Skip to content

[WIP] Generate memory.atomic.wait with a 0 timeout in fuzzer #9170

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
stevenfontanella wants to merge 1 commit into
base: main
Choose a base branch
from
+129 −92
Draft

[WIP] Generate memory.atomic.wait with a 0 timeout in fuzzer #9170

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 44 additions & 9 deletions src/tools/fuzzing/fuzzing.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1905,14 +1905,44 @@ void TranslateToFuzzReader::addHangLimitChecks(Function* func) {
}
}
if (!ATOMIC_WAITS) {
for (auto* wait : FindAll<StructWait>(func->body).list) {
if (auto* c = wait->timeout->dynCast<Const>()) {
c->value = Literal(int64_t(0));
} else if (wait->timeout->type == Type::i64) {
wait->timeout = builder.makeSequence(builder.makeDrop(wait->timeout),
builder.makeConst(int64_t(0)));
struct Visitor : PostWalker<Visitor, UnifiedExpressionVisitor<Visitor>> {
Builder& builder;
Visitor(Builder& builder) : builder(builder) {}

void visitExpression(Expression* curr) {
if (auto* atomicWait = curr->dynCast<AtomicWait>()) {
zeroTimeout(&atomicWait->timeout);
} else if (auto* structWait = curr->dynCast<StructWait>()) {
zeroTimeout(&structWait->timeout);
}
}
}

private:
void zeroTimeout(Expression** timeout) {
if ((*timeout)->dynCast<Const>()) {
*timeout = builder.makeConst(int64_t(0));
} else if ((*timeout)->type == Type::i64) {
*timeout = builder.makeSequence(builder.makeDrop(*timeout),
builder.makeConst(int64_t{0}));
}
}
} v(builder);
v.walk(func->body);

// auto zeroTimeout = [&](auto* wait) {
// if (auto* c = wait->timeout->template dynCast<Const>()) {
// c->value = Literal(int64_t(0));
// } else if (wait->timeout->type == Type::i64) {
// wait->timeout = builder.makeSequence(builder.makeDrop(wait->timeout),
// builder.makeConst(int64_t(0)));
// }
// };
// for (auto* wait : FindAll<AtomicWait>(func->body).list) {
// zeroTimeout(wait);
// }
// for (auto* wait : FindAll<StructWait>(func->body).list) {
// zeroTimeout(wait);
// }
}
}

Expand Down Expand Up @@ -5292,11 +5322,16 @@ Expression* TranslateToFuzzReader::makeAtomic(Type type) {
return builder.makeAtomicFence(pick(atomicMemoryOrders));
}
if (type == Type::i32 && oneIn(2)) {
if (ATOMIC_WAITS && oneIn(2)) {
if (oneIn(2)) {
auto* ptr = makePointer();
auto expectedType = pick(Type::i32, Type::i64);
auto* expected = make(expectedType);
auto* timeout = make(Type::i64);
Expression* timeout = nullptr;
if (ATOMIC_WAITS && oneIn(2)) {
timeout = make(Type::i64);
} else {
timeout = builder.makeConst(int64_t{0});
}
return builder.makeAtomicWait(ptr,
expected,
timeout,
Expand Down
168 changes: 85 additions & 83 deletions test/passes/translate-to-fuzz_all-features_metrics_noprint.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,94 +1,96 @@
Metrics
total
[exports] : 109
[funcs] : 205
[exports] : 78
[funcs] : 154
[globals] : 22
[imports] : 15
[memories] : 1
[memory-data] : 31
[table-data] : 66
[table-data] : 38
[tables] : 2
[tags] : 2
[total] : 111414
[vars] : 4479
ArrayCmpxchg : 15
ArrayCopy : 47
ArrayFill : 34
ArrayGet : 481
ArrayLen : 642
ArrayNew : 2316
ArrayNewFixed : 672
[total] : 86022
[vars] : 3960
ArrayCmpxchg : 13
ArrayCopy : 41
ArrayFill : 35
ArrayGet : 362
ArrayLen : 511
ArrayNew : 1565
ArrayNewFixed : 451
ArrayRMW : 13
ArraySet : 77
AtomicCmpxchg : 49
AtomicFence : 75
AtomicNotify : 41
AtomicRMW : 43
Binary : 5029
Block : 6507
BrOn : 293
Break : 1012
Call : 866
CallIndirect : 250
CallRef : 259
Const : 17289
ContBind : 1
ContNew : 193
DataDrop : 9
Drop : 580
GlobalGet : 5513
GlobalSet : 2079
I31Get : 75
If : 2566
Load : 313
LocalGet : 11499
LocalSet : 3978
Loop : 834
MemoryCopy : 27
MemoryFill : 18
MemoryInit : 23
Nop : 784
RefAs : 9921
RefCast : 703
RefEq : 291
RefFunc : 2029
RefGetDesc : 79
RefI31 : 796
RefIsNull : 69
RefNull : 11791
RefTest : 59
Return : 389
SIMDExtract : 132
SIMDLoad : 2
SIMDShift : 1
SIMDShuffle : 1
Select : 312
Store : 142
StringConcat : 3
StringConst : 400
StringEncode : 70
StringEq : 69
StringMeasure : 70
StringNew : 10
ArraySet : 59
AtomicCmpxchg : 37
AtomicFence : 52
AtomicNotify : 12
AtomicRMW : 28
AtomicWait : 12
Binary : 3807
Block : 5541
BrOn : 216
Break : 826
Call : 849
CallIndirect : 77
CallRef : 165
Const : 12988
ContBind : 2
ContNew : 189
DataDrop : 14
Drop : 413
GlobalGet : 4338
GlobalSet : 1834
I31Get : 59
If : 2101
Load : 260
LocalGet : 9176
LocalSet : 3317
Loop : 760
MemoryCopy : 15
MemoryFill : 19
MemoryInit : 10
Nop : 607
RefAs : 7191
RefCast : 593
RefEq : 218
RefFunc : 1425
RefGetDesc : 68
RefI31 : 581
RefIsNull : 45
RefNull : 8399
RefTest : 53
Return : 347
SIMDExtract : 109
SIMDLoad : 1
SIMDReplace : 1
SIMDShift : 2
SIMDShuffle : 2
SIMDTernary : 3
Select : 258
Store : 111
StringConcat : 4
StringConst : 329
StringEncode : 55
StringEq : 52
StringMeasure : 45
StringNew : 6
StringSliceWTF : 1
StringWTF16Get : 55
StructCmpxchg : 57
StructGet : 442
StructNew : 13734
StructRMW : 54
StructSet : 84
StructWait : 78
Switch : 4
TableSet : 77
Throw : 87
ThrowRef : 5
Try : 410
TryTable : 477
TupleExtract : 262
TupleMake : 231
Unary : 1996
Unreachable : 1066
WaitqueueNew : 373
WaitqueueNotify: 51
StringWTF16Get : 61
StructCmpxchg : 48
StructGet : 435
StructNew : 10354
StructRMW : 48
StructSet : 64
StructWait : 53
TableSet : 55
Throw : 58
ThrowRef : 4
Try : 342
TryTable : 390
TupleExtract : 226
TupleMake : 208
Unary : 1730
Unreachable : 944
WaitqueueNew : 253
WaitqueueNotify: 49
WideIntAddSub : 16
WideIntMul : 13
WideIntMul : 11
Loading