Skip to content

Commit c6695c2

Browse files
LiedtkeV8-internal LUCI CQ
Liedtke
authored and
V8-internal LUCI CQ
committed
[wasm] remove confusing ProgramBuilder.addWasmFunction overload
Since wasm functions support implicit fall-through of values and multiple return values, the old overload is not supposed to be used as it inserts random magic to provide input values for the EndWasmFunction operation. Change-Id: Ib9579a70812325db2dbe41d3881057eb5776c3d4 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8465496 Reviewed-by: Manos Koukoutos <[email protected]> Auto-Submit: Matthias Liedtke <[email protected]> Commit-Queue: Matthias Liedtke <[email protected]>
1 parent e7e9699 commit c6695c2

File tree

9 files changed

+284
-314
lines changed

9 files changed

+284
-314
lines changed

‎Sources/Fuzzilli/Base/ProgramBuilder.swift

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3840,17 +3840,6 @@ public class ProgramBuilder {
38403840
}
38413841

38423842
// TODO: distinguish between exported and non-exported functions
3843-
@discardableResult
3844-
public func addWasmFunction(with signature: WasmSignature, _ body: (WasmFunction, [Variable]) -> ()) -> Variable {
3845-
let instr = b.emit(BeginWasmFunction(signature: signature))
3846-
// Ignore the label in this overload.
3847-
body(currentWasmFunction, Array(instr.innerOutputs.dropFirst()))
3848-
// TODO(mliedtke): Ideally we'd replace all overloads of this function to the new one
3849-
// expecting explicit return values.
3850-
let results = signature.outputTypes.map {b.randomVariable(ofType: $0) ?? currentWasmFunction.generateRandomWasmVar(ofType: $0)!}
3851-
return b.emit(EndWasmFunction(signature: signature), withInputs: results).output
3852-
}
3853-
38543843
@discardableResult
38553844
public func addWasmFunction(with signature: WasmSignature, _ body: (WasmFunction, Variable, [Variable]) -> [Variable]) -> Variable {
38563845
let instr = b.emit(BeginWasmFunction(signature: signature))

‎Sources/Fuzzilli/CodeGen/ProgramTemplates.swift

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ public let ProgramTemplates = [
105105
let wrapped = b.wrapSuspending(function: f!)
106106

107107
let m = b.buildWasmModule { mod in
108-
mod.addWasmFunction(with: [] => []) { fbuilder, _ in
108+
mod.addWasmFunction(with: [] => []) { fbuilder, _, _ in
109109
// This will create a bunch of locals, which should create large (>4KB) frames.
110110
if probability(0.02) {
111111
for _ in 0..<1000 {
@@ -120,6 +120,7 @@ public let ProgramTemplates = [
120120
fbuilder.wasmJsCall(function: wrapped, withArgs: args, withWasmSignature: wasmSignature)
121121
}
122122
b.build(n: 4)
123+
return []
123124
}
124125
if probability(0.2) {
125126
b.build(n: 20)
@@ -156,7 +157,7 @@ public let ProgramTemplates = [
156157
let module = b.buildWasmModule { wasmModule in
157158
// Wasm function that throws a tag, catches a tag (the same or a different one) to
158159
// rethrow it again (or another exnref if present).
159-
wasmModule.addWasmFunction(with: [] => []) { function, args in
160+
wasmModule.addWasmFunction(with: [] => []) { function, label, args in
160161
b.build(n: 10)
161162
let caughtValues = function.wasmBuildBlockWithResults(with: [] => catchBlockOutputTypes, args: []) { catchRefLabel, _ in
162163
// TODO(mliedtke): We should probably allow mutations of try_tables to make
@@ -173,6 +174,7 @@ public let ProgramTemplates = [
173174
}
174175
b.build(n: 10)
175176
function.wasmBuildThrowRef(exception: b.randomVariable(ofType: .wasmExnRef)!)
177+
return []
176178
}
177179
}
178180

‎Sources/Fuzzilli/FuzzIL/TypeSystem.swift

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1914,8 +1914,8 @@ public struct Signature: Hashable, CustomStringConvertible {
19141914
}
19151915

19161916
public struct WasmSignature: Hashable, CustomStringConvertible {
1917-
let parameterTypes: [ILType]
1918-
let outputTypes: [ILType]
1917+
public let parameterTypes: [ILType]
1918+
public let outputTypes: [ILType]
19191919

19201920
init(expects parameters: [ILType], returns returnTypes: [ILType]) {
19211921
self.parameterTypes = parameters

‎Sources/FuzzilliCli/Profiles/V8Profile.swift

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -499,16 +499,17 @@ fileprivate let WasmFastCallFuzzer = WasmProgramTemplate("WasmFastCallFuzzer") {
499499
let m = b.buildWasmModule { m in
500500
let allWasmTypes: WeightedList<ILType> = WeightedList([(.wasmi32, 1), (.wasmi64, 1), (.wasmf32, 1), (.wasmf64, 1), (.wasmExternRef, 1), (.wasmFuncRef, 1)])
501501
let wasmSignature = ProgramBuilder.convertJsSignatureToWasmSignature(wrappedSig, availableTypes: allWasmTypes)
502-
m.addWasmFunction(with: wasmSignature) {fbuilder, _ in
502+
m.addWasmFunction(with: wasmSignature) {fbuilder, _, _ in
503503
let args = b.randomWasmArguments(forWasmSignature: wasmSignature)
504504
if let args {
505505
let maybeRet = fbuilder.wasmJsCall(function: wrapped, withArgs: args, withWasmSignature: wasmSignature)
506506
if let ret = maybeRet {
507-
fbuilder.wasmReturn(ret)
507+
return [ret]
508508
}
509509
} else {
510510
logger.error("Arguments should have been generated")
511511
}
512+
return wasmSignature.outputTypes.map(fbuilder.findOrGenerateWasmVar)
512513
}
513514
}
514515

‎Tests/FuzzilliTests/JSTyperTests.swift

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1226,7 +1226,7 @@ class JSTyperTests: XCTestCase {
12261226
let b = fuzzer.makeBuilder()
12271227

12281228
b.buildWasmModule { m in
1229-
m.addWasmFunction(with: [] => []) { f, _ in
1229+
m.addWasmFunction(with: [] => []) { f, _, _ in
12301230
let ci32 = f.consti32(1337)
12311231
let ci64 = f.consti64(1338)
12321232
let cf32 = f.constf32(13.37)
@@ -1240,6 +1240,7 @@ class JSTyperTests: XCTestCase {
12401240
XCTAssertTrue(b.type(of: ci64).Is(.wasmPrimitive))
12411241
XCTAssertTrue(b.type(of: cf32).Is(.wasmPrimitive))
12421242
XCTAssertTrue(b.type(of: cf64).Is(.wasmPrimitive))
1243+
return []
12431244
}
12441245
}
12451246
}
@@ -1546,7 +1547,7 @@ class JSTyperTests: XCTestCase {
15461547
wasmModule.addTag(parameterTypes: [.wasmi32])
15471548

15481549
// Function zero
1549-
wasmModule.addWasmFunction(with: [] => []) { function, _ in
1550+
wasmModule.addWasmFunction(with: [] => []) { function, _, _ in
15501551
// This forces an import of the wasmGlobalf64, second global
15511552
function.wasmLoadGlobal(globalVariable: wasmGlobalf64)
15521553
// This forces an import and a re-export of the jsTag.
@@ -1556,6 +1557,7 @@ class JSTyperTests: XCTestCase {
15561557
}
15571558
}
15581559
function.wasmUnreachable()
1560+
return []
15591561
}
15601562

15611563
// Function one

‎Tests/FuzzilliTests/LifterTest.swift

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3239,8 +3239,9 @@ class LifterTests: XCTestCase {
32393239
b.reassign(table, to: table)
32403240

32413241
b.buildWasmModule { m in
3242-
m.addWasmFunction(with: [] => []) { f, _ in
3242+
m.addWasmFunction(with: [] => []) { f, _, _ in
32433243
f.wasmCallIndirect(signature: [] => [], table: table, functionArgs: [], tableIndex: f.consti64(0))
3244+
return []
32443245
}
32453246
}
32463247

‎Tests/FuzzilliTests/MinimizerTest.swift

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2035,11 +2035,12 @@ class MinimizerTests: XCTestCase {
20352035
}
20362036

20372037
b.buildWasmModule { wasmModule in
2038-
wasmModule.addWasmFunction(with: [] => []) { function, _ in
2038+
wasmModule.addWasmFunction(with: [] => []) { function, _, _ in
20392039
let constOne = function.consti32(1)
20402040
evaluator.nextInstructionIsImportant(in: b)
20412041
function.wasmArrayNewDefault(arrayType: typeGroupB[1], size: constOne)
20422042
function.wasmArrayNewDefault(arrayType: typeGroupB[0], size: constOne)
2043+
return []
20432044
}
20442045
}
20452046
}
@@ -2055,9 +2056,10 @@ class MinimizerTests: XCTestCase {
20552056
}
20562057

20572058
b.buildWasmModule { wasmModule in
2058-
wasmModule.addWasmFunction(with: [] => []) { function, _ in
2059+
wasmModule.addWasmFunction(with: [] => []) { function, _, _ in
20592060
let constOne = function.consti32(1)
20602061
function.wasmArrayNewDefault(arrayType: typeGroupB[0], size: constOne)
2062+
return []
20612063
}
20622064
}
20632065
}

‎Tests/FuzzilliTests/WasmAtomicsTests.swift

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -147,40 +147,44 @@ class WasmAtomicsTests: XCTestCase {
147147
// Load operations
148148

149149
for memory in [unsharedMemory, sharedMemory] {
150-
wasmModule.addWasmFunction(with: [] => []) { f, _ in
150+
wasmModule.addWasmFunction(with: [] => []) { f, _, _ in
151151
let address = f.consti32(1) // Unaligned for 4-byte access
152152
// This should trap.
153153
f.wasmAtomicLoad(memory: memory, address: address, loadType: .i32Load, offset: 0)
154+
return []
154155
}
155156
}
156157

157158
// memory64
158159
for memory in [unsharedMemory, sharedMemory] {
159-
wasmModule.addWasmFunction(with: [] => []) { f, _ in
160+
wasmModule.addWasmFunction(with: [] => []) { f, _, _ in
160161
let address = f.consti32(4) // Unaligned for 8-byte access
161162
// This should trap.
162163
f.wasmAtomicLoad(memory: memory, address: address, loadType: .i64Load, offset: 0)
164+
return []
163165
}
164166
}
165167

166168
// Store operations
167169

168170
for memory in [unsharedMemory, sharedMemory] {
169-
wasmModule.addWasmFunction(with: [] => []) { f, _ in
171+
wasmModule.addWasmFunction(with: [] => []) { f, _, _ in
170172
let address = f.consti32(2) // Unaligned for 4-byte access
171173
// This should trap.
172174
let value = f.consti32(0x1337)
173175
f.wasmAtomicStore(memory: memory, address: address, value: value, storeType: .i32Store, offset: 0)
176+
return []
174177
}
175178
}
176179

177180
// memory64
178181
for memory in [unsharedMemory, sharedMemory] {
179-
wasmModule.addWasmFunction(with: [] => []) { f, _ in
182+
wasmModule.addWasmFunction(with: [] => []) { f, _, _ in
180183
let address = f.consti32(7) // Unaligned for 8-byte access
181184
// This should trap.
182185
let value = f.consti64(0xDEADBEEF)
183186
f.wasmAtomicStore(memory: memory, address: address, value: value, storeType: .i64Store, offset: 0)
187+
return []
184188
}
185189
}
186190
}

0 commit comments

Comments
 (0)