaitqueue: {
WASM_UNREACHABLE("waitqueue is unimplemented in the fuzzer");
}
}
assert(!candidates.empty());
return rand.pick(candidates);
Expand Down
3 changes: 0 additions & 3 deletions src/wasm-type.h
Original file line number Diff line number Diff line change
Expand Up @@ -736,9 +736,6 @@ struct Field {
std::string toString() const;

unsigned getByteSize() const;

// true iff this field can be the target of a `struct.wait`.
bool isValidControlWord() const;
};

using FieldList = std::vector<Field>;
Expand Down
7 changes: 0 additions & 7 deletions src/wasm/wasm-type.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -2794,13 +2794,6 @@ std::unordered_set<HeapType> getIgnorablePublicTypes() {
return set;
}

bool Field::isValidControlWord() const {
return !isPacked() &&
(type == Type::i32 || type == Type::i64 ||
Type::isSubType(type,
Type(HeapTypes::eq.getBasic(Shared), Nullable)));
}

namespace HeapTypes {

HeapType getMutI8Array() { return Array(Field(Field::i8, Mutable)); }
Expand Down
4 changes: 3 additions & 1 deletion src/wasm/wasm-validator.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -3734,7 +3734,9 @@ void FunctionValidator::visitStructWait(StructWait* curr) {

if (
!shouldBeTrue(
field.isValidControlWord(),
field.type == Type::i32 || field.type == Type::i64 ||
Type::isSubType(field.type,
Type(HeapTypes::eq.getBasic(Shared), Nullable)),
curr,
R"(struct.wait control word field must be i32, i64 or a subtype of (ref null (shared eq)))")) {
return;
Expand Down
112 changes: 56 additions & 56 deletions test/lit/fuzz-types.test
Original file line number Diff line number Diff line change
@@ -1,60 +1,60 @@
;; RUN: wasm-fuzz-types -v --seed=3 | filecheck %s

;; CHECK: Running with seed 3
;; CHECK-NEXT: Built 20 types:
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $0 (sub (shared (func (param i64 f64 exnref (ref null $0)) (result (ref cont))))))
;; CHECK-NEXT: (type $1 (shared (descriptor $2) (struct)))
;; CHECK-NEXT: (type $2 (shared (describes $1) (descriptor $4) (struct (field (mut v128)) (field (mut (ref $4))) (field (mut v128)) (field (mut i32)) (field f32))))
;; CHECK-NEXT: (type $3 (array i8))
;; CHECK-NEXT: (type $4 (shared (describes $2) (struct)))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $5 (shared (descriptor $6) (struct (field f64) (field (ref $7)) (field (mut f64)) (field (mut (ref (shared i31)))) (field (mut (ref $11))) (field (ref (shared i31))))))
;; CHECK-NEXT: (type $6 (shared (describes $5) (descriptor $7) (struct (field (mut i32)) (field (mut (ref null $0))) (field (ref null (shared i31))) (field (mut v128)) (field (mut i64)) (field (mut (ref $2))))))
;; CHECK-NEXT: (type $7 (shared (describes $6) (descriptor $9) (struct (field (ref null $6)) (field (mut (ref $0))) (field (ref $7)) (field i8) (field (mut i8)) (field (ref null $5)))))
;; CHECK-NEXT: (type $8 (sub (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)))))
;; CHECK-NEXT: (type $9 (shared (describes $7) (descriptor $11) (struct (field (mut (ref $0))) (field (mut v128)))))
;; CHECK-NEXT: (type $10 (func (result (ref extern) (ref noextern) (ref $13) i32 exnref)))
;; CHECK-NEXT: (type $11 (shared (describes $9) (struct (field i16) (field (ref null $11)))))
;; CHECK-NEXT: (type $12 (sub (descriptor $13) (struct (field i64) (field (ref (shared extern))) (field (mut i16)) (field (mut (ref noextern))))))
;; CHECK-NEXT: (type $13 (sub (describes $12) (struct (field (ref extern)) (field f64))))
;; CHECK-NEXT: (type $14 (sub final $8 (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)) (field v128))))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $15 (sub $8 (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)) (field (mut i32)))))
;; CHECK-NEXT: (type $16 (shared (func (param (ref null $17)) (result exnref))))
;; CHECK-NEXT: (type $17 (sub final $12 (descriptor $18) (struct (field i64) (field (ref (shared extern))) (field (mut i16)) (field (mut (ref noextern))) (field (mut (ref null $10))))))
;; CHECK-NEXT: (type $18 (sub final $13 (describes $17) (struct (field (ref extern)) (field f64) (field (mut i16)) (field (mut i8)))))
;; CHECK-NEXT: (type $19 (sub $8 (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)) (field (mut (ref cont))) (field (mut i64)))))
;; CHECK-NEXT: )
;; CHECK: Running with seed 3
;; CHECK-NEXT: Built 20 types:
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $0 (sub (shared (func (param i64 f64 exnref (ref null $0)) (result (ref cont))))))
;; CHECK-NEXT: (type $1 (shared (descriptor $2) (struct)))
;; CHECK-NEXT: (type $2 (shared (describes $1) (descriptor $4) (struct (field (mut v128)) (field (mut (ref $4))) (field (mut v128)) (field (mut i32)) (field f32))))
;; CHECK-NEXT: (type $3 (array i8))
;; CHECK-NEXT: (type $4 (shared (describes $2) (struct)))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $5 (shared (descriptor $6) (struct (field f64) (field (ref $7)) (field (mut f64)) (field (mut (ref null (shared eq)))) (field (ref $11)) (field (ref (shared any))))))
;; CHECK-NEXT: (type $6 (shared (describes $5) (descriptor $7) (struct (field (mut i32)) (field (mut i16)) (field i64) (field f32) (field (ref null $11)) (field (mut f64)))))
;; CHECK-NEXT: (type $7 (shared (describes $6) (descriptor $9) (struct (field i8) (field (mut f32)) (field (mut f64)) (field (mut i32)) (field (mut f32)) (field (mut i64)))))
;; CHECK-NEXT: (type $8 (sub (struct)))
;; CHECK-NEXT: (type $9 (shared (describes $7) (descriptor $11) (struct (field (mut v128)) (field (mut v128)) (field (mut f32)))))
;; CHECK-NEXT: (type $10 (func (param f32 f64 f32)))
;; CHECK-NEXT: (type $11 (shared (describes $9) (struct (field (ref (shared struct))) (field i32) (field f32) (field (mut (ref null (shared struct)))) (field i64) (field i32))))
;; CHECK-NEXT: (type $12 (sub (descriptor $13) (struct (field (mut i8)) (field f32) (field (mut v128)))))
;; CHECK-NEXT: (type $13 (sub (describes $12) (struct (field i32) (field (ref $10)) (field i8) (field (mut i64)))))
;; CHECK-NEXT: (type $14 (sub $8 (struct)))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $15 (sub $8 (struct (field v128) (field (mut (ref null (shared struct)))))))
;; CHECK-NEXT: (type $16 (shared (func (param (ref null $10)) (result (ref $6) i32 f64))))
;; CHECK-NEXT: (type $17 (sub final $12 (descriptor $18) (struct (field (mut i8)) (field f32) (field (mut v128)) (field (ref $17)) (field (mut i8)) (field (mut eqref)))))
;; CHECK-NEXT: (type $18 (sub final $13 (describes $17) (struct (field i32) (field (ref $10)) (field i8) (field (mut i64)) (field (mut (ref null $11))) (field f64))))
;; CHECK-NEXT: (type $19 (sub $8 (struct (field (mut i8)) (field (mut v128)) (field v128) (field v128))))
;; CHECK-NEXT: )
;; CHECK-EMPTY:
;; CHECK-NEXT: Inhabitable types:
;; CHECK-NEXT: Inhabitable types:
;; CHECK-EMPTY:
;; CHECK-NEXT: Built 20 types:
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $0 (sub (shared (func (param i64 f64 exnref (ref null $0)) (result (ref cont))))))
;; CHECK-NEXT: (type $1 (shared (descriptor $2) (struct)))
;; CHECK-NEXT: (type $2 (shared (describes $1) (descriptor $4) (struct (field (mut v128)) (field (mut (ref $4))) (field (mut v128)) (field (mut i32)) (field f32))))
;; CHECK-NEXT: (type $3 (array i8))
;; CHECK-NEXT: (type $4 (shared (describes $2) (struct)))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $5 (shared (descriptor $6) (struct (field f64) (field (ref $7)) (field (mut f64)) (field (mut (ref (shared i31)))) (field (mut (ref $11))) (field (ref (shared i31))))))
;; CHECK-NEXT: (type $6 (shared (describes $5) (descriptor $7) (struct (field (mut i32)) (field (mut (ref null $0))) (field (ref null (shared i31))) (field (mut v128)) (field (mut i64)) (field (mut (ref $2))))))
;; CHECK-NEXT: (type $7 (shared (describes $6) (descriptor $9) (struct (field (ref null $6)) (field (mut (ref $0))) (field (ref null $7)) (field i8) (field (mut i8)) (field (ref null $5)))))
;; CHECK-NEXT: (type $8 (sub (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)))))
;; CHECK-NEXT: (type $9 (shared (describes $7) (descriptor $11) (struct (field (mut (ref $0))) (field (mut v128)))))
;; CHECK-NEXT: (type $10 (func (result (ref extern) (ref noextern) (ref $13) i32 exnref)))
;; CHECK-NEXT: (type $11 (shared (describes $9) (struct (field i16) (field (ref null $11)))))
;; CHECK-NEXT: (type $12 (sub (descriptor $13) (struct (field i64) (field (ref null (shared extern))) (field (mut i16)) (field (mut nullexternref)))))
;; CHECK-NEXT: (type $13 (sub (describes $12) (struct (field externref) (field f64))))
;; CHECK-NEXT: (type $14 (sub final $8 (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)) (field v128))))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $15 (sub $8 (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)) (field (mut i32)))))
;; CHECK-NEXT: (type $16 (shared (func (param (ref null $17)) (result exnref))))
;; CHECK-NEXT: (type $17 (sub final $12 (descriptor $18) (struct (field i64) (field (ref null (shared extern))) (field (mut i16)) (field (mut nullexternref)) (field (mut (ref null $10))))))
;; CHECK-NEXT: (type $18 (sub final $13 (describes $17) (struct (field externref) (field f64) (field (mut i16)) (field (mut i8)))))
;; CHECK-NEXT: (type $19 (sub $8 (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)) (field (mut (ref cont))) (field (mut i64)))))
;; CHECK-NEXT: )
;; CHECK-NEXT: Built 20 types:
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $0 (sub (shared (func (param i64 f64 exnref (ref null $0)) (result (ref cont))))))
;; CHECK-NEXT: (type $1 (shared (descriptor $2) (struct)))
;; CHECK-NEXT: (type $2 (shared (describes $1) (descriptor $4) (struct (field (mut v128)) (field (mut (ref $4))) (field (mut v128)) (field (mut i32)) (field f32))))
;; CHECK-NEXT: (type $3 (array i8))
;; CHECK-NEXT: (type $4 (shared (describes $2) (struct)))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $5 (shared (descriptor $6) (struct (field f64) (field (ref $7)) (field (mut f64)) (field (mut (ref null (shared eq)))) (field (ref $11)) (field (ref (shared any))))))
;; CHECK-NEXT: (type $6 (shared (describes $5) (descriptor $7) (struct (field (mut i32)) (field (mut i16)) (field i64) (field f32) (field (ref null $11)) (field (mut f64)))))
;; CHECK-NEXT: (type $7 (shared (describes $6) (descriptor $9) (struct (field i8) (field (mut f32)) (field (mut f64)) (field (mut i32)) (field (mut f32)) (field (mut i64)))))
;; CHECK-NEXT: (type $8 (sub (struct)))
;; CHECK-NEXT: (type $9 (shared (describes $7) (descriptor $11) (struct (field (mut v128)) (field (mut v128)) (field (mut f32)))))
;; CHECK-NEXT: (type $10 (func (param f32 f64 f32)))
;; CHECK-NEXT: (type $11 (shared (describes $9) (struct (field (ref (shared struct))) (field i32) (field f32) (field (mut (ref null (shared struct)))) (field i64) (field i32))))
;; CHECK-NEXT: (type $12 (sub (descriptor $13) (struct (field (mut i8)) (field f32) (field (mut v128)))))
;; CHECK-NEXT: (type $13 (sub (describes $12) (struct (field i32) (field (ref $10)) (field i8) (field (mut i64)))))
;; CHECK-NEXT: (type $14 (sub $8 (struct)))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $15 (sub $8 (struct (field v128) (field (mut (ref null (shared struct)))))))
;; CHECK-NEXT: (type $16 (shared (func (param (ref null $10)) (result (ref $6) i32 f64))))
;; CHECK-NEXT: (type $17 (sub final $12 (descriptor $18) (struct (field (mut i8)) (field f32) (field (mut v128)) (field (ref null $17)) (field (mut i8)) (field (mut eqref)))))
;; CHECK-NEXT: (type $18 (sub final $13 (describes $17) (struct (field i32) (field (ref $10)) (field i8) (field (mut i64)) (field (mut (ref null $11))) (field f64))))
;; CHECK-NEXT: (type $19 (sub $8 (struct (field (mut i8)) (field (mut v128)) (field v128) (field v128))))
;; CHECK-NEXT: )
Loading
Loading