b73b831892
This commit removes the binaryen support for fuzzing from wasmtime, instead switching over to `wasm-smith`. In general it's great to have what fuzzing we can, but our binaryen support suffers from a few issues: * The Rust crate, binaryen-sys, seems largely unmaintained at this point. While we could likely take ownership and/or send PRs to update the crate it seems like the maintenance is largely on us at this point. * Currently the binaryen-sys crate doesn't support fuzzing anything beyond MVP wasm, but we're interested at least in features like bulk memory and reference types. Additionally we'll also be interested in features like module-linking. New features would require either implementation work in binaryen or the binaryen-sys crate to support. * We have 4-5 fuzz-bugs right now related to timeouts simply in generating a module for wasmtime to fuzz. One investigation along these lines in the past revealed a bug in binaryen itself, and in any case these bugs would otherwise need to get investigated, reported, and possibly fixed ourselves in upstream binaryen. Overall I'm not sure at this point if maintaining binaryen fuzzing is worth it with the advent of `wasm-smith` which has similar goals for wasm module generation, but is much more readily maintainable on our end. Additonally in this commit I've added a fuzzer for wasm-smith's `SwarmConfig`-based fuzzer which should expand the coverage of tested modules. Closes #2163
15 lines
347 B
Rust
15 lines
347 B
Rust
#![no_main]
|
|
|
|
use libfuzzer_sys::fuzz_target;
|
|
use wasmtime_fuzzing::{generators, oracles};
|
|
|
|
fuzz_target!(|data: (
|
|
generators::DifferentialConfig,
|
|
generators::DifferentialConfig,
|
|
wasm_smith::Module,
|
|
)| {
|
|
let (lhs, rhs, mut wasm) = data;
|
|
wasm.ensure_termination(1000);
|
|
oracles::differential_execution(&wasm, &[lhs, rhs]);
|
|
});
|