Throw out fewer fuzz inputs with differential fuzzer (#4859)

* Throw out fewer fuzz inputs with differential fuzzer

Prior to this commit the differential fuzzer would generate a module and
then select an engine to execute the module against Wasmtime. This
meant, however, that the candidate list of engines were filtered against
the configuration used to generate the module to ensure that the
selected engine could run the generated module.

This commit inverts this logic and instead selects an engine first,
allowing the engine to then tweak the module configuration to ensure
that the generated module is compatible with the engine selected. This
means that fewer fuzz inputs are discarded because every fuzz input will
result in an engine being executed.

Internally the engine constructors have all been updated to update the
configuration to work instead of filtering the configuration. Some other
fixes were applied for the spec interpreter as well to work around #4852

* Fix tests

fuzz/fuzz_targets/differential.rs

@@ -60,60 +60,84 @@ fn run(data: &[u8]) -> Result<()> {
     STATS.bump_attempts();
 
     let mut u = Unstructured::new(data);
+
+    // Generate a Wasmtime and module configuration and update its settings
+    // initially to be suitable for differential execution where the generated
+    // wasm will behave the same in two different engines. This will get further
+    // refined below.
     let mut config: Config = u.arbitrary()?;
     config.set_differential_config();
 
-    // Generate the Wasm module; this is specified by either the ALLOWED_MODULES
-    // environment variable or a random selection between wasm-smith and
-    // single-inst.
-    let build_wasm_smith_module = |u: &mut Unstructured, config: &mut Config| -> Result<_> {
+    // Choose an engine that Wasmtime will be differentially executed against.
+    // The chosen engine is then created, which might update `config`, and
+    // returned as a trait object.
+    let lhs = u.choose(unsafe { &ALLOWED_ENGINES })?;
+    let mut lhs = match engine::build(&mut u, lhs, &mut config)? {
+        Some(engine) => engine,
+        // The chosen engine does not have support compiled into the fuzzer,
+        // discard this test case.
+        None => return Ok(()),
+    };
+
+    // Using the now-legalized module configuration generate the Wasm module;
+    // this is specified by either the ALLOWED_MODULES environment variable or a
+    // random selection between wasm-smith and single-inst.
+    let build_wasm_smith_module = |u: &mut Unstructured, config: &Config| -> Result<_> {
         STATS.wasm_smith_modules.fetch_add(1, SeqCst);
         let module = config.generate(u, Some(1000))?;
         Ok(module.to_bytes())
     };
-    let build_single_inst_module = |u: &mut Unstructured, config: &mut Config| -> Result<_> {
+    let build_single_inst_module = |u: &mut Unstructured, config: &Config| -> Result<_> {
         STATS.single_instruction_modules.fetch_add(1, SeqCst);
-        let module = SingleInstModule::new(u, &mut config.module_config)?;
+        let module = SingleInstModule::new(u, &config.module_config)?;
         Ok(module.to_bytes())
     };
     if unsafe { ALLOWED_MODULES.is_empty() } {
         panic!("unable to generate a module to fuzz against; check `ALLOWED_MODULES`")
     }
     let wasm = match *u.choose(unsafe { ALLOWED_MODULES.as_slice() })? {
-        "wasm-smith" => build_wasm_smith_module(&mut u, &mut config)?,
-        "single-inst" => build_single_inst_module(&mut u, &mut config)?,
+        "wasm-smith" => build_wasm_smith_module(&mut u, &config)?,
+        "single-inst" => build_single_inst_module(&mut u, &config)?,
         _ => unreachable!(),
     };
     log_wasm(&wasm);
 
-    // Choose a left-hand side Wasm engine. If no engine could be chosen then
-    // that means the configuration selected above doesn't match any allowed
-    // engine (configured via an env var) so the test case is thrown out.
-    let mut lhs = match engine::choose(&mut u, &config, unsafe { &ALLOWED_ENGINES })? {
-        Some(engine) => engine,
-        None => return Ok(()),
-    };
+    // Instantiate the generated wasm file in the chosen differential engine.
     let lhs_instance = lhs.instantiate(&wasm);
     STATS.bump_engine(lhs.name());
 
-    // Choose a right-hand side Wasm engine--this will always be Wasmtime.
+    // Always use Wasmtime as the second engine to instantiate within.
     let rhs_store = config.to_store();
     let rhs_module = wasmtime::Module::new(rhs_store.engine(), &wasm).unwrap();
     let rhs_instance = WasmtimeInstance::new(rhs_store, rhs_module);
 
-    // If we fail to instantiate, check that both sides do.
     let (mut lhs_instance, mut rhs_instance) = match (lhs_instance, rhs_instance) {
+        // Both sides successful, continue below to invoking exports.
         (Ok(l), Ok(r)) => (l, r),
+
+        // Both sides failed, make sure they failed for the same reason but then
+        // we're done with this fuzz test case.
         (Err(l), Err(r)) => {
             let err = r.downcast::<Trap>().expect("not a trap");
             lhs.assert_error_match(&err, &l);
             return Ok(());
         }
-        (l, r) => panic!(
-            "failed to instantiate only one side: {:?} != {:?}",
-            l.err(),
-            r.err()
-        ),
+
+        // One side succeeded and one side failed, that means a bug happened!
+        (l, r) => {
+            // FIXME(#4852): the spec interpreter doesn't instantiate as part of
+            // the instantiate step so if wasmtime failed and the spec succeeded
+            // that's ok. This clause should be removed once that issue is
+            // fixed.
+            if l.is_ok() && lhs.name() == "spec" {
+                return Ok(());
+            }
+            panic!(
+                "failed to instantiate only one side: {:?} != {:?}",
+                l.err(),
+                r.err()
+            )
+        }
     };
 
     // Call each exported function with different sets of arguments.
@@ -148,6 +172,13 @@ fn run(data: &[u8]) -> Result<()> {
                 break 'outer;
             }
 
+            // FIXME(#4852): the spec interpreter only supports one execution
+            // right now because each execution re-instantiates the module in
+            // its bindings. This should be removed once that issue is fixed.
+            if lhs.name() == "spec" {
+                break 'outer;
+            }
+
             // We evaluate the same function with different arguments until we
             // hit a predetermined limit or we run out of unstructured data--it
             // does not make sense to re-evaluate the same arguments over and