Skip to content

Commit 1d0b1d6

Browse files
Add fuzzing support for relaxed atomics (#8253)
Part of #8165. We already don't run v8 fuzz handlers for relaxed atomics ([link](https://github.com/WebAssembly/binaryen/blob/660166319b6cdb255b5dbc3d2a3ef3e9c0a00ad3/scripts/fuzz_opt.py#L68)) since this feature isn't implemented in V8 yet. To test, ran `fuzz_opt.py` for ~1 hour with no failures.
1 parent 6601663 commit 1d0b1d6

File tree

3 files changed

+47
-43
lines changed

3 files changed

+47
-43
lines changed

src/tools/fuzzing.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -276,6 +276,8 @@ class TranslateToFuzzReader {
276276
// overridden using another context in an RAII manner).
277277
std::unique_ptr<FuzzParamsContext> globalParams;
278278

279+
std::vector<MemoryOrder> atomicMemoryOrders;
280+
279281
public:
280282
int nesting = 0;
281283

src/tools/fuzzing/fuzzing.cpp

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ TranslateToFuzzReader::TranslateToFuzzReader(Module& wasm,
3636
random(std::move(input), wasm.features),
3737
publicTypeValidator(wasm.features) {
3838

39+
atomicMemoryOrders = wasm.features.hasRelaxedAtomics()
40+
? std::vector{MemoryOrder::AcqRel, MemoryOrder::SeqCst}
41+
: std::vector{MemoryOrder::SeqCst};
42+
3943
haveInitialFunctions = !wasm.functions.empty();
4044

4145
// - funcref cannot be logged because referenced functions can be inlined or
@@ -3239,7 +3243,7 @@ Expression* TranslateToFuzzReader::makeLoad(Type type) {
32393243
// make it atomic
32403244
auto* load = ret->cast<Load>();
32413245
wasm.memories[0]->shared = true;
3242-
load->order = MemoryOrder::SeqCst;
3246+
load->order = pick(atomicMemoryOrders);
32433247
load->signed_ = false;
32443248
load->align = load->bytes;
32453249
return load;
@@ -3358,7 +3362,7 @@ Expression* TranslateToFuzzReader::makeStore(Type type) {
33583362
}
33593363
// make it atomic
33603364
wasm.memories[0]->shared = true;
3361-
store->order = MemoryOrder::SeqCst;
3365+
store->order = pick(atomicMemoryOrders);
33623366
store->align = store->bytes;
33633367
return store;
33643368
}
@@ -4771,7 +4775,7 @@ Expression* TranslateToFuzzReader::makeAtomic(Type type) {
47714775
value,
47724776
type,
47734777
wasm.memories[0]->name,
4774-
MemoryOrder::SeqCst);
4778+
pick(atomicMemoryOrders));
47754779
} else {
47764780
auto* expected = make(type);
47774781
auto* replacement = make(type);
@@ -4782,7 +4786,7 @@ Expression* TranslateToFuzzReader::makeAtomic(Type type) {
47824786
replacement,
47834787
type,
47844788
wasm.memories[0]->name,
4785-
MemoryOrder::SeqCst);
4789+
pick(atomicMemoryOrders));
47864790
}
47874791
}
47884792

Lines changed: 37 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,51 +1,49 @@
11
Metrics
22
total
3-
[exports] : 13
4-
[funcs] : 11
3+
[exports] : 15
4+
[funcs] : 13
55
[globals] : 26
66
[imports] : 10
77
[memories] : 1
88
[memory-data] : 16
99
[table-data] : 5
1010
[tables] : 2
1111
[tags] : 1
12-
[total] : 548
13-
[vars] : 32
14-
ArrayNewFixed : 7
15-
AtomicRMW : 1
12+
[total] : 459
13+
[vars] : 50
14+
ArrayNewFixed : 9
15+
AtomicCmpxchg : 1
16+
AtomicNotify : 1
1617
Binary : 25
17-
Block : 81
18-
BrOn : 1
19-
Break : 7
20-
Call : 18
21-
CallIndirect : 3
18+
Block : 68
19+
Break : 2
20+
Call : 14
21+
CallIndirect : 2
2222
CallRef : 1
23-
Const : 128
24-
Drop : 3
25-
GlobalGet : 47
26-
GlobalSet : 36
27-
If : 24
28-
Load : 4
29-
LocalGet : 19
30-
LocalSet : 13
31-
Loop : 7
32-
Nop : 5
33-
RefEq : 3
34-
RefFunc : 9
35-
RefI31 : 3
36-
RefNull : 5
37-
Return : 6
38-
SIMDExtract : 2
39-
Select : 4
40-
Store : 2
41-
StringConst : 9
42-
StringEq : 1
43-
StringWTF16Get : 1
23+
Const : 104
24+
Drop : 2
25+
GlobalGet : 44
26+
GlobalSet : 32
27+
If : 21
28+
Load : 5
29+
LocalGet : 15
30+
LocalSet : 7
31+
Loop : 3
32+
Nop : 6
33+
Pop : 3
34+
RefEq : 2
35+
RefFunc : 8
36+
RefI31 : 1
37+
RefNull : 3
38+
Return : 7
39+
SIMDExtract : 3
40+
Select : 1
41+
StringConst : 6
42+
StringMeasure : 2
4443
StructNew : 4
45-
TableSet : 1
46-
Throw : 2
47-
TryTable : 4
48-
TupleExtract : 2
49-
TupleMake : 15
50-
Unary : 27
51-
Unreachable : 18
44+
Try : 3
45+
TryTable : 3
46+
TupleExtract : 1
47+
TupleMake : 11
48+
Unary : 23
49+
Unreachable : 16

0 commit comments

Comments
 (0)