#!/usr/bin/python3

'''

Run various fuzzing operations on random inputs, using wasm-opt. See

"testcase_handlers" below for the list of fuzzing operations.

Usage:

./scripts/fuzz_opt.py

That will run forever or until it finds a problem.

Setup: Some tools are optional, like emcc and wasm2c. The v8 shell (d8),

however, is used in various sub-fuzzers and so it is mandatory.

Note: For afl-fuzz integration, you probably don't want this, and can use

something like

BINARYEN_CORES=1 BINARYEN_PASS_DEBUG=1 afl-fuzz -i afl-testcases/ -o afl-findings/ -m 100 -d -- bin/wasm-opt -ttf --fuzz-exec --Os @@

(that is on a fixed set of arguments to wasm-opt, though - this

script covers different options being passed)

'''

import contextlib

import os

import difflib

import math

import shutil

import subprocess

import random

import re

import sys

import time

import traceback

from os.path import abspath

from test import shared

from test import support

assert sys.version_info.major == 3, 'requires Python 3!'

# parameters

TYPE_SYSTEM_FLAG = '--nominal'

# feature options that are always passed to the tools.

CONSTANT_FEATURE_OPTS = ['--all-features']

INPUT_SIZE_MIN = 1024

INPUT_SIZE_MEAN = 40 * 1024

INPUT_SIZE_MAX = 5 * INPUT_SIZE_MEAN

PRINT_WATS = False

given_seed = None

# utilities

def in_binaryen(*args):

return os.path.join(shared.options.binaryen_root, *args)

def in_bin(tool):

return os.path.join(shared.options.binaryen_bin, tool)

def random_size():

if random.random() < 0.25:

# sometimes do an exponential distribution, which prefers smaller sizes but may

# also get very high

ret = int(random.expovariate(1.0 / INPUT_SIZE_MEAN))

# if the result is valid, use it, otherwise do the normal thing

# (don't clamp, which would give us a lot of values on the borders)

if ret >= INPUT_SIZE_MIN and ret <= INPUT_SIZE_MAX:

return ret

# most of the time do a simple linear range around the mean

return random.randint(INPUT_SIZE_MIN, 2 * INPUT_SIZE_MEAN - INPUT_SIZE_MIN)

def run(cmd, stderr=None, silent=False):

if not silent:

print(' '.join(cmd))

return subprocess.check_output(cmd, stderr=stderr, text=True)

def run_unchecked(cmd):

print(' '.join(cmd))

return subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True).communicate()[0]

def randomize_pass_debug():

if random.random() < 0.1:

print('[pass-debug]')

os.environ['BINARYEN_PASS_DEBUG'] = '1'

else:

os.environ['BINARYEN_PASS_DEBUG'] = '0'

del os.environ['BINARYEN_PASS_DEBUG']

print('randomized pass debug:', os.environ.get('BINARYEN_PASS_DEBUG', ''))

@contextlib.contextmanager

def no_pass_debug():

old_env = os.environ.copy()

if os.environ.get('BINARYEN_PASS_DEBUG'):

del os.environ['BINARYEN_PASS_DEBUG']

try:

yield

finally:

os.environ.update(old_env)

def randomize_feature_opts():

global FEATURE_OPTS

FEATURE_OPTS = CONSTANT_FEATURE_OPTS[:]

# 1/3 the time apply all the possible opts, 1/3 none of them, to maximize

# coverage both ways, and 1/3 pick each one randomly

if random.random() < 0.33333:

FEATURE_OPTS += POSSIBLE_FEATURE_OPTS

elif random.random() < 0.5:

for possible in POSSIBLE_FEATURE_OPTS:

if random.random() < 0.5:

FEATURE_OPTS.append(possible)

if possible in IMPLIED_FEATURE_OPTS:

FEATURE_OPTS.extend(IMPLIED_FEATURE_OPTS[possible])

print('randomized feature opts:', '\n ' + '\n '.join(FEATURE_OPTS))

# Type system flags only make sense when GC is enabled

if '--disable-gc' not in FEATURE_OPTS:

FEATURE_OPTS.append(TYPE_SYSTEM_FLAG)

ALL_FEATURE_OPTS = ['--all-features', '-all', '--mvp-features', '-mvp']

def update_feature_opts(wasm):

global FEATURE_OPTS

# we will re-compute the features; leave all other things as they are

EXTRA = [x for x in FEATURE_OPTS if not x.startswith('--enable') and

not x.startswith('--disable') and x not in ALL_FEATURE_OPTS]

FEATURE_OPTS = run([in_bin('wasm-opt'), wasm] + FEATURE_OPTS + ['--print-features']).strip().split('\n')

# filter out '', which can happen if no features are enabled

FEATURE_OPTS = [x for x in FEATURE_OPTS if x]

print(FEATURE_OPTS, EXTRA)

FEATURE_OPTS += EXTRA

def randomize_fuzz_settings():

# a list of the optimizations to run on the wasm

global FUZZ_OPTS

# a boolean whether NaN values are allowed, or we de-NaN them

global NANS

# a boolean whether out of bounds operations are allowed, or we bounds-enforce them

global OOB

# a boolean whether we legalize the wasm for JS

global LEGALIZE

FUZZ_OPTS = []

if random.random() < 0.5:

NANS = True

else:

NANS = False

FUZZ_OPTS += ['--denan']

if random.random() < 0.5:

OOB = True

else:

OOB = False

FUZZ_OPTS += ['--no-fuzz-oob']

if random.random() < 0.5:

LEGALIZE = True

FUZZ_OPTS += ['--legalize-js-interface']

else:

LEGALIZE = False

print('randomized settings (NaNs, OOB, legalize):', NANS, OOB, LEGALIZE)

def init_important_initial_contents():

FIXED_IMPORTANT_INITIAL_CONTENTS = [

# Perenially-important passes

os.path.join('lit', 'passes', 'optimize-instructions.wast'),

os.path.join('passes', 'optimize-instructions_fuzz-exec.wast'),

]

MANUAL_RECENT_INITIAL_CONTENTS = [

# Recently-added or modified passes. These can be added to and pruned

# frequently.

os.path.join('lit', 'passes', 'once-reduction.wast'),

os.path.join('passes', 'remove-unused-brs_enable-multivalue.wast'),

os.path.join('lit', 'passes', 'optimize-instructions-bulk-memory.wast'),

os.path.join('lit', 'passes', 'optimize-instructions-ignore-traps.wast'),

os.path.join('lit', 'passes', 'optimize-instructions-gc.wast'),

os.path.join('lit', 'passes', 'optimize-instructions-gc-iit.wast'),

os.path.join('lit', 'passes', 'optimize-instructions-call_ref.wast'),

os.path.join('lit', 'passes', 'inlining_splitting.wast'),

os.path.join('heap-types.wast'),

]

RECENT_DAYS = 30

# Returns the list of test wast/wat files added or modified within the

# RECENT_DAYS number of days counting from the commit time of HEAD

def auto_select_recent_initial_contents():

# Print 'git log' with changed file status and without commit messages,

# with commits within RECENT_DAYS number of days, counting from the

# commit time of HEAD. The reason we use the commit time of HEAD instead

# of the current system time is to make the results deterministic given

# the Binaryen HEAD commit.

from datetime import datetime, timedelta, timezone

head_ts_str = run(['git', 'log', '-1', '--format=%cd', '--date=raw'],

silent=True).split()[0]

head_dt = datetime.utcfromtimestamp(int(head_ts_str))

start_dt = head_dt - timedelta(days=RECENT_DAYS)

start_ts = start_dt.replace(tzinfo=timezone.utc).timestamp()

log = run(['git', 'log', '--name-status', '--format=', '--date=raw', '--no-renames', f'--since={start_ts}'], silent=True).splitlines()

# Pick up lines in the form of

# A test/../something.wast

# M test/../something.wast

# (wat extension is also included)

p = re.compile(r'^[AM]\stest' + os.sep + r'(.*\.(wat|wast))$')

matches = [p.match(e) for e in log]

auto_set = set([match.group(1) for match in matches if match])

auto_set = auto_set.difference(set(FIXED_IMPORTANT_INITIAL_CONTENTS))

return sorted(list(auto_set))

def is_git_repo():

try:

ret = run(['git', 'rev-parse', '--is-inside-work-tree'],

silent=True, stderr=subprocess.DEVNULL)

return ret == 'true\n'

except subprocess.CalledProcessError:

return False

if not is_git_repo() and shared.options.auto_initial_contents:

print('Warning: The current directory is not a git repository, so you cannot use "--auto-initial-contents". Using the manually selected contents.\n')

shared.options.auto_initial_contents = False

print('- Perenially-important initial contents:')

for test in FIXED_IMPORTANT_INITIAL_CONTENTS:

print(' ' + test)

print()

recent_contents = []

print('- Recently added or modified initial contents ', end='')

if shared.options.auto_initial_contents:

print(f'(automatically selected: within last {RECENT_DAYS} days):')

recent_contents += auto_select_recent_initial_contents()

else:

print('(manually selected):')

recent_contents = MANUAL_RECENT_INITIAL_CONTENTS

for test in recent_contents:

print(' ' + test)

print()

# We prompt the user only when there is no seed given. This fuzz_opt.py is

# often used with seed in a script called from wasm-reduce, in which case we

# should not pause for a user input.

if given_seed is None:

ret = input('Do you want to proceed with these initial contents? (Y/n) ').lower()

if ret != 'y' and ret != '':

sys.exit(1)

initial_contents = FIXED_IMPORTANT_INITIAL_CONTENTS + recent_contents

global IMPORTANT_INITIAL_CONTENTS

IMPORTANT_INITIAL_CONTENTS = [os.path.join(shared.get_test_dir('.'), t) for t in initial_contents]

INITIAL_CONTENTS_IGNORE = [

# not all relaxed SIMD instructions are implemented in the interpreter

'relaxed-simd.wast',

# TODO: fuzzer and interpreter support for strings

'strings.wast',

'simplify-locals-strings.wast',

# TODO: fuzzer and interpreter support for extern conversions

'extern-conversions.wast',

# ignore DWARF because it is incompatible with multivalue atm

'zlib.wasm',

'cubescript.wasm',

'class_with_dwarf_noprint.wasm',

'fib2_dwarf.wasm',

'fib_nonzero-low-pc_dwarf.wasm',

'inlined_to_start_dwarf.wasm',

'fannkuch3_manyopts_dwarf.wasm',

'fib2_emptylocspan_dwarf.wasm',

'fannkuch3_dwarf.wasm',

'multi_unit_abbrev_noprint.wasm',

# TODO fuzzer support for multi-memories

'multi-memories-atomics64.wast',

'multi-memories-basics.wast',

'multi-memories-simd.wast',

'multi-memories-atomics64.wasm',

'multi-memories-basics.wasm',

'multi-memories-simd.wasm',

'multi-memories_size.wast',

]

def pick_initial_contents():

# if we use an initial wasm file's contents as the basis for the

# fuzzing, then that filename, or None if we start entirely from scratch

global INITIAL_CONTENTS

INITIAL_CONTENTS = None

# half the time don't use any initial contents

if random.random() < 0.5:

return

# some of the time use initial contents that are known to be especially

# important

if random.random() < 0.5:

test_name = random.choice(IMPORTANT_INITIAL_CONTENTS)

else:

test_name = random.choice(all_tests)

print('initial contents:', test_name)

if shared.options.auto_initial_contents:

# when using auto initial contents, we look through the git history to

# find test files. if a test file was renamed or removed then it may

# no longer exist, and we should just skip it.

if not os.path.exists(test_name):

return

if os.path.basename(test_name) in INITIAL_CONTENTS_IGNORE:

return

assert os.path.exists(test_name)

# tests that check validation errors are not helpful for us

if '.fail.' in test_name:

print('initial contents is just a .fail test')

return

if os.path.basename(test_name) in [

# contains too many segments to run in a wasm VM

'limit-segments_disable-bulk-memory.wast',

# https://github.com/WebAssembly/binaryen/issues/3203

'simd.wast',

# corner cases of escaping of names is not interesting

'names.wast',

# huge amount of locals that make it extremely slow

'too_much_for_liveness.wasm'

]:

print('initial contents is disallowed')

return

if test_name.endswith('.wast'):

# this can contain multiple modules, pick one

split_parts = support.split_wast(test_name)

if len(split_parts) > 1:

index = random.randint(0, len(split_parts) - 1)

chosen = split_parts[index]

module, asserts = chosen

if not module:

# there is no module in this choice (just asserts), ignore it

print('initial contents has no module')

return

test_name = abspath('initial.wat')

with open(test_name, 'w') as f:

f.write(module)

print(' picked submodule %d from multi-module wast' % index)

global FEATURE_OPTS

FEATURE_OPTS += [

# has not been fuzzed in general yet

'--disable-memory64',

# avoid multivalue for now due to bad interactions with gc non-nullable

# locals in stacky code. for example, this fails to roundtrip as the

# tuple code ends up creating stacky binary code that needs to spill

# non-nullable references to locals, which is not allowed:

#

# (module

# (type $other (struct))

# (func $foo (result (ref $other))

# (select

# (struct.new $other)

# (struct.new $other)

# (tuple.extract 1

# (tuple.make

# (i32.const 0)

# (i32.const 0)

# )

# )

# )

# )

# )

'--disable-multivalue',

]

# the given wasm may not work with the chosen feature opts. for example, if

# we pick atomics.wast but want to run with --disable-atomics, then we'd

# error, so we need to test the wasm. first, make sure it doesn't have a

# features section, as that would enable a feature that we might want to

# be disabled, and our test would not error as we want it to.

if test_name.endswith('.wasm'):

temp_test_name = 'initial.wasm'

try:

run([in_bin('wasm-opt'), test_name, '-all', '--strip-target-features',

'-o', temp_test_name])

except Exception:

# the input can be invalid if e.g. it is raw data that is used with

# -ttf as fuzzer input

print('(initial contents are not valid wasm, ignoring)')

return

test_name = temp_test_name

# next, test the wasm.

try:

run([in_bin('wasm-opt'), test_name] + FEATURE_OPTS,

stderr=subprocess.PIPE,

silent=True)

except Exception:

print('(initial contents not valid for features, ignoring)')

return

INITIAL_CONTENTS = test_name

# Test outputs we want to ignore are marked this way.

IGNORE = '[binaryen-fuzzer-ignore]'

# Traps are reported as [trap REASON]

TRAP_PREFIX = '[trap '

# Host limits are reported as [host limit REASON]

HOST_LIMIT_PREFIX = '[host limit '

# --fuzz-exec reports calls as [fuzz-exec] calling foo

FUZZ_EXEC_CALL_PREFIX = '[fuzz-exec] calling'

# compare two strings, strictly

def compare(x, y, context, verbose=True):

if x != y and x != IGNORE and y != IGNORE:

message = ''.join([a + '\n' for a in difflib.unified_diff(x.splitlines(), y.splitlines(), fromfile='expected', tofile='actual')])

if verbose:

raise Exception(context + " comparison error, expected to have '%s' == '%s', diff:\n\n%s" % (

x, y,

message

))

else:

raise Exception(context + "\nDiff:\n\n%s" % (message))

# converts a possibly-signed integer to an unsigned integer

def unsign(x, bits):

return x & ((1 << bits) - 1)

# numbers are "close enough" if they just differ in printing, as different

# vms may print at different precision levels and verbosity

def numbers_are_close_enough(x, y):

# handle nan comparisons like -nan:0x7ffff0 vs NaN, ignoring the bits

if 'nan' in x.lower() and 'nan' in y.lower():

return True

# if one input is a pair, then it is in fact a 64-bit integer that is

# reported as two 32-bit chunks. convert such 'low high' pairs into a 64-bit

# integer for comparison to the other value

if ' ' in x or ' ' in y:

def to_64_bit(a):

if ' ' not in a:

return unsign(int(a), bits=64)

low, high = a.split(' ')

return unsign(int(low), 32) + (1 << 32) * unsign(int(high), 32)

return to_64_bit(x) == to_64_bit(y)

# float() on the strings will handle many minor differences, like

# float('1.0') == float('1') , float('inf') == float('Infinity'), etc.

try:

return float(x) == float(y)

except Exception:

pass

# otherwise, try a full eval which can handle i64s too

try:

ex = eval(x)

ey = eval(y)

return ex == ey or float(ex) == float(ey)

except Exception as e:

print('failed to check if numbers are close enough:', e)

return False

FUZZ_EXEC_NOTE_RESULT = '[fuzz-exec] note result'

# compare between vms, which may slightly change how numbers are printed

def compare_between_vms(x, y, context):

x_lines = x.splitlines()

y_lines = y.splitlines()

if len(x_lines) != len(y_lines):

return compare(x, y, context + ' (note: different number of lines between vms)')

num_lines = len(x_lines)

for i in range(num_lines):

x_line = x_lines[i]

y_line = y_lines[i]

if x_line != y_line:

# this is different, but maybe it's a vm difference we can ignore

LEI_LOGGING = '[LoggingExternalInterface logging'

if x_line.startswith(LEI_LOGGING) and y_line.startswith(LEI_LOGGING):

x_val = x_line[len(LEI_LOGGING) + 1:-1]

y_val = y_line[len(LEI_LOGGING) + 1:-1]

if numbers_are_close_enough(x_val, y_val):

continue

if x_line.startswith(FUZZ_EXEC_NOTE_RESULT) and y_line.startswith(FUZZ_EXEC_NOTE_RESULT):

x_val = x_line.split(' ')[-1]

y_val = y_line.split(' ')[-1]

if numbers_are_close_enough(x_val, y_val):

continue

# this failed to compare. print a custom diff of the relevant lines

MARGIN = 3

start = max(i - MARGIN, 0)

end = min(i + MARGIN, num_lines)

return compare('\n'.join(x_lines[start:end]), '\n'.join(y_lines[start:end]), context)

def fix_output(out):

# large doubles may print slightly different on different VMs

def fix_double(x):

x = x.group(1)

if 'nan' in x or 'NaN' in x:

x = 'nan'

else:

x = x.replace('Infinity', 'inf')

x = str(float(x))

return 'f64.const ' + x

out = re.sub(r'f64\.const (-?[nanN:abcdefxIity\d+-.]+)', fix_double, out)

# mark traps from wasm-opt as exceptions, even though they didn't run in a vm

out = out.replace(TRAP_PREFIX, 'exception: ' + TRAP_PREFIX)

# funcref(0) has the index of the function in it, and optimizations can

# change that index, so ignore it

out = re.sub(r'funcref\([\d\w$+-_:]+\)', 'funcref()', out)

lines = out.splitlines()

for i in range(len(lines)):

line = lines[i]

if 'Warning: unknown flag' in line or 'Try --help for options' in line:

# ignore some VM warnings that don't matter, like if a newer V8 has

# removed a flag that is no longer needed. but print the line so the

# developer can see it.

print(line)

lines[i] = None

elif 'exception' in line:

# exceptions may differ when optimizing, but an exception should

# occur, so ignore their types (also js engines print them out

# slightly differently)

lines[i] = ' *exception*'

return '\n'.join([line for line in lines if line is not None])

def fix_spec_output(out):

out = fix_output(out)

# spec shows a pointer when it traps, remove that

out = '\n'.join(map(lambda x: x if 'runtime trap' not in x else x[x.find('runtime trap'):], out.splitlines()))

# https://github.com/WebAssembly/spec/issues/543 , float consts are messed up

out = '\n'.join(map(lambda x: x if 'f32' not in x and 'f64' not in x else '', out.splitlines()))

return out

def run_vm(cmd):

def filter_known_issues(output):

known_issues = [

# can be caused by flatten, ssa, etc. passes

'local count too large',

# https://github.com/WebAssembly/binaryen/issues/3767

# note that this text is a little too broad, but the problem is rare

# enough that it's unlikely to hide an unrelated issue

'found br_if of type',

# all host limitations are arbitrary and may differ between VMs and also

# be affected by optimizations, so ignore them.

HOST_LIMIT_PREFIX,

]

for issue in known_issues:

if issue in output:

return IGNORE

return output

try:

# some known issues do not cause the entire process to fail

return filter_known_issues(run(cmd))

except subprocess.CalledProcessError:

# other known issues do make it fail, so re-run without checking for

# success and see if we should ignore it

if filter_known_issues(run_unchecked(cmd)) == IGNORE:

return IGNORE

raise

MAX_INTERPRETER_ENV_VAR = 'BINARYEN_MAX_INTERPRETER_DEPTH'

MAX_INTERPRETER_DEPTH = 1000

def run_bynterp(wasm, args):

# increase the interpreter stack depth, to test more things

os.environ[MAX_INTERPRETER_ENV_VAR] = str(MAX_INTERPRETER_DEPTH)

try:

return run_vm([in_bin('wasm-opt'), wasm] + FEATURE_OPTS + args)

finally:

del os.environ['BINARYEN_MAX_INTERPRETER_DEPTH']

V8_LIFTOFF_ARGS = ['--liftoff', '--no-wasm-tier-up']

# default to running with liftoff enabled, because we need to pick either

# liftoff or turbofan for consistency (otherwise running the same command twice

# may have different results due to NaN nondeterminism), and liftoff is faster

# for small things

def run_d8_js(js, args=[], liftoff=True):

cmd = [shared.V8] + shared.V8_OPTS

if liftoff:

cmd += V8_LIFTOFF_ARGS

cmd += [js]

if args:

cmd += ['--'] + args

return run_vm(cmd)

def run_d8_wasm(wasm, liftoff=True):

return run_d8_js(in_binaryen('scripts', 'fuzz_shell.js'), [wasm], liftoff=liftoff)

def all_disallowed(features):

return not any(('--enable-' + x) in FEATURE_OPTS for x in features)

class TestCaseHandler:

# how frequent this handler will be run. 1 means always run it, 0.5 means half the

# time

frequency = 1

def __init__(self):

self.num_runs = 0

# If the core handle_pair() method is not overridden, it calls handle() on

# each of the items. That is useful if you just want the two wasms and don't

# care about their relationship.

def handle_pair(self, input, before_wasm, after_wasm, opts):

self.handle(before_wasm)

self.handle(after_wasm)

def can_run_on_feature_opts(self, feature_opts):

return True

def increment_runs(self):

self.num_runs += 1

def count_runs(self):

return self.num_runs

# Fuzz the interpreter with --fuzz-exec.

class FuzzExec(TestCaseHandler):

frequency = 1

def handle_pair(self, input, before_wasm, after_wasm, opts):

run([in_bin('wasm-opt'), before_wasm] + opts + ['--fuzz-exec'])

class CompareVMs(TestCaseHandler):

frequency = 0.6

def __init__(self):

super(CompareVMs, self).__init__()

class BinaryenInterpreter:

name = 'binaryen interpreter'

def run(self, wasm):

return run_bynterp(wasm, ['--fuzz-exec-before'])

def can_run(self, wasm):

return True

def can_compare_to_self(self):

return True

def can_compare_to_others(self):

return True

class D8:

name = 'd8'

def run(self, wasm, extra_d8_flags=[]):

run([in_bin('wasm-opt'), wasm, '--emit-js-wrapper=' + wasm + '.js'] + FEATURE_OPTS)

return run_vm([shared.V8, wasm + '.js'] + shared.V8_OPTS + extra_d8_flags + ['--', wasm])

def can_run(self, wasm):

# INITIAL_CONTENT is disallowed because some initial spec testcases

# have names that require mangling, see

# https://github.com/WebAssembly/binaryen/pull/3216

return not INITIAL_CONTENTS

def can_compare_to_self(self):

# With nans, VM differences can confuse us, so only very simple VMs

# can compare to themselves after opts in that case.

return not NANS

def can_compare_to_others(self):

# If not legalized, the JS will fail immediately, so no point to

# compare to others.

return LEGALIZE and not NANS

class D8Liftoff(D8):

name = 'd8_liftoff'

def run(self, wasm):

return super(D8Liftoff, self).run(wasm, extra_d8_flags=V8_LIFTOFF_ARGS)

class D8TurboFan(D8):

name = 'd8_turbofan'

def run(self, wasm):

return super(D8TurboFan, self).run(wasm, extra_d8_flags=['--no-liftoff'])

class Wasm2C:

name = 'wasm2c'

def __init__(self):

# look for wabt in the path. if it's not here, don't run wasm2c

try:

wabt_bin = shared.which('wasm2c')

wabt_root = os.path.dirname(os.path.dirname(wabt_bin))

self.wasm2c_dir = os.path.join(wabt_root, 'wasm2c')

if not os.path.isdir(self.wasm2c_dir):

print('wabt found, but not wasm2c support dir')

self.wasm2c_dir = None

except Exception as e:

print('warning: no wabt found:', e)

self.wasm2c_dir = None

def can_run(self, wasm):

if self.wasm2c_dir is None:

return False

# if we legalize for JS, the ABI is not what C wants

if LEGALIZE:

return False

# relatively slow, so run it less frequently

if random.random() < 0.5:

return False

# wasm2c doesn't support most features

return all_disallowed(['exception-handling', 'simd', 'threads', 'bulk-memory', 'nontrapping-float-to-int', 'tail-call', 'sign-ext', 'reference-types', 'multivalue', 'gc'])

def run(self, wasm):

run([in_bin('wasm-opt'), wasm, '--emit-wasm2c-wrapper=main.c'] + FEATURE_OPTS)

run(['wasm2c', wasm, '-o', 'wasm.c'])

compile_cmd = ['clang', 'main.c', 'wasm.c', os.path.join(self.wasm2c_dir, 'wasm-rt-impl.c'), '-I' + self.wasm2c_dir, '-lm', '-Werror']

run(compile_cmd)

return run_vm(['./a.out'])

def can_compare_to_self(self):

# The binaryen optimizer changes NaNs in the ways that wasm

# expects, but that's not quite what C has

return not NANS

def can_compare_to_others(self):

# C won't trap on OOB, and NaNs can differ from wasm VMs

return not OOB and not NANS

class Wasm2C2Wasm(Wasm2C):

name = 'wasm2c2wasm'

def __init__(self):

super(Wasm2C2Wasm, self).__init__()

self.has_emcc = shared.which('emcc') is not None

def run(self, wasm):

run([in_bin('wasm-opt'), wasm, '--emit-wasm2c-wrapper=main.c'] + FEATURE_OPTS)

run(['wasm2c', wasm, '-o', 'wasm.c'])

compile_cmd = ['emcc', 'main.c', 'wasm.c',

os.path.join(self.wasm2c_dir, 'wasm-rt-impl.c'),

'-I' + self.wasm2c_dir,

'-lm',

'-s', 'ENVIRONMENT=shell',

'-s', 'ALLOW_MEMORY_GROWTH']

# disable the signal handler: emcc looks like unix, but wasm has

# no signals

compile_cmd += ['-DWASM_RT_MEMCHECK_SIGNAL_HANDLER=0']

if random.random() < 0.5:

compile_cmd += ['-O' + str(random.randint(1, 3))]

elif random.random() < 0.5:

if random.random() < 0.5:

compile_cmd += ['-Os']

else:

compile_cmd += ['-Oz']

# avoid pass-debug on the emcc invocation itself (which runs

# binaryen to optimize the wasm), as the wasm here can be very

# large and it isn't what we are focused on testing here

with no_pass_debug():

run(compile_cmd)

return run_d8_js(abspath('a.out.js'))

def can_run(self, wasm):

# quite slow (more steps), so run it less frequently

if random.random() < 0.8:

return False

# prefer not to run if the wasm is very large, as it can OOM

# the JS engine.

return super(Wasm2C2Wasm, self).can_run(wasm) and self.has_emcc and \

os.path.getsize(wasm) <= INPUT_SIZE_MEAN

def can_compare_to_others(self):

# NaNs can differ from wasm VMs

return not NANS

self.vms = [BinaryenInterpreter(),

D8(),

D8Liftoff(),

D8TurboFan(),

# FIXME: Temprorary disable. See issue #4741 for more details

# Wasm2C(),

# Wasm2C2Wasm()

]

def handle_pair(self, input, before_wasm, after_wasm, opts):

before = self.run_vms(before_wasm)

after = self.run_vms(after_wasm)

self.compare_before_and_after(before, after)

def run_vms(self, wasm):

# vm_results will map vms to their results

vm_results = {}

for vm in self.vms:

if vm.can_run(wasm):

print(f'[CompareVMs] running {vm.name}')

vm_results[vm] = fix_output(vm.run(wasm))

# compare between the vms on this specific input

first_vm = None

for vm in vm_results.keys():

if vm.can_compare_to_others():

if first_vm is None:

first_vm = vm

else:

compare_between_vms(vm_results[first_vm], vm_results[vm], 'CompareVMs between VMs: ' + first_vm.name + ' and ' + vm.name)

return vm_results

def compare_before_and_after(self, before, after):

# compare each VM to itself on the before and after inputs

for vm in before.keys():

if vm in after and vm.can_compare_to_self():

compare(before[vm], after[vm], 'CompareVMs between before and after: ' + vm.name)

def can_run_on_feature_opts(self, feature_opts):

return all_disallowed(['simd', 'multivalue'])

# Check for determinism - the same command must have the same output.

class CheckDeterminism(TestCaseHandler):

# not that important

frequency = 0.1

def handle_pair(self, input, before_wasm, after_wasm, opts):

# check for determinism

run([in_bin('wasm-opt'), before_wasm, '-o', abspath('b1.wasm')] + opts)

run([in_bin('wasm-opt'), before_wasm, '-o', abspath('b2.wasm')] + opts)

b1 = open('b1.wasm', 'rb').read()

b2 = open('b2.wasm', 'rb').read()

if (b1 != b2):

run([in_bin('wasm-dis'), abspath('b1.wasm'), '-o', abspath('b1.wat')] + FEATURE_OPTS)

run([in_bin('wasm-dis'), abspath('b2.wasm'), '-o', abspath('b2.wat')] + FEATURE_OPTS)

t1 = open(abspath('b1.wat'), 'r').read()

t2 = open(abspath('b2.wat'), 'r').read()

compare(t1, t2, 'Output must be deterministic.', verbose=False)

class Wasm2JS(TestCaseHandler):

frequency = 0.6

def handle_pair(self, input, before_wasm, after_wasm, opts):

before_wasm_temp = before_wasm + '.temp.wasm'

after_wasm_temp = after_wasm + '.temp.wasm'

# legalize the before wasm, so that comparisons to the interpreter

# later make sense (if we don't do this, the wasm may have i64 exports).

# after applying other necessary fixes, we'll recreate the after wasm

# from scratch.

run([in_bin('wasm-opt'), before_wasm, '--legalize-js-interface', '-o', before_wasm_temp] + FEATURE_OPTS)

compare_before_to_after = random.random() < 0.5

compare_to_interpreter = compare_before_to_after and random.random() < 0.5

if compare_before_to_after:

# to compare the wasm before and after optimizations, we must

# remove operations that wasm2js does not support with full

# precision, such as i64-to-f32, as the optimizer can give different

# results.

simplification_passes = ['--stub-unsupported-js']

if compare_to_interpreter:

# unexpectedly-unaligned loads/stores work fine in wasm in general but

# not in wasm2js, since typed arrays silently round down, effectively.

# if we want to compare to the interpreter, remove unaligned

# operations (by forcing alignment 1, then lowering those into aligned

# components, which means all loads and stores are of a single byte).

simplification_passes += ['--dealign', '--alignment-lowering']

run([in_bin('wasm-opt'), before_wasm_temp, '-o', before_wasm_temp] + simplification_passes + FEATURE_OPTS)

# now that the before wasm is fixed up, generate a proper after wasm

run([in_bin('wasm-opt'), before_wasm_temp, '-o', after_wasm_temp] + opts + FEATURE_OPTS)

# always check for compiler crashes

before = self.run(before_wasm_temp)

after = self.run(after_wasm_temp)

if NANS:

# with NaNs we can't compare the output, as a reinterpret through

# memory might end up different in JS than wasm

return

# we also cannot compare if the wasm hits a trap, as wasm2js does not

# trap on many things wasm would, and in those cases it can do weird

# undefined things. in such a case, at least compare up until before

# the trap, which lets us compare at least some results in some cases.

# (this is why wasm2js is not in CompareVMs, which does full

# comparisons - we need to limit the comparison in a special way here)

interpreter = run_bynterp(before_wasm_temp, ['--fuzz-exec-before'])

if TRAP_PREFIX in interpreter:

trap_index = interpreter.index(TRAP_PREFIX)

# we can't test this function, which the trap is in the middle of.

# erase everything from this function's output and onward, so we

# only compare the previous trap-free code

call_start = interpreter.rindex(FUZZ_EXEC_CALL_PREFIX, 0, trap_index)

call_end = interpreter.index('\n', call_start)

call_line = interpreter[call_start:call_end]

before = before[:before.index(call_line)]

after = after[:after.index(call_line)]

interpreter = interpreter[:interpreter.index(call_line)]

def fix_output_for_js(x):

# start with the normal output fixes that all VMs need

x = fix_output(x)

# check if a number is 0 or a subnormal, which is basically zero

def is_basically_zero(x):

# to check if something is a subnormal, compare it to the largest one

return x >= 0 and x <= 2.22507385850720088902e-308

def fix_number(x):

x = x.group(1)

try:

x = float(x)

# There appear to be some cases where JS VMs will print

# subnormals in full detail while other VMs do not, and vice

# versa. Ignore such really tiny numbers.

if is_basically_zero(x):

x = 0

except ValueError:

# not a floating-point number, nothing to do

pass

return ' => ' + str(x)

# logging notation is "function_name => result", look for that with

# a floating-point result that may need to be fixed up

return re.sub(r' => (-?[\d+-.e\-+]+)', fix_number, x)

before = fix_output_for_js(before)

after = fix_output_for_js(after)

if compare_before_to_after:

compare_between_vms(before, after, 'Wasm2JS (before/after)')

if compare_to_interpreter:

interpreter = fix_output_for_js(interpreter)

compare_between_vms(before, interpreter, 'Wasm2JS (vs interpreter)')

def run(self, wasm):

wrapper = run([in_bin('wasm-opt'), wasm, '--emit-js-wrapper=/dev/stdout'] + FEATURE_OPTS)

cmd = [in_bin('wasm2js'), wasm, '--emscripten']

# avoid optimizations if we have nans, as we don't handle them with

# full precision and optimizations can change things

# OOB accesses are also an issue with optimizations, that can turn the

# loaded "undefined" into either 0 (with an |0) or stay undefined

# in optimized code.

if not NANS and not OOB and random.random() < 0.5:

# when optimizing also enable deterministic mode, to avoid things

# like integer divide by zero causing false positives (1 / 0 is

# Infinity without a | 0 , and 0 with one, and the truthiness of

# those differs; we don't want to care about this because it

# would trap in wasm anyhow)

cmd += ['-O', '--deterministic']

main = run(cmd + FEATURE_OPTS)

with open(os.path.join(shared.options.binaryen_root, 'scripts', 'wasm2js.js')) as f:

glue = f.read()

js_file = wasm + '.js'

with open(js_file, 'w') as f:

f.write(glue)

f.write(main)

f.write(wrapper)

return run_vm([shared.NODEJS, js_file, abspath('a.wasm')])

def can_run_on_feature_opts(self, feature_opts):

# TODO: properly handle memory growth. right now the wasm2js handler

# uses --emscripten which assumes the Memory is created before, and

# wasm2js.js just starts with a size of 1 and no limit. We should switch

# to non-emscripten mode or adding memory information, or check

# specifically for growth here

if INITIAL_CONTENTS:

return False

return all_disallowed(['exception-handling', 'simd', 'threads', 'bulk-memory', 'nontrapping-float-to-int', 'tail-call', 'sign-ext', 'reference-types', 'multivalue', 'gc'])

class Asyncify(TestCaseHandler):

frequency = 0.6

def handle_pair(self, input, before_wasm, after_wasm, opts):

# we must legalize in order to run in JS

async_before_wasm = abspath('async.' + os.path.basename(before_wasm))

async_after_wasm = abspath('async.' + os.path.basename(after_wasm))