Add wasm select instruction

Change-Id: I69614762932b78d3d05d87528439035872d3bb90
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/7963008
Auto-Submit: Matthias Liedtke <[email protected]>
Reviewed-by: Carl Smith <[email protected]>
Commit-Queue: Matthias Liedtke <[email protected]>

Author: Liedtke

Sources/Fuzzilli/Base/ProgramBuilder.swift

@@ -3328,6 +3328,11 @@ public class ProgramBuilder {
             b.emit(WasmUnreachable())
         }
 
+        @discardableResult
+        public func wasmSelect(type: ILType, on condition: Variable, trueValue: Variable, falseValue: Variable) -> Variable {
+            return b.emit(WasmSelect(type: type), withInputs: [trueValue, falseValue, condition]).output
+        }
+
         public func wasmReturn(_ returnVariable: Variable) {
             let returnType = b.type(of: returnVariable)
             b.emit(WasmReturn(returnType: returnType), withInputs: [returnVariable])

Sources/Fuzzilli/CodeGen/CodeGeneratorWeights.swift

@@ -291,4 +291,6 @@ public let codeGeneratorWeights = [
     "WasmI64x2SplatGenerator":                  10,
     "WasmI64x2ExtractLaneGenerator":            10,
     "WasmI64x2LoadSplatGenerator":              10,
+
+    "WasmSelectGenerator":                      10,
 ]

Sources/Fuzzilli/CodeGen/WasmCodeGenerators.swift

@@ -633,6 +633,16 @@ public let WasmCodeGenerators: [CodeGenerator] = [
         }
     },
 
+    CodeGenerator("WasmSelectGenerator", inContext: .wasmFunction, inputs: .required(.wasmi32)) { b, condition in
+        let function = b.currentWasmModule.currentWasmFunction
+        let supportedTypes : ILType = .wasmi32 | .wasmi64 | .wasmf32 | .wasmf64 | .wasmExternRef
+        // The condition is an i32, so we should always find at least that one as a possible input.
+        let trueValue = b.randomVariable(ofType: supportedTypes)!
+        let selectType = b.type(of: trueValue)
+        let falseValue = b.randomVariable(ofType: selectType)!
+        function.wasmSelect(type: selectType, on: condition, trueValue: trueValue, falseValue: falseValue)
+    },
+
     CodeGenerator("WasmThrowGenerator", inContext: .wasmFunction, inputs: .required(.object(ofGroup: "WasmTag"))) { b, tag in
         let function = b.currentWasmModule.currentWasmFunction
         let wasmTagType = b.type(of: tag).wasmTagType!

Sources/Fuzzilli/FuzzIL/Instruction.swift

@@ -1252,6 +1252,10 @@ extension Instruction: ProtobufConvertible {
                 fatalError("Should never be serialized")
             case .wasmUnreachable(_):
                 $0.wasmUnreachable = Fuzzilli_Protobuf_WasmUnreachable()
+            case .wasmSelect(let op):
+                $0.wasmSelect = Fuzzilli_Protobuf_WasmSelect.with {
+                    $0.type = ILTypeToWasmTypeEnum(op.type)
+                }
             case .constSimd128(let op):
                 $0.constSimd128 = Fuzzilli_Protobuf_ConstSimd128.with { $0.value = op.value.map{ UInt32($0) } }
             case .wasmSimd128IntegerUnOp(let op):
@@ -2037,6 +2041,8 @@ extension Instruction: ProtobufConvertible {
             fatalError("Should never be deserialized!")
         case .wasmUnreachable(_):
             op = WasmUnreachable()
+        case .wasmSelect(let p):
+            op = WasmSelect(type: WasmTypeEnumToILType(p.type))
         case .constSimd128(let p):
             op = ConstSimd128(value: p.value.map{ UInt8($0) })
         case .wasmSimd128IntegerUnOp(let p):

Sources/Fuzzilli/FuzzIL/Opcodes.swift

@@ -312,4 +312,5 @@ enum Opcode {
     case wasmI64x2LoadSplat(WasmI64x2LoadSplat)
 
     case wasmUnreachable(WasmUnreachable)
+    case wasmSelect(WasmSelect)
 }

Sources/Fuzzilli/FuzzIL/WasmOperations.swift

@@ -932,6 +932,19 @@ final class WasmJsCall: WasmOperation {
     }
 }
 
+final class WasmSelect: WasmOperation {
+    override var opcode: Opcode { .wasmSelect(self) }
+    let type: ILType
+
+    init(type: ILType) {
+        self.type = type
+        // Note that the condition is the third input. This is due to the lifting that pushes all
+        // inputs to the value stack in reverse order (and the select expects the condition as the
+        // first value on the stack.)
+        super.init(inputTypes: [type, type, .wasmi32], outputType: type, requiredContext: [.wasmFunction])
+    }
+}
+
 final class WasmBeginBlock: WasmOperation {
     override var opcode: Opcode { .wasmBeginBlock(self) }
 

Sources/Fuzzilli/Lifting/FuzzILLifter.swift

@@ -1069,6 +1069,9 @@ public class FuzzILLifter: Lifter {
         case .wasmUnreachable:
             w.emit("WasmUnreachable")
 
+        case .wasmSelect(let op):
+            w.emit("\(output()) <- WasmSelect[\(op.type)] \(input(2)) ? \(input(0)) : \(input(1))")
+
         case .constSimd128(let op):
             w.emit("\(output()) <- ConstSimd128 \(op.value)")
 

Sources/Fuzzilli/Lifting/JavaScriptLifter.swift

@@ -1599,6 +1599,7 @@ public class JavaScriptLifter: Lifter {
                  .wasmEndIf(_),
                  .wasmNop(_),
                  .wasmUnreachable(_),
+                 .wasmSelect(_),
                  .constSimd128(_),
                  .wasmSimd128IntegerUnOp(_),
                  .wasmSimd128IntegerBinOp(_),

Sources/Fuzzilli/Lifting/WasmLifter.swift

@@ -1436,6 +1436,8 @@ public class WasmLifter {
             return Data([0x01])
         case .wasmUnreachable(_):
             return Data([0x00])
+        case .wasmSelect(let op):
+            return Data([0x1c, 0x01]) + ILTypeMapping[op.type]!
         case .constSimd128(let op):
             return Data([0xFD]) + Leb128.unsignedEncode(12) + Data(op.value)
         case .wasmSimd128IntegerUnOp(let op):

Sources/Fuzzilli/Mutators/OperationMutator.swift

@@ -558,6 +558,7 @@ public class OperationMutator: BaseInstructionMutator {
              .wasmEndIf(_),
              .wasmNop(_),
              .wasmUnreachable(_),
+             .wasmSelect(_),
              .wasmDefineTag(_):
              assert(!instr.isOperationMutable)
              fatalError("Unexpected Operation")