implement fuzzing for component types (#4537)

This addresses #4307.

For the static API we generate 100 arbitrary test cases at build time, each of
which includes 0-5 parameter types, a result type, and a WAT fragment containing
an imported function and an exported function.  The exported function calls the
imported function, which is implemented by the host.  At runtime, the fuzz test
selects a test case at random and feeds it zero or more sets of arbitrary
parameters and results, checking that values which flow host-to-guest and
guest-to-host make the transition unchanged.

The fuzz test for the dynamic API follows a similar pattern, the only difference
being that test cases are generated at runtime.

Signed-off-by: Joel Dice <joel.dice@fermyon.com>
This commit is contained in:
Joel Dice
2022-08-04 11:02:55 -06:00
committed by GitHub
parent ad223c5234
commit ed8908efcf
29 changed files with 1963 additions and 266 deletions

View File

@@ -9,6 +9,8 @@ publish = false
cargo-fuzz = true
[dependencies]
anyhow = { version = "1.0.19" }
arbitrary = { version = "1.1.0", features = ["derive"] }
cranelift-codegen = { path = "../cranelift/codegen" }
cranelift-reader = { path = "../cranelift/reader" }
cranelift-wasm = { path = "../cranelift/wasm" }
@@ -19,6 +21,16 @@ libfuzzer-sys = "0.4.0"
target-lexicon = "0.12"
wasmtime = { path = "../crates/wasmtime" }
wasmtime-fuzzing = { path = "../crates/fuzzing" }
component-test-util = { path = "../crates/misc/component-test-util" }
component-fuzz-util = { path = "../crates/misc/component-fuzz-util" }
[build-dependencies]
anyhow = "1.0.19"
proc-macro2 = "1.0"
arbitrary = { version = "1.1.0", features = ["derive"] }
rand = { version = "0.8.0" }
quote = "1.0"
component-fuzz-util = { path = "../crates/misc/component-fuzz-util" }
[features]
default = ['fuzz-spec-interpreter']
@@ -102,3 +114,9 @@ name = "instantiate-many"
path = "fuzz_targets/instantiate-many.rs"
test = false
doc = false
[[bin]]
name = "component_api"
path = "fuzz_targets/component_api.rs"
test = false
doc = false