[wasm] Do not treat wasm throw exceptions inside LiveTests as failures

The test case testWasmCodeGenerationAndCompilationAndExecution treats a
wasm program that throws an exception as a failure and expects this
failure rate to remain below a certain threshold. With the exception-
handling proposal (https://github.com/WebAssembly/exception-handling)
wasm adds support for deliberately throwing exceptions.

As these should also be fuzzed, generating a throw should not be
treated as a failure by this test case.

This change handles this by wrapping the call to the exported wasm
function like this:
  try {
    instance.exports.w0();
  } catch (e) {
    if (!(e instance of WebAssembly.Exception)) rethrow e;
  }

Still, this highlights the issue of many wasm programs throwing an
unconditional exception, so the weight to generate a throw inside wasm
is now significantly lowered as well. (The same does not apply to a
rethrow as a rethrow is only reachable when such a "low chance" throw
was already emitted, so keeping that higher prevents us from making it
exceedingly rare to cover rethrow edges.)

Change-Id: I17c270edd87aa7d8af97efa1eb6eaded420e9a8f
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/7963393
Auto-Submit: Matthias Liedtke <[email protected]>
Reviewed-by: Carl Smith <[email protected]>
Commit-Queue: Matthias Liedtke <[email protected]>

Author: Liedtke

Sources/Fuzzilli/CodeGen/CodeGeneratorWeights.swift

@@ -275,8 +275,8 @@ public let codeGeneratorWeights = [
     "WasmLegacyTryGenerator":                   8,
     "WasmLegacyCatchGenerator":                 8,
     "WasmLegacyTryDelegateGenerator":           8,
-    "WasmThrowGenerator":                       8,
-    "WasmRethrowGenerator":                     8,
+    "WasmThrowGenerator":                       2,
+    "WasmRethrowGenerator":                     10,
     "WasmBranchGenerator":                      10,
     "WasmBranchIfGenerator":                    10,
     "WasmJsCallGenerator":                      30,

Tests/FuzzilliTests/LiveTests.swift

@@ -45,7 +45,7 @@ class LiveTests: XCTestCase {
             }
             // Make at least one Wasm global available
             b.createWasmGlobal(value: .wasmi32(1337), isMutable: true)
-            // Make at laest one Wasm tag of each kind available.
+            // Make at least one Wasm tag of each kind available.
             b.createWasmJSTag()
             b.createWasmTag(parameterTypes: [.wasmi32, .wasmf64])
 
@@ -72,7 +72,7 @@ class LiveTests: XCTestCase {
             }
             // Make at least one Wasm global available
             b.createWasmGlobal(value: .wasmi32(1337), isMutable: true)
-            // Make at laest one Wasm tag of each kind available.
+            // Make at least one Wasm tag of each kind available.
             b.createWasmJSTag()
             b.createWasmTag(parameterTypes: [.wasmi32, .wasmf64])
 
@@ -84,18 +84,28 @@ class LiveTests: XCTestCase {
                 }
             }
 
-            b.callMethod(m.getExportedMethod(at: 0), on: m.loadExports())
+            // The wasm exception handling proposal contains instructions to deliberately trigger
+            // exceptions. Catch these exceptions here to not treat them as test failures.
+            b.buildTryCatchFinally {
+                b.callMethod(m.getExportedMethod(at: 0), on: m.loadExports())
+            } catchBody: { exception in
+                let wasmGlobal = b.createNamedVariable(forBuiltin: "WebAssembly")
+                let wasmException = b.getProperty("Exception", of: wasmGlobal)
+                b.buildIf(b.unary(.LogicalNot, b.testInstanceOf(exception, wasmException))) {
+                    b.throwException(exception)
+                }
+            }
         }
 
         // TODO(cffsmith): Try to lower this
-        // We expect a maximum of 50% of Wasm execution attempts to fail
-        checkFailureRate(testResults: results, maxFailureRate: 0.50)
+        // We expect a maximum of 25% of Wasm execution attempts to fail.
+        checkFailureRate(testResults: results, maxFailureRate: 0.25)
     }
 
     // The closure can use the ProgramBuilder to emit a program of a specific
     // shape that is then executed with the given runner. We then check that
     // we stay below the maximum failure rate over the given number of iterations.
-    static func runLiveTest(iterations n: Int = 250, withRunner runner: JavaScriptExecutor, body: (inout ProgramBuilder) -> Void) throws -> (failureRate: Double, failureMessages: [String: Int]) {
+    static func runLiveTest(iterations n: Int = 250, withRunner runner: JavaScriptExecutor, body: (ProgramBuilder) -> Void) throws -> (failureRate: Double, failureMessages: [String: Int]) {
         let liveTestConfig = Configuration(logLevel: .error, enableInspection: true)
 
         // We have to use the proper JavaScriptEnvironment here.
@@ -120,9 +130,9 @@ class LiveTests: XCTestCase {
         var results = [ExecutionResult?](repeating: nil, count: n)
 
         for _ in 0..<n {
-            var b = fuzzer.makeBuilder()
+            let b = fuzzer.makeBuilder()
 
-            body(&b)
+            body(b)
 
             let program = b.finalize()
             let jsProgram = fuzzer.lifter.lift(program)