10dbb19983
* Improve wasmi differential fuzzer * Support modules with a `start` function * Implement trap-matching to ensure that wasmi and Wasmtime both report the same flavor of trap. * Support differential fuzzing where no engines match Locally I was attempting to run against just one wasm engine with `ALLOWED_ENGINES=wasmi` but the fuzzer quickly panicked because the generated test case didn't match wasmi's configuration. This commit updates engine-selection in the differential fuzzer to return `None` if no engine is applicable, throwing out the test case. This won't be hit at all with oss-fuzz-based runs but for local runs it'll be useful to have. * Improve proposal support in differential fuzzer * De-prioritize unstable wasm proposals such as multi-memory and memory64 by making them more unlikely with `Unstructured::ratio`. * Allow fuzzing multi-table (reference types) and multi-memory by avoiding setting their maximums to 1 in `set_differential_config`. * Update selection of the pooling strategy to unconditionally support the selected module config rather than the other way around. * Improve handling of traps in differential fuzzing This commit fixes an issue found via local fuzzing where engines were reporting different results but the underlying reason for this was that one engine was hitting stack overflow before the other. To fix the underlying issue I updated the execution to check for stack overflow and, if hit, it discards the entire fuzz test case from then on. The rationale behind this is that each engine can have unique limits for stack overflow. One test case I was looking at for example would stack overflow at less than 1000 frames with epoch interruption enabled but would stack overflow at more than 1000 frames with it disabled. This means that the state after the trap started to diverge and it looked like the engines produced different results. While I was at it I also improved the "function call returned a trap" case to compare traps to make sure the same trap reason popped out. * Fix fuzzer tests
68 lines
2.2 KiB
Rust
68 lines
2.2 KiB
Rust
//! Generate a Wasm module and the configuration for generating it.
|
|
|
|
use arbitrary::{Arbitrary, Unstructured};
|
|
use wasm_smith::SwarmConfig;
|
|
|
|
/// Default module-level configuration for fuzzing Wasmtime.
|
|
///
|
|
/// Internally this uses `wasm-smith`'s own `SwarmConfig` but we further refine
|
|
/// the defaults here as well.
|
|
#[derive(Debug, Clone)]
|
|
pub struct ModuleConfig {
|
|
#[allow(missing_docs)]
|
|
pub config: SwarmConfig,
|
|
}
|
|
|
|
impl<'a> Arbitrary<'a> for ModuleConfig {
|
|
fn arbitrary(u: &mut Unstructured<'a>) -> arbitrary::Result<ModuleConfig> {
|
|
let mut config = SwarmConfig::arbitrary(u)?;
|
|
|
|
// Allow multi-memory but make it unlikely
|
|
if u.ratio(1, 20)? {
|
|
config.max_memories = config.max_memories.max(2);
|
|
} else {
|
|
config.max_memories = 1;
|
|
}
|
|
|
|
// Allow multi-table by default.
|
|
if config.reference_types_enabled {
|
|
config.max_tables = config.max_tables.max(4);
|
|
}
|
|
|
|
// Allow enabling some various wasm proposals by default. Note that
|
|
// these are all unconditionally turned off even with
|
|
// `SwarmConfig::arbitrary`.
|
|
config.memory64_enabled = u.ratio(1, 20)?;
|
|
|
|
// Allow the threads proposal if memory64 is not already enabled. FIXME:
|
|
// to allow threads and memory64 to coexist, see
|
|
// https://github.com/bytecodealliance/wasmtime/issues/4267.
|
|
config.threads_enabled = !config.memory64_enabled && u.ratio(1, 20)?;
|
|
|
|
Ok(ModuleConfig { config })
|
|
}
|
|
}
|
|
|
|
impl ModuleConfig {
|
|
/// Uses this configuration and the supplied source of data to generate a
|
|
/// Wasm module.
|
|
///
|
|
/// If a `default_fuel` is provided, the resulting module will be configured
|
|
/// to ensure termination; as doing so will add an additional global to the
|
|
/// module, the pooling allocator, if configured, must also have its globals
|
|
/// limit updated.
|
|
pub fn generate(
|
|
&self,
|
|
input: &mut Unstructured<'_>,
|
|
default_fuel: Option<u32>,
|
|
) -> arbitrary::Result<wasm_smith::Module> {
|
|
let mut module = wasm_smith::Module::new(self.config.clone(), input)?;
|
|
|
|
if let Some(default_fuel) = default_fuel {
|
|
module.ensure_termination(default_fuel);
|
|
}
|
|
|
|
Ok(module)
|
|
}
|
|
}
|