Throw out fewer fuzz inputs with differential fuzzer (#4859)

* Throw out fewer fuzz inputs with differential fuzzer

Prior to this commit the differential fuzzer would generate a module and
then select an engine to execute the module against Wasmtime. This
meant, however, that the candidate list of engines were filtered against
the configuration used to generate the module to ensure that the
selected engine could run the generated module.

This commit inverts this logic and instead selects an engine first,
allowing the engine to then tweak the module configuration to ensure
that the generated module is compatible with the engine selected. This
means that fewer fuzz inputs are discarded because every fuzz input will
result in an engine being executed.

Internally the engine constructors have all been updated to update the
configuration to work instead of filtering the configuration. Some other
fixes were applied for the spec interpreter as well to work around #4852

* Fix tests

crates/fuzzing/src/oracles/engine.rs

@@ -1,68 +1,37 @@
 //! Define the interface for differential evaluation of Wasm functions.
 
-use crate::generators::{Config, DiffValue, DiffValueType, WasmtimeConfig};
+use crate::generators::{Config, DiffValue, DiffValueType};
 use crate::oracles::{diff_wasmi::WasmiEngine, diff_wasmtime::WasmtimeEngine};
 use anyhow::Error;
 use arbitrary::Unstructured;
 use wasmtime::Trap;
 
-/// Pick one of the engines implemented in this module that is:
-/// - in the list of `allowed` engines
-/// - can evaluate Wasm modules compatible with `existing_config`.
-pub fn choose(
+/// Returns a function which can be used to build the engine name specified.
+///
+/// `None` is returned if the named engine does not have support compiled into
+/// this crate.
+pub fn build(
     u: &mut Unstructured<'_>,
-    existing_config: &Config,
-    allowed: &[&str],
+    name: &str,
+    config: &mut Config,
 ) -> arbitrary::Result<Option<Box<dyn DiffEngine>>> {
-    // Filter out any engines that cannot match the `existing_config` or are not
-    // `allowed`.
-    let mut engines: Vec<Box<dyn DiffEngine>> = vec![];
+    let engine: Box<dyn DiffEngine> = match name {
+        "wasmtime" => Box::new(WasmtimeEngine::new(u, config)?),
+        "wasmi" => Box::new(WasmiEngine::new(config)),
 
-    if allowed.contains(&"wasmtime") {
-        let mut new_wasmtime_config: WasmtimeConfig = u.arbitrary()?;
-        new_wasmtime_config.make_compatible_with(&existing_config.wasmtime);
-        let new_config = Config {
-            wasmtime: new_wasmtime_config,
-            module_config: existing_config.module_config.clone(),
-        };
-        if let Result::Ok(e) = WasmtimeEngine::new(new_config) {
-            engines.push(Box::new(e))
-        }
-    }
+        #[cfg(feature = "fuzz-spec-interpreter")]
+        "spec" => Box::new(crate::oracles::diff_spec::SpecInterpreter::new(config)),
+        #[cfg(not(feature = "fuzz-spec-interpreter"))]
+        "spec" => return Ok(None),
 
-    if allowed.contains(&"wasmi") {
-        if let Result::Ok(e) = WasmiEngine::new(&existing_config.module_config) {
-            engines.push(Box::new(e))
-        }
-    }
+        #[cfg(not(any(windows, target_arch = "s390x")))]
+        "v8" => Box::new(crate::oracles::diff_v8::V8Engine::new(config)),
+        #[cfg(any(windows, target_arch = "s390x"))]
+        "v8" => return Ok(None),
 
-    #[cfg(feature = "fuzz-spec-interpreter")]
-    if allowed.contains(&"spec") {
-        if let Result::Ok(e) =
-            crate::oracles::diff_spec::SpecInterpreter::new(&existing_config.module_config)
-        {
-            engines.push(Box::new(e))
-        }
-    }
+        _ => panic!("unknown engine {name}"),
+    };
 
-    #[cfg(not(any(windows, target_arch = "s390x")))]
-    if allowed.contains(&"v8") {
-        if let Result::Ok(e) =
-            crate::oracles::diff_v8::V8Engine::new(&existing_config.module_config)
-        {
-            engines.push(Box::new(e))
-        }
-    }
-
-    if engines.is_empty() {
-        return Ok(None);
-    }
-
-    // Use the input of the fuzzer to pick an engine that we'll be fuzzing
-    // Wasmtime against.
-    let index: usize = u.int_in_range(0..=engines.len() - 1)?;
-    let engine = engines.swap_remove(index);
-    log::debug!("selected engine: {}", engine.name());
     Ok(Some(engine))
 }
 
@@ -187,11 +156,11 @@ pub fn parse_env_list(env_variable: &str) -> Option<Vec<String>> {
 }
 
 #[cfg(test)]
-pub fn smoke_test_engine<T>(mk_engine: impl Fn(Config) -> anyhow::Result<T>)
-where
+pub fn smoke_test_engine<T>(
+    mk_engine: impl Fn(&mut arbitrary::Unstructured<'_>, &mut Config) -> arbitrary::Result<T>,
+) where
     T: DiffEngine,
 {
-    use arbitrary::Arbitrary;
     use rand::prelude::*;
 
     let mut rng = SmallRng::seed_from_u64(0);
@@ -199,8 +168,8 @@ where
     let n = 100;
     for _ in 0..n {
         rng.fill_bytes(&mut buf);
-        let u = Unstructured::new(&buf);
-        let mut config = match Config::arbitrary_take_rest(u) {
+        let mut u = Unstructured::new(&buf);
+        let mut config = match u.arbitrary::<Config>() {
             Ok(config) => config,
             Err(_) => continue,
         };
@@ -208,19 +177,7 @@ where
         // settings, can guaranteed instantiate a module.
         config.set_differential_config();
 
-        // Configure settings to ensure that any filters in engine constructors
-        // try not to filter out this `Config`.
-        config.module_config.config.reference_types_enabled = false;
-        config.module_config.config.bulk_memory_enabled = false;
-        config.module_config.config.memory64_enabled = false;
-        config.module_config.config.threads_enabled = false;
-        config.module_config.config.simd_enabled = false;
-        config.module_config.config.min_funcs = 1;
-        config.module_config.config.max_funcs = 1;
-        config.module_config.config.min_tables = 0;
-        config.module_config.config.max_tables = 0;
-
-        let mut engine = match mk_engine(config) {
+        let mut engine = match mk_engine(&mut u, &mut config) {
             Ok(engine) => engine,
             Err(e) => {
                 println!("skip {:?}", e);