Skip to content

Commit f31876f

Browse files
LiedtkeV8-internal LUCI CQ
Liedtke
authored and
V8-internal LUCI CQ
committed
[wasm] Add more simd load instructions
Note that there are even more simd load instructions (those with "extract lane") but they have different signatures, so they will need separate Fuzzilli nodes and therefore are not included in this change. Bug: chromium:391916477 Change-Id: Iab3f1be0e0c640445ec181240508c2ee0228edab Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/7988888 Reviewed-by: Carl Smith <[email protected]> Reviewed-by: Eva Herencsárová <[email protected]> Commit-Queue: Matthias Liedtke <[email protected]>
1 parent 583b81c commit f31876f

File tree

15 files changed

+269
-47
lines changed

15 files changed

+269
-47
lines changed

‎Sources/Fuzzilli/Base/ProgramBuilder.swift‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3346,9 +3346,9 @@ public class ProgramBuilder {
33463346
}
33473347

33483348
@discardableResult
3349-
public func wasmI64x2LoadSplat(memory: Variable, dynamicOffset: Variable, staticOffset: Int64) -> Variable {
3349+
func wasmSimdLoad(kind: WasmSimdLoad.Kind, memory: Variable, dynamicOffset: Variable, staticOffset: Int64) -> Variable {
33503350
let isMemory64 = b.type(of: memory).wasmMemoryType!.isMemory64
3351-
return b.emit(WasmI64x2LoadSplat(staticOffset: staticOffset, isMemory64: isMemory64), withInputs: [memory, dynamicOffset]).output
3351+
return b.emit(WasmSimdLoad(kind: kind, staticOffset: staticOffset, isMemory64: isMemory64), withInputs: [memory, dynamicOffset]).output
33523352
}
33533353
}
33543354

‎Sources/Fuzzilli/CodeGen/CodeGeneratorWeights.swift‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -292,7 +292,7 @@ public let codeGeneratorWeights = [
292292
"WasmSimd128CompareGenerator": 5,
293293
"WasmI64x2SplatGenerator": 5,
294294
"WasmI64x2ExtractLaneGenerator": 5,
295-
"WasmI64x2LoadSplatGenerator": 5,
295+
"WasmSimdLoadGenerator": 5,
296296

297297
"WasmSelectGenerator": 10,
298298
]

‎Sources/Fuzzilli/CodeGen/WasmCodeGenerators.swift‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -850,13 +850,13 @@ public let WasmCodeGenerators: [CodeGenerator] = [
850850
function.wasmI64x2ExtractLane(input, 0)
851851
},
852852

853-
CodeGenerator("WasmI64x2LoadSplatGenerator", inContext: .wasmFunction, inputs: .required(.object(ofGroup: "WasmMemory"))) { b, memory in
853+
CodeGenerator("WasmSimdLoadGenerator", inContext: .wasmFunction, inputs: .required(.object(ofGroup: "WasmMemory"))) { b, memory in
854854
if (b.hasZeroPages(memory: memory)) { return }
855855

856856
let function = b.currentWasmModule.currentWasmFunction
857857
let (dynamicOffset, staticOffset) = b.generateMemoryIndexes(forMemory: memory)
858-
859-
function.wasmI64x2LoadSplat(memory: memory, dynamicOffset: dynamicOffset, staticOffset: staticOffset)
858+
let kind = chooseUniform(from: WasmSimdLoad.Kind.allCases)
859+
function.wasmSimdLoad(kind: kind, memory: memory, dynamicOffset: dynamicOffset, staticOffset: staticOffset)
860860
},
861861

862862
// TODO: Add three generators for JSPI

‎Sources/Fuzzilli/FuzzIL/Instruction.swift‎

Lines changed: 61 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -431,6 +431,33 @@ extension Instruction: ProtobufConvertible {
431431
}
432432
}
433433

434+
func convertWasmSimdLoadKind(_ loadKind: WasmSimdLoad.Kind) -> Fuzzilli_Protobuf_WasmSimdLoadKind {
435+
switch loadKind {
436+
case .LoadS128:
437+
return .loads128
438+
case .Load8x8S:
439+
return .load8X8S
440+
case .Load8x8U:
441+
return .load8X8U
442+
case .Load16x4S:
443+
return .load16X4S
444+
case .Load16x4U:
445+
return .load16X4U
446+
case .Load32x2S:
447+
return .load32X2S
448+
case .Load32x2U:
449+
return .load32X2U
450+
case .Load8Splat:
451+
return .load8Splat
452+
case .Load16Splat:
453+
return .load16Splat
454+
case .Load32Splat:
455+
return .load32Splat
456+
case .Load64Splat:
457+
return .load64Splat
458+
}
459+
}
460+
434461
func convertWasmGlobal(wasmGlobal: WasmGlobal) -> Fuzzilli_Protobuf_WasmGlobal.OneOf_WasmGlobal {
435462
switch wasmGlobal {
436463
case .wasmi32(let val):
@@ -1303,8 +1330,9 @@ extension Instruction: ProtobufConvertible {
13031330
$0.wasmI64X2Splat = Fuzzilli_Protobuf_WasmI64x2Splat()
13041331
case .wasmI64x2ExtractLane(_):
13051332
$0.wasmI64X2ExtractLane = Fuzzilli_Protobuf_WasmI64x2ExtractLane()
1306-
case .wasmI64x2LoadSplat(let op):
1307-
$0.wasmI64X2LoadSplat = Fuzzilli_Protobuf_WasmI64x2LoadSplat.with {
1333+
case .wasmSimdLoad(let op):
1334+
$0.wasmSimdLoad = Fuzzilli_Protobuf_WasmSimdLoad.with {
1335+
$0.kind = convertWasmSimdLoadKind(op.kind)
13081336
$0.staticOffset = op.staticOffset
13091337
$0.isMemory64 = op.isMemory64
13101338
}
@@ -1421,6 +1449,35 @@ extension Instruction: ProtobufConvertible {
14211449
}
14221450
}
14231451

1452+
func convertProtoWasmSimdLoadKind(_ loadKind: Fuzzilli_Protobuf_WasmSimdLoadKind) -> WasmSimdLoad.Kind {
1453+
switch loadKind {
1454+
case .loads128:
1455+
return .LoadS128
1456+
case .load8X8S:
1457+
return .Load8x8S
1458+
case .load8X8U:
1459+
return .Load8x8U
1460+
case .load16X4S:
1461+
return .Load16x4S
1462+
case .load16X4U:
1463+
return .Load16x4U
1464+
case .load32X2S:
1465+
return .Load32x2S
1466+
case .load32X2U:
1467+
return .Load32x2U
1468+
case .load8Splat:
1469+
return .Load8Splat
1470+
case .load16Splat:
1471+
return .Load16Splat
1472+
case .load32Splat:
1473+
return .Load32Splat
1474+
case .load64Splat:
1475+
return .Load64Splat
1476+
case .UNRECOGNIZED(let i):
1477+
fatalError("Invalid WasmSimdLoadKind \(i)")
1478+
}
1479+
}
1480+
14241481
func convertWasmGlobal(_ proto: Fuzzilli_Protobuf_WasmGlobal) -> WasmGlobal {
14251482
switch proto.wasmGlobal {
14261483
case .nullref(_):
@@ -2093,8 +2150,8 @@ extension Instruction: ProtobufConvertible {
20932150
op = WasmI64x2Splat()
20942151
case .wasmI64X2ExtractLane(_):
20952152
op = WasmI64x2ExtractLane(lane: 0)
2096-
case .wasmI64X2LoadSplat(let p):
2097-
op = WasmI64x2LoadSplat(staticOffset: p.staticOffset, isMemory64: p.isMemory64)
2153+
case .wasmSimdLoad(let p):
2154+
op = WasmSimdLoad(kind: convertProtoWasmSimdLoadKind(p.kind), staticOffset: p.staticOffset, isMemory64: p.isMemory64)
20982155
}
20992156

21002157
guard op.numInputs + op.numOutputs + op.numInnerOutputs == inouts.count else {

‎Sources/Fuzzilli/FuzzIL/Opcodes.swift‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -308,7 +308,7 @@ enum Opcode {
308308
case wasmSimd128FloatBinOp(WasmSimd128FloatBinOp)
309309
case wasmI64x2Splat(WasmI64x2Splat)
310310
case wasmI64x2ExtractLane(WasmI64x2ExtractLane)
311-
case wasmI64x2LoadSplat(WasmI64x2LoadSplat)
311+
case wasmSimdLoad(WasmSimdLoad)
312312

313313
case wasmUnreachable(WasmUnreachable)
314314
case wasmSelect(WasmSelect)

‎Sources/Fuzzilli/FuzzIL/WasmOperations.swift‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1523,13 +1523,30 @@ final class WasmI64x2ExtractLane: WasmOperation {
15231523
}
15241524
}
15251525

1526-
final class WasmI64x2LoadSplat: WasmOperation {
1527-
override var opcode: Opcode { .wasmI64x2LoadSplat(self) }
1528-
1526+
final class WasmSimdLoad: WasmOperation {
1527+
enum Kind: UInt8, CaseIterable {
1528+
// TODO(mliedtke): Test all the other variants!
1529+
case LoadS128 = 0x00
1530+
case Load8x8S = 0x01
1531+
case Load8x8U = 0x02
1532+
case Load16x4S = 0x03
1533+
case Load16x4U = 0x04
1534+
case Load32x2S = 0x05
1535+
case Load32x2U = 0x06
1536+
case Load8Splat = 0x07
1537+
case Load16Splat = 0x08
1538+
case Load32Splat = 0x09
1539+
case Load64Splat = 0x0A
1540+
}
1541+
1542+
override var opcode: Opcode { .wasmSimdLoad(self) }
1543+
1544+
let kind: Kind
15291545
let staticOffset: Int64
15301546
let isMemory64: Bool
15311547

1532-
init(staticOffset: Int64, isMemory64: Bool) {
1548+
init(kind: Kind, staticOffset: Int64, isMemory64: Bool) {
1549+
self.kind = kind
15331550
self.staticOffset = staticOffset
15341551
self.isMemory64 = isMemory64
15351552
let dynamicOffsetType = isMemory64 ? ILType.wasmi64 : ILType.wasmi32

‎Sources/Fuzzilli/Lifting/FuzzILLifter.swift‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1099,8 +1099,8 @@ public class FuzzILLifter: Lifter {
10991099
case .wasmI64x2ExtractLane(let op):
11001100
w.emit("\(output()) <- WasmI64x2ExtractLane \(input(0)) \(op.lane)")
11011101

1102-
case .wasmI64x2LoadSplat(_):
1103-
w.emit("\(output()) <- WasmI64x2LoadSplat \(input(0))")
1102+
case .wasmSimdLoad(let op):
1103+
w.emit("\(output()) <- WasmSimdLoad \(op.kind) \(input(0)) + \(op.staticOffset)")
11041104

11051105
default:
11061106
fatalError("No FuzzIL lifting for this operation!")

‎Sources/Fuzzilli/Lifting/JavaScriptLifter.swift‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1607,7 +1607,7 @@ public class JavaScriptLifter: Lifter {
16071607
.wasmSimd128Compare(_),
16081608
.wasmI64x2Splat(_),
16091609
.wasmI64x2ExtractLane(_),
1610-
.wasmI64x2LoadSplat(_):
1610+
.wasmSimdLoad(_):
16111611
fatalError("unreachable")
16121612
}
16131613

‎Sources/Fuzzilli/Lifting/WasmLifter.swift‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1071,7 +1071,7 @@ public class WasmLifter {
10711071
try memoryOpImportAnalysis(instr: instr, isMemory64: op.isMemory64)
10721072
case .wasmMemoryStore(let op):
10731073
try memoryOpImportAnalysis(instr: instr, isMemory64: op.isMemory64)
1074-
case .wasmI64x2LoadSplat(let op):
1074+
case .wasmSimdLoad(let op):
10751075
try memoryOpImportAnalysis(instr: instr, isMemory64: op.isMemory64)
10761076
case .wasmTableGet(_),
10771077
.wasmTableSet(_):
@@ -1556,9 +1556,9 @@ public class WasmLifter {
15561556
return Data([0xFD]) + Leb128.unsignedEncode(0x12)
15571557
case .wasmI64x2ExtractLane(let op):
15581558
return Data([0xFD]) + Leb128.unsignedEncode(0x1D) + Leb128.unsignedEncode(op.lane)
1559-
case .wasmI64x2LoadSplat(let op):
1559+
case .wasmSimdLoad(let op):
15601560
// The memory immediate is {staticOffset, align} where align is 0 by default. Use signed encoding for potential bad (i.e. negative) offsets.
1561-
return Data([0xFD]) + Leb128.unsignedEncode(0x0A) + Leb128.unsignedEncode(0) + Leb128.signedEncode(Int(op.staticOffset))
1561+
return Data([0xFD, op.kind.rawValue]) + Leb128.unsignedEncode(0) + Leb128.signedEncode(Int(op.staticOffset))
15621562

15631563
default:
15641564
fatalError("unreachable")

‎Sources/Fuzzilli/Mutators/OperationMutator.swift‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -377,7 +377,7 @@ public class OperationMutator: BaseInstructionMutator {
377377
case .wasmI64x2ExtractLane(let op):
378378
// TODO: ?
379379
newOp = op
380-
case .wasmI64x2LoadSplat(let op):
380+
case .wasmSimdLoad(let op):
381381
// TODO: ?
382382
newOp = op
383383
case .createWasmJSTag(let op):

0 commit comments

Comments
 (0)