T0b1/wasmtime
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Various improvements to differential fuzzing (#4845)

Browse Source 
* Improve wasmi differential fuzzer

* Support modules with a `start` function
* Implement trap-matching to ensure that wasmi and Wasmtime both report
  the same flavor of trap.

* Support differential fuzzing where no engines match

Locally I was attempting to run against just one wasm engine with
`ALLOWED_ENGINES=wasmi` but the fuzzer quickly panicked because the
generated test case didn't match wasmi's configuration. This commit
updates engine-selection in the differential fuzzer to return `None` if
no engine is applicable, throwing out the test case. This won't be hit
at all with oss-fuzz-based runs but for local runs it'll be useful to
have.

* Improve proposal support in differential fuzzer

* De-prioritize unstable wasm proposals such as multi-memory and
  memory64 by making them more unlikely with `Unstructured::ratio`.
* Allow fuzzing multi-table (reference types) and multi-memory by
  avoiding setting their maximums to 1 in `set_differential_config`.
* Update selection of the pooling strategy to unconditionally support
  the selected module config rather than the other way around.

* Improve handling of traps in differential fuzzing

This commit fixes an issue found via local fuzzing where engines were
reporting different results but the underlying reason for this was that
one engine was hitting stack overflow before the other. To fix the
underlying issue I updated the execution to check for stack overflow
and, if hit, it discards the entire fuzz test case from then on.

The rationale behind this is that each engine can have unique limits for
stack overflow. One test case I was looking at for example would stack
overflow at less than 1000 frames with epoch interruption enabled but
would stack overflow at more than 1000 frames with it disabled. This
means that the state after the trap started to diverge and it looked
like the engines produced different results.

While I was at it I also improved the "function call returned a trap"
case to compare traps to make sure the same trap reason popped out.

* Fix fuzzer tests
This commit is contained in:
Alex Crichton
2022-09-02 14:16:02 -05:00
committed by GitHub
parent 3afb711a51
commit 10dbb19983
9 changed files with 192 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
crates/fuzzing/src/generators/config.rs
View File

@@ -36,12 +36,6 @@ impl Config {
pub fn set_differential_config(&mut self) {
let config = &mut self.module_config.config;
// Disable the start function for now.
//
// TODO: should probably allow this after testing it works with the new
// differential setup in all engines.
config.allow_start_export = false;
// Make it more likely that there are types available to generate a
// function with.
config.min_types = 1;
@@ -54,7 +48,6 @@ impl Config {
// Allow a memory to be generated, but don't let it get too large.
// Additionally require the maximum size to guarantee that the growth
// behavior is consistent across engines.
config.max_memories = 1;
config.max_memory_pages = 10;
config.memory_max_size_required = true;
@@ -65,7 +58,6 @@ impl Config {
//
// Note that while reference types are disabled below, only allow one
// table.
config.max_tables = 1;
config.max_table_elements = 1_000;
config.table_max_size_required = true;
@@ -86,10 +78,10 @@ impl Config {
} = &mut self.wasmtime.strategy
{
// One single-page memory
limits.memories = 1;
limits.memories = config.max_memories as u32;
limits.memory_pages = 10;
limits.tables = 1;
limits.tables = config.max_tables as u32;
limits.table_elements = 1_000;
limits.size = 1_000_000;
@@ -329,16 +321,22 @@ impl<'a> Arbitrary<'a> for Config {
if let InstanceAllocationStrategy::Pooling {
instance_limits: limits,
..
} = &config.wasmtime.strategy
} = &mut config.wasmtime.strategy
{
let cfg = &mut config.module_config.config;
// If the pooling allocator is used, do not allow shared memory to
// be created. FIXME: see
// https://github.com/bytecodealliance/wasmtime/issues/4244.
config.module_config.config.threads_enabled = false;
cfg.threads_enabled = false;
// Force the use of a normal memory config when using the pooling allocator and
// limit the static memory maximum to be the same as the pooling allocator's memory
// page limit.
if cfg.max_memory_pages < limits.memory_pages {
limits.memory_pages = cfg.max_memory_pages;
} else {
cfg.max_memory_pages = limits.memory_pages;
}
config.wasmtime.memory_config = match config.wasmtime.memory_config {
MemoryConfig::Normal(mut config) => {
config.static_memory_maximum_size = Some(limits.memory_pages * 0x10000);
@@ -351,14 +349,10 @@ impl<'a> Arbitrary<'a> for Config {
}
};
let cfg = &mut config.module_config.config;
cfg.max_memories = limits.memories as usize;
cfg.max_tables = limits.tables as usize;
cfg.max_memory_pages = limits.memory_pages;
// Force no aliases in any generated modules as they might count against the
// import limits above.
cfg.max_aliases = 0;
// Force this pooling allocator to always be able to accommodate the
// module that may be generated.
limits.memories = cfg.max_memories as u32;
limits.tables = cfg.max_tables as u32;
}
Ok(config)

16
crates/fuzzing/src/generators/module.rs
View File

@@ -17,21 +17,27 @@ impl<'a> Arbitrary<'a> for ModuleConfig {
fn arbitrary(u: &mut Unstructured<'a>) -> arbitrary::Result<ModuleConfig> {
let mut config = SwarmConfig::arbitrary(u)?;
// Allow multi-memory by default.
config.max_memories = config.max_memories.max(2);
// Allow multi-memory but make it unlikely
if u.ratio(1, 20)? {
config.max_memories = config.max_memories.max(2);
} else {
config.max_memories = 1;
}
// Allow multi-table by default.
config.max_tables = config.max_tables.max(4);
if config.reference_types_enabled {
config.max_tables = config.max_tables.max(4);
}
// Allow enabling some various wasm proposals by default. Note that
// these are all unconditionally turned off even with
// `SwarmConfig::arbitrary`.
config.memory64_enabled = u.arbitrary()?;
config.memory64_enabled = u.ratio(1, 20)?;
// Allow the threads proposal if memory64 is not already enabled. FIXME:
// to allow threads and memory64 to coexist, see
// https://github.com/bytecodealliance/wasmtime/issues/4267.
config.threads_enabled = !config.memory64_enabled && u.arbitrary()?;
config.threads_enabled = !config.memory64_enabled && u.ratio(1, 20)?;
Ok(ModuleConfig { config })
}