T0b1/wasmtime
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request from GHSA-5fhj-g3p3-pq9g

Browse Source 
* Improve cranelift disassembly of stack maps

Print out extra information about stack maps such as their contents and
other related metadata available. Additionally also print out addresses
in hex to line up with the disassembly otherwise printed as well.

* Improve the `table_ops` fuzzer

* Generate more instructions by default
* Fix negative indices appearing in `table.{get,set}`
* Assert that the traps generated are expected to prevent accidental
  other errors reporting a fuzzing success.

* Fix `reftype_vregs` reported to `regalloc2`

This fixes a mistake in the register allocation of Cranelift functions
where functions using reference-typed arguments incorrectly report which
virtual registers are reference-typed values if there are vreg aliases
in play. The fix here is to apply the vreg aliases to the final list of
reftyped regs which is eventually passed to `regalloc2`.

The main consequence of this fix is that functions which previously
accidentally didn't have correct stack maps should now have the missing
stack maps.

* Add a test that `table_ops` gc's eventually

* Add a comment about new alias resolution

* Update crates/fuzzing/src/oracles.rs

Co-authored-by: Nick Fitzgerald <fitzgen@gmail.com>

* Add some comments

Co-authored-by: Nick Fitzgerald <fitzgen@gmail.com>
This commit is contained in:
Alex Crichton
2022-07-20 11:52:23 -05:00
committed by GitHub
parent 839c4cce17
commit 2154c63de9
4 changed files with 143 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
crates/fuzzing/src/generators/table_ops.rs
View File

@@ -147,12 +147,7 @@ impl<'a> Arbitrary<'a> for TableOps {
let mut stack = 0;
let mut ops = vec![];
let mut choices = vec![];
loop {
let keep_going = ops.len() < MAX_OPS && u.arbitrary().unwrap_or(false);
if !keep_going {
break;
}
while ops.len() < MAX_OPS && !u.is_empty() {
ops.push(TableOp::arbitrary(u, &mut stack, &mut choices)?);
}
@@ -216,8 +211,8 @@ define_table_ops! {
MakeRefs : 0 => 3,
TakeRefs : 3 => 0,
TableGet(i32) : 0 => 1,
TableSet(i32) : 1 => 0,
TableGet(u32) : 0 => 1,
TableSet(u32) : 1 => 0,
GlobalGet(u32) : 0 => 1,
GlobalSet(u32) : 1 => 0,
@@ -237,7 +232,7 @@ impl TableOp {
// Add one to make sure that out of bounds table accesses are possible,
// but still rare.
let table_mod = table_size as i32 + 1;
let table_mod = table_size + 1;
let gc_func_idx = 0;
let take_refs_func_idx = 1;
@@ -256,12 +251,12 @@ impl TableOp {
func.instruction(&Instruction::Call(take_refs_func_idx));
}
Self::TableGet(x) => {
func.instruction(&Instruction::I32Const(x % table_mod));
func.instruction(&Instruction::I32Const((x % table_mod) as i32));
func.instruction(&Instruction::TableGet { table: 0 });
}
Self::TableSet(x) => {
func.instruction(&Instruction::LocalSet(scratch_local));
func.instruction(&Instruction::I32Const(x % table_mod));
func.instruction(&Instruction::I32Const((x % table_mod) as i32));
func.instruction(&Instruction::LocalGet(scratch_local));
func.instruction(&Instruction::TableSet { table: 0 });
}