Skip to content

Fuzz waitqueue instructions #9012

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stevenfontanella wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fuzz waitqueue instructions #9012

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions src/tools/fuzzing.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,6 +220,9 @@ class TranslateToFuzzReader {
// All struct fields that are mutable.
std::vector<StructField> mutableStructFields;

// All struct fields that can be waited on.
std::vector<StructField> structWaitFields;

// All arrays that are mutable.
std::vector<HeapType> mutableArrays;

Expand Down Expand Up @@ -560,6 +563,8 @@ class TranslateToFuzzReader {
Expression* makeStructRMW(Type type);
Expression* makeStructCmpxchg(Type type);
Expression* makeStructSet(Type type);
Expression* makeStructWait(Type type);
Expression* makeWaitqueueNotify(Type type);
Expression* makeArrayGet(Type type);
Expression* makeArraySet(Type type);
Expression* makeArrayRMW(Type type);
Expand Down
79 changes: 68 additions & 11 deletions src/tools/fuzzing/fuzzing.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -603,11 +603,19 @@ void TranslateToFuzzReader::setupHeapTypes() {
interestingHeapSubTypes[struct_].push_back(type);
interestingHeapSubTypes[eq].push_back(type);
interestingHeapSubTypes[any].push_back(type);
// Note the mutable fields.
auto& fields = type.getStruct().fields;
// Note the mutable fields and fields that can be waited on.
const auto& fields = type.getStruct().fields;
for (Index i = 0; i < fields.size(); i++) {
if (fields[i].mutable_) {
mutableStructFields.push_back(StructField{type, i});
mutableStructFields.emplace_back(type, i);
}
if (!fields[i].isPacked()) {
auto fieldType = fields[i].type;
if (fieldType == Type::i32 || fieldType == Type::i64 ||
Type::isSubType(
fieldType, Type(HeapTypes::eq.getBasic(Shared), Nullable))) {
structWaitFields.emplace_back(type, i);
}
}
}
break;
Expand Down Expand Up @@ -1901,6 +1909,16 @@ void TranslateToFuzzReader::addHangLimitChecks(Function* func) {
AndInt32, arrayNew->size, builder.makeConst(int32_t(1024 - 1)));
}
}
if (!ATOMIC_WAITS) {
for (auto* wait : FindAll<StructWait>(func->body).list) {
if (auto* c = wait->timeout->dynCast<Const>()) {
c->value = Literal(int64_t(0));
} else if (wait->timeout->type == Type::i64) {
wait->timeout = builder.makeSequence(builder.makeDrop(wait->timeout),
builder.makeConst(int64_t(0)));
}
}
}
}

void TranslateToFuzzReader::recombine(Function* func) {
Expand Down Expand Up @@ -2881,6 +2899,13 @@ Expression* TranslateToFuzzReader::_makeConcrete(Type type) {
&Self::makeStringEq,
&Self::makeStringMeasure,
&Self::makeStringGet);
options.add(FeatureSet::ReferenceTypes | FeatureSet::SharedEverything,
&Self::makeWaitqueueNotify);
if (!structWaitFields.empty()) {
options.add(FeatureSet::ReferenceTypes | FeatureSet::GC |
FeatureSet::SharedEverything,
&Self::makeStructWait);
}
}
if (type == Type::i64) {
options.add(FeatureSet::WideArithmetic | FeatureSet::Multivalue,
Expand Down Expand Up @@ -4407,17 +4432,20 @@ Expression* TranslateToFuzzReader::makeBasicRef(Type type) {
case HeapType::noext:
case HeapType::nofunc:
case HeapType::nocont:
case HeapType::noexn: {
case HeapType::noexn:
case HeapType::nowaitqueue: {
auto null = builder.makeRefNull(heapType.getBasic(share));
if (!type.isNullable()) {
return builder.makeRefAs(RefAsNonNull, null);
}
return null;
}

case HeapType::waitqueue:
case HeapType::nowaitqueue: {
WASM_UNREACHABLE("waitqueue is unimplemented in the fuzzer");
case HeapType::waitqueue: {
if (type.isNullable() && oneIn(2)) {
return builder.makeRefNull(HeapTypes::sharedWaitqueue.getBasic(share));
}
return builder.makeWaitqueueNew();
}
}
WASM_UNREACHABLE("invalid basic ref type");
Expand Down Expand Up @@ -6060,8 +6088,8 @@ Expression* TranslateToFuzzReader::makeStructSet(Type type) {
return makeTrivial(type);
}
auto [structType, fieldIndex] = pick(mutableStructFields);
auto fieldType = structType.getStruct().fields[fieldIndex].type;
auto* ref = makeTrappingRefUse(structType);
auto fieldType = structType.getStruct().fields[fieldIndex].type;
auto* value = make(fieldType);
auto order = MemoryOrder::Unordered;
if (wasm.features.hasAtomics() && wasm.features.hasSharedEverything() &&
Expand All @@ -6071,6 +6099,35 @@ Expression* TranslateToFuzzReader::makeStructSet(Type type) {
return builder.makeStructSet(fieldIndex, ref, value, order);
}

Expression* TranslateToFuzzReader::makeStructWait(Type type) {
assert(type == Type::i32);
assert(!structWaitFields.empty());
auto [structType, fieldIndex] = pick(structWaitFields);
auto* ref = makeTrappingRefUse(structType);
auto* waitqueue =
makeTrappingRefUse(Type(HeapTypes::sharedWaitqueue, Nullable));
auto expectedType = structType.getStruct().fields[fieldIndex].type;
if (expectedType.isRef()) {
expectedType = Type(HeapTypes::eq.getBasic(Shared), Nullable);
}
auto* expected = make(expectedType);
Expression* timeout = nullptr;
if (ATOMIC_WAITS && oneIn(2)) {
timeout = make(Type::i64);
} else {
timeout = builder.makeConst(int64_t{0});
}
return builder.makeStructWait(fieldIndex, ref, waitqueue, expected, timeout);
}

Expression* TranslateToFuzzReader::makeWaitqueueNotify(Type type) {
assert(type == Type::i32);
auto* waitqueue =
makeTrappingRefUse(Type(HeapTypes::sharedWaitqueue, Nullable));
auto* count = make(Type::i32);
return builder.makeWaitqueueNotify(waitqueue, count);
}

// Make a bounds check for an array operation, given a ref + index. An optional
// additional length parameter can be provided, which is added to the index if
// so (that is useful for something like array.fill, which operations on not a
Expand Down Expand Up @@ -6705,11 +6762,11 @@ HeapType TranslateToFuzzReader::getSubType(HeapType type) {
case HeapType::nofunc:
case HeapType::nocont:
case HeapType::noexn:
case HeapType::nowaitqueue:
break;
case HeapType::waitqueue:
case HeapType::nowaitqueue: {
WASM_UNREACHABLE("waitqueue is unimplemented in the fuzzer");
}
return pick(HeapTypes::sharedWaitqueue, HeapTypes::sharedNowaitqueue)
.getBasic(share);
}
}
// Look for an interesting subtype.
Expand Down
22 changes: 15 additions & 7 deletions src/tools/fuzzing/heap-types.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -344,6 +344,9 @@ struct HeapTypeGeneratorImpl {
if (features.hasStackSwitching() && share == Unshared) {
bottoms.push_back(HeapType::nocont);
}
if (features.hasSharedEverything() && share == Shared) {
bottoms.push_back(HeapType::nowaitqueue);
}
return rand.pick(bottoms).getBasic(share);
}

Expand All @@ -366,6 +369,9 @@ struct HeapTypeGeneratorImpl {
if (features.hasExceptionHandling() && share == Unshared) {
options.push_back(HeapType::exn);
}
if (features.hasSharedEverything() && share == Shared) {
options.push_back(HeapType::waitqueue);
}
auto ht = rand.pick(options);
return ht.getBasic(share);
}
Expand Down Expand Up @@ -691,11 +697,13 @@ struct HeapTypeGeneratorImpl {
case HeapType::nofunc:
case HeapType::nocont:
case HeapType::noexn:
case HeapType::nowaitqueue:
return type;
case HeapType::waitqueue:
case HeapType::nowaitqueue: {
WASM_UNREACHABLE("waitqueue is unimplemented in the fuzzer");
}
if (rand.oneIn(2)) {
return HeapTypes::sharedNowaitqueue.getBasic(share);
}
return type;
}
WASM_UNREACHABLE("unexpected type");
}
Expand Down Expand Up @@ -743,6 +751,7 @@ struct HeapTypeGeneratorImpl {
case HeapType::exn:
case HeapType::cont:
case HeapType::any:
case HeapType::waitqueue:
break;
case HeapType::eq:
candidates.push_back(HeapTypes::any.getBasic(share));
Expand All @@ -768,10 +777,9 @@ struct HeapTypeGeneratorImpl {
case HeapType::noexn:
candidates.push_back(HeapTypes::exn.getBasic(share));
break;
case HeapType::waitqueue:
case HeapType::nowaitqueue: {
WASM_UNREACHABLE("waitqueue is unimplemented in the fuzzer");
}
case HeapType::nowaitqueue:
candidates.push_back(HeapTypes::sharedWaitqueue.getBasic(share));
break;
}
assert(!candidates.empty());
return rand.pick(candidates);
Expand Down
3 changes: 3 additions & 0 deletions src/wasm-builder.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1524,6 +1524,9 @@ class Builder {
return makeRefAs(ExternConvertAny,
makeConstantExpression(value.internalize()));
}
if (type.isRef() && type.getHeapType() == HeapTypes::sharedWaitqueue) {
return makeWaitqueueNew();
}
TODO_SINGLE_COMPOUND(type);
WASM_UNREACHABLE("unsupported constant expression");
}
Expand Down
112 changes: 56 additions & 56 deletions test/lit/fuzz-types.test
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,60 +1,60 @@
;; RUN: wasm-fuzz-types -v --seed=3 | filecheck %s

;; CHECK: Running with seed 3
;; CHECK-NEXT: Built 20 types:
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $0 (sub (shared (func (param i64 f64 exnref (ref null $0)) (result (ref cont))))))
;; CHECK-NEXT: (type $1 (shared (descriptor $2) (struct)))
;; CHECK-NEXT: (type $2 (shared (describes $1) (descriptor $4) (struct (field (mut v128)) (field (mut (ref $4))) (field (mut v128)) (field (mut i32)) (field f32))))
;; CHECK-NEXT: (type $3 (array i8))
;; CHECK-NEXT: (type $4 (shared (describes $2) (struct)))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $5 (shared (descriptor $6) (struct (field f64) (field (ref $7)) (field (mut f64)) (field (mut (ref null (shared eq)))) (field (ref $11)) (field (ref (shared any))))))
;; CHECK-NEXT: (type $6 (shared (describes $5) (descriptor $7) (struct (field (mut i32)) (field (mut i16)) (field i64) (field f32) (field (ref null $11)) (field (mut f64)))))
;; CHECK-NEXT: (type $7 (shared (describes $6) (descriptor $9) (struct (field i8) (field (mut f32)) (field (mut f64)) (field (mut i32)) (field (mut f32)) (field (mut i64)))))
;; CHECK-NEXT: (type $8 (sub (struct)))
;; CHECK-NEXT: (type $9 (shared (describes $7) (descriptor $11) (struct (field (mut v128)) (field (mut v128)) (field (mut f32)))))
;; CHECK-NEXT: (type $10 (func (param f32 f64 f32)))
;; CHECK-NEXT: (type $11 (shared (describes $9) (struct (field (ref (shared struct))) (field i32) (field f32) (field (mut (ref null (shared struct)))) (field i64) (field i32))))
;; CHECK-NEXT: (type $12 (sub (descriptor $13) (struct (field (mut i8)) (field f32) (field (mut v128)))))
;; CHECK-NEXT: (type $13 (sub (describes $12) (struct (field i32) (field (ref $10)) (field i8) (field (mut i64)))))
;; CHECK-NEXT: (type $14 (sub $8 (struct)))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $15 (sub $8 (struct (field v128) (field (mut (ref null (shared struct)))))))
;; CHECK-NEXT: (type $16 (shared (func (param (ref null $10)) (result (ref $6) i32 f64))))
;; CHECK-NEXT: (type $17 (sub final $12 (descriptor $18) (struct (field (mut i8)) (field f32) (field (mut v128)) (field (ref $17)) (field (mut i8)) (field (mut eqref)))))
;; CHECK-NEXT: (type $18 (sub final $13 (describes $17) (struct (field i32) (field (ref $10)) (field i8) (field (mut i64)) (field (mut (ref null $11))) (field f64))))
;; CHECK-NEXT: (type $19 (sub $8 (struct (field (mut i8)) (field (mut v128)) (field v128) (field v128))))
;; CHECK-NEXT: )
;; CHECK: Running with seed 3
;; CHECK-NEXT: Built 20 types:
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $0 (sub (shared (func (param i64 f64 exnref (ref null $0)) (result (ref cont))))))
;; CHECK-NEXT: (type $1 (shared (descriptor $2) (struct)))
;; CHECK-NEXT: (type $2 (shared (describes $1) (descriptor $4) (struct (field (mut v128)) (field (mut (ref $4))) (field (mut v128)) (field (mut i32)) (field f32))))
;; CHECK-NEXT: (type $3 (array i8))
;; CHECK-NEXT: (type $4 (shared (describes $2) (struct)))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $5 (shared (descriptor $6) (struct (field f64) (field (ref $7)) (field (mut f64)) (field (mut (ref (shared i31)))) (field (mut (ref $11))) (field (ref (shared i31))))))
;; CHECK-NEXT: (type $6 (shared (describes $5) (descriptor $7) (struct (field (mut i32)) (field (mut (ref null $0))) (field (ref null (shared i31))) (field (mut v128)) (field (mut i64)) (field (mut (ref $2))))))
;; CHECK-NEXT: (type $7 (shared (describes $6) (descriptor $9) (struct (field (ref null $6)) (field (mut (ref $0))) (field (ref $7)) (field i8) (field (mut i8)) (field (ref null $5)))))
;; CHECK-NEXT: (type $8 (sub (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)))))
;; CHECK-NEXT: (type $9 (shared (describes $7) (descriptor $11) (struct (field (mut (ref $0))) (field (mut v128)))))
;; CHECK-NEXT: (type $10 (func (result (ref extern) (ref noextern) (ref $13) i32 exnref)))
;; CHECK-NEXT: (type $11 (shared (describes $9) (struct (field i16) (field (ref null $11)))))
;; CHECK-NEXT: (type $12 (sub (descriptor $13) (struct (field i64) (field (ref (shared extern))) (field (mut i16)) (field (mut (ref noextern))))))
;; CHECK-NEXT: (type $13 (sub (describes $12) (struct (field (ref extern)) (field f64))))
;; CHECK-NEXT: (type $14 (sub final $8 (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)) (field v128))))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $15 (sub $8 (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)) (field (mut i32)))))
;; CHECK-NEXT: (type $16 (shared (func (param (ref null $17)) (result exnref))))
;; CHECK-NEXT: (type $17 (sub final $12 (descriptor $18) (struct (field i64) (field (ref (shared extern))) (field (mut i16)) (field (mut (ref noextern))) (field (mut (ref null $10))))))
;; CHECK-NEXT: (type $18 (sub final $13 (describes $17) (struct (field (ref extern)) (field f64) (field (mut i16)) (field (mut i8)))))
;; CHECK-NEXT: (type $19 (sub $8 (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)) (field (mut (ref cont))) (field (mut i64)))))
;; CHECK-NEXT: )
;; CHECK-EMPTY:
;; CHECK-NEXT: Inhabitable types:
;; CHECK-NEXT: Inhabitable types:
;; CHECK-EMPTY:
;; CHECK-NEXT: Built 20 types:
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $0 (sub (shared (func (param i64 f64 exnref (ref null $0)) (result (ref cont))))))
;; CHECK-NEXT: (type $1 (shared (descriptor $2) (struct)))
;; CHECK-NEXT: (type $2 (shared (describes $1) (descriptor $4) (struct (field (mut v128)) (field (mut (ref $4))) (field (mut v128)) (field (mut i32)) (field f32))))
;; CHECK-NEXT: (type $3 (array i8))
;; CHECK-NEXT: (type $4 (shared (describes $2) (struct)))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $5 (shared (descriptor $6) (struct (field f64) (field (ref $7)) (field (mut f64)) (field (mut (ref null (shared eq)))) (field (ref $11)) (field (ref (shared any))))))
;; CHECK-NEXT: (type $6 (shared (describes $5) (descriptor $7) (struct (field (mut i32)) (field (mut i16)) (field i64) (field f32) (field (ref null $11)) (field (mut f64)))))
;; CHECK-NEXT: (type $7 (shared (describes $6) (descriptor $9) (struct (field i8) (field (mut f32)) (field (mut f64)) (field (mut i32)) (field (mut f32)) (field (mut i64)))))
;; CHECK-NEXT: (type $8 (sub (struct)))
;; CHECK-NEXT: (type $9 (shared (describes $7) (descriptor $11) (struct (field (mut v128)) (field (mut v128)) (field (mut f32)))))
;; CHECK-NEXT: (type $10 (func (param f32 f64 f32)))
;; CHECK-NEXT: (type $11 (shared (describes $9) (struct (field (ref (shared struct))) (field i32) (field f32) (field (mut (ref null (shared struct)))) (field i64) (field i32))))
;; CHECK-NEXT: (type $12 (sub (descriptor $13) (struct (field (mut i8)) (field f32) (field (mut v128)))))
;; CHECK-NEXT: (type $13 (sub (describes $12) (struct (field i32) (field (ref $10)) (field i8) (field (mut i64)))))
;; CHECK-NEXT: (type $14 (sub $8 (struct)))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $15 (sub $8 (struct (field v128) (field (mut (ref null (shared struct)))))))
;; CHECK-NEXT: (type $16 (shared (func (param (ref null $10)) (result (ref $6) i32 f64))))
;; CHECK-NEXT: (type $17 (sub final $12 (descriptor $18) (struct (field (mut i8)) (field f32) (field (mut v128)) (field (ref null $17)) (field (mut i8)) (field (mut eqref)))))
;; CHECK-NEXT: (type $18 (sub final $13 (describes $17) (struct (field i32) (field (ref $10)) (field i8) (field (mut i64)) (field (mut (ref null $11))) (field f64))))
;; CHECK-NEXT: (type $19 (sub $8 (struct (field (mut i8)) (field (mut v128)) (field v128) (field v128))))
;; CHECK-NEXT: )
;; CHECK-NEXT: Built 20 types:
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $0 (sub (shared (func (param i64 f64 exnref (ref null $0)) (result (ref cont))))))
;; CHECK-NEXT: (type $1 (shared (descriptor $2) (struct)))
;; CHECK-NEXT: (type $2 (shared (describes $1) (descriptor $4) (struct (field (mut v128)) (field (mut (ref $4))) (field (mut v128)) (field (mut i32)) (field f32))))
;; CHECK-NEXT: (type $3 (array i8))
;; CHECK-NEXT: (type $4 (shared (describes $2) (struct)))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $5 (shared (descriptor $6) (struct (field f64) (field (ref $7)) (field (mut f64)) (field (mut (ref (shared i31)))) (field (mut (ref $11))) (field (ref (shared i31))))))
;; CHECK-NEXT: (type $6 (shared (describes $5) (descriptor $7) (struct (field (mut i32)) (field (mut (ref null $0))) (field (ref null (shared i31))) (field (mut v128)) (field (mut i64)) (field (mut (ref $2))))))
;; CHECK-NEXT: (type $7 (shared (describes $6) (descriptor $9) (struct (field (ref null $6)) (field (mut (ref $0))) (field (ref null $7)) (field i8) (field (mut i8)) (field (ref null $5)))))
;; CHECK-NEXT: (type $8 (sub (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)))))
;; CHECK-NEXT: (type $9 (shared (describes $7) (descriptor $11) (struct (field (mut (ref $0))) (field (mut v128)))))
;; CHECK-NEXT: (type $10 (func (result (ref extern) (ref noextern) (ref $13) i32 exnref)))
;; CHECK-NEXT: (type $11 (shared (describes $9) (struct (field i16) (field (ref null $11)))))
;; CHECK-NEXT: (type $12 (sub (descriptor $13) (struct (field i64) (field (ref null (shared extern))) (field (mut i16)) (field (mut nullexternref)))))
;; CHECK-NEXT: (type $13 (sub (describes $12) (struct (field externref) (field f64))))
;; CHECK-NEXT: (type $14 (sub final $8 (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)) (field v128))))
;; CHECK-NEXT: )
;; CHECK-NEXT: (rec
;; CHECK-NEXT: (type $15 (sub $8 (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)) (field (mut i32)))))
;; CHECK-NEXT: (type $16 (shared (func (param (ref null $17)) (result exnref))))
;; CHECK-NEXT: (type $17 (sub final $12 (descriptor $18) (struct (field i64) (field (ref null (shared extern))) (field (mut i16)) (field (mut nullexternref)) (field (mut (ref null $10))))))
;; CHECK-NEXT: (type $18 (sub final $13 (describes $17) (struct (field externref) (field f64) (field (mut i16)) (field (mut i8)))))
;; CHECK-NEXT: (type $19 (sub $8 (struct (field (mut i16)) (field (mut (ref null $3))) (field (mut i64)) (field (mut (ref cont))) (field (mut i64)))))
;; CHECK-NEXT: )
Loading
Loading