Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[NFC] Make fuzzing params mutable #7257

Merged
merged 8 commits into from
Feb 4, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/tools/CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ FILE(GLOB fuzzing_HEADERS fuzzing/*h)
set(fuzzing_SOURCES
fuzzing/fuzzing.cpp
fuzzing/heap-types.cpp
fuzzing/parameters.cpp
fuzzing/random.cpp
${fuzzing_HEADERS}
)
Expand Down
86 changes: 80 additions & 6 deletions src/tools/fuzzing.h
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,6 @@
// This is helpful for fuzzing.
//

/*
high chance for set at start of loop
high chance of get of a set local in the scope of that scope
high chance of a tee in that case => loop var
*/

#include "ir/branch-utils.h"
#include "ir/struct-utils.h"
#include "support/insert_ordered.h"
Expand Down Expand Up @@ -61,9 +55,68 @@ struct BinaryArgs {
Expression* c;
};

// params

struct FuzzParams {
// The maximum amount of params to each function.
int MAX_PARAMS;

// The maximum amount of vars in each function.
int MAX_VARS;

// The maximum number of globals in a module.
int MAX_GLOBALS;

// The maximum number of tuple elements.
int MAX_TUPLE_SIZE;

// The maximum number of struct fields.
int MAX_STRUCT_SIZE;

// The maximum number of elements in an array.
int MAX_ARRAY_SIZE;

// The number of nontrivial heap types to generate.
int MIN_HEAPTYPES;
int MAX_HEAPTYPES;

// some things require luck, try them a few times
int TRIES;

// beyond a nesting limit, greatly decrease the chance to continue to nest
int NESTING_LIMIT;

// the maximum size of a block
int BLOCK_FACTOR;

// the memory that we use, a small portion so that we have a good chance of
// looking at writes (we also look outside of this region with small
// probability) this should be a power of 2
Address USABLE_MEMORY;

// the number of runtime iterations (function calls, loop backbranches) we
// allow before we stop execution with a trap, to prevent hangs. 0 means
// no hang protection.
int HANG_LIMIT;

// the maximum amount of new GC types (structs, etc.) to create
int MAX_NEW_GC_TYPES;

// the maximum amount of catches in each try (not including a catch-all, if
// present).
int MAX_TRY_CATCHES;

FuzzParams() { setDefaults(); }

void setDefaults();
};

// main reader

class TranslateToFuzzReader {
static constexpr size_t VeryImportant = 4;
static constexpr size_t Important = 2;

public:
TranslateToFuzzReader(Module& wasm,
std::vector<char>&& input,
Expand Down Expand Up @@ -179,6 +232,27 @@ class TranslateToFuzzReader {

FunctionCreationContext* funcContext = nullptr;

// The fuzzing parameters we use. This may change from function to function or
// even in a more refined manner, so we use an RAII context to manage it.
struct FuzzParamsContext : public FuzzParams {
TranslateToFuzzReader& parent;

FuzzParamsContext* old;

FuzzParamsContext(TranslateToFuzzReader& parent)
: parent(parent), old(parent.fuzzParams) {
parent.fuzzParams = this;
}

~FuzzParamsContext() { parent.fuzzParams = old; }
};

FuzzParamsContext* fuzzParams = nullptr;

// The default global context we use throughout the process (unless it is
// overridden using another context in an RAII manner).
std::unique_ptr<FuzzParamsContext> globalParams;

public:
int nesting = 0;

Expand Down
Loading