Skip to content

Commit d38ddda

Browse files
authored
Fuzzer: Do not emit random global.get/sets of the hang limit global (#3229)
That global is for internal use. If we emit random sets to it, we could prevent it from doing its job of preventing an infinite loop (normally it decreases each time a loop runs or we recurse, until we reach 0 - if we set it to a nonzero value in that code, that would be bad). Random gets are less of a problem, but may be confusing when debugging a testcase.
1 parent 9d6413c commit d38ddda

File tree

3 files changed

+555
-126
lines changed

3 files changed

+555
-126
lines changed

src/tools/fuzzing.h

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1261,12 +1261,21 @@ class TranslateToFuzzReader {
12611261
}
12621262
}
12631263

1264+
// Some globals are for internal use, and should not be modified by random
1265+
// fuzz code.
1266+
bool isValidGlobal(Name name) { return name != HANG_LIMIT_GLOBAL; }
1267+
12641268
Expression* makeGlobalGet(Type type) {
12651269
auto it = globalsByType.find(type);
12661270
if (it == globalsByType.end() || it->second.empty()) {
12671271
return makeConst(type);
12681272
}
1269-
return builder.makeGlobalGet(pick(it->second), type);
1273+
auto name = pick(it->second);
1274+
if (isValidGlobal(name)) {
1275+
return builder.makeGlobalGet(name, type);
1276+
} else {
1277+
return makeTrivial(type);
1278+
}
12701279
}
12711280

12721281
Expression* makeGlobalSet(Type type) {
@@ -1276,8 +1285,12 @@ class TranslateToFuzzReader {
12761285
if (it == globalsByType.end() || it->second.empty()) {
12771286
return makeTrivial(Type::none);
12781287
}
1279-
auto* value = make(type);
1280-
return builder.makeGlobalSet(pick(it->second), value);
1288+
auto name = pick(it->second);
1289+
if (isValidGlobal(name)) {
1290+
return builder.makeGlobalSet(name, make(type));
1291+
} else {
1292+
return makeTrivial(Type::none);
1293+
}
12811294
}
12821295

12831296
Expression* makeTupleMake(Type type) {
Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,30 @@
11
total
22
[events] : 0
3-
[exports] : 69
4-
[funcs] : 101
3+
[exports] : 18
4+
[funcs] : 22
55
[globals] : 7
66
[imports] : 4
77
[memory-data] : 4
8-
[table-data] : 39
9-
[total] : 7276
10-
[vars] : 287
11-
binary : 555
12-
block : 1075
13-
break : 250
14-
call : 433
15-
call_indirect : 75
16-
const : 1310
17-
drop : 111
18-
global.get : 606
19-
global.set : 263
20-
if : 415
21-
load : 137
22-
local.get : 465
23-
local.set : 364
24-
loop : 166
25-
nop : 110
26-
return : 300
27-
select : 46
28-
store : 61
29-
unary : 531
30-
unreachable : 3
8+
[table-data] : 9
9+
[total] : 4993
10+
[vars] : 58
11+
binary : 397
12+
block : 736
13+
break : 204
14+
call : 173
15+
call_indirect : 32
16+
const : 823
17+
drop : 42
18+
global.get : 421
19+
global.set : 190
20+
if : 292
21+
load : 95
22+
local.get : 392
23+
local.set : 297
24+
loop : 146
25+
nop : 97
26+
return : 189
27+
select : 39
28+
store : 55
29+
switch : 1
30+
unary : 372

0 commit comments

Comments
 (0)