Better const fuzzing (WebAssembly#2972)

kripken · web-flow · commit 6733a055fd78 · 2020-07-30T11:55:17.000-07:00
Tweak floating-point numbers with not just a +-1 integer, but also a float in [-1, 1]. Apply a tweak to powers of 2 as well. This found bugs in various codebases, see WebAssembly/spec#1224
diff --git a/src/tools/fuzzing.h b/src/tools/fuzzing.h
@@ -1546,6 +1546,38 @@ class TranslateToFuzzReader {
       }
     }
 
+    // Optional tweaking of the value by a small adjustment.
+    auto tweak = [this, type](Literal value) {
+      // +- 1
+      switch (upTo(5)) {
+        case 0:
+          value = value.add(Literal::makeFromInt32(-1, type));
+          break;
+        case 1:
+          value = value.add(Literal::makeFromInt32(1, type));
+          break;
+        default: {
+        }
+      }
+      // For floats, optionally add a non-integer adjustment in +- [-1, 1]
+      if (type.isFloat() && oneIn(2)) {
+        const int RANGE = 1000;
+        auto RANGE_LITERAL = Literal::makeFromInt32(RANGE, type);
+        // adjustment -> [0, 2 * RANGE]
+        auto adjustment = Literal::makeFromInt32(upTo(2 * RANGE + 1), type);
+        // adjustment -> [-RANGE, RANGE]
+        adjustment = adjustment.sub(RANGE_LITERAL);
+        // adjustment -> [-1, 1]
+        adjustment = adjustment.div(RANGE_LITERAL);
+        value = value.add(adjustment);
+      }
+      // Flip sign.
+      if (oneIn(2)) {
+        value = value.mul(Literal::makeFromInt32(-1, type));
+      }
+      return value;
+    };
+
     switch (upTo(4)) {
       case 0: {
         // totally random, entire range
@@ -1680,14 +1712,7 @@ class TranslateToFuzzReader {
           case Type::unreachable:
             WASM_UNREACHABLE("unexpected type");
         }
-        // tweak around special values
-        if (oneIn(3)) { // +- 1
-          value = value.add(Literal::makeFromInt32(upTo(3) - 1, type));
-        }
-        if (oneIn(2)) { // flip sign
-          value = value.mul(Literal::makeFromInt32(-1, type));
-        }
-        return value;
+        return tweak(value);
       }
       case 3: {
         // powers of 2
@@ -1714,14 +1739,10 @@ class TranslateToFuzzReader {
           case Type::unreachable:
             WASM_UNREACHABLE("unexpected type");
         }
-        // maybe negative
-        if (oneIn(2)) {
-          value = value.mul(Literal::makeFromInt32(-1, type));
-        }
-        return value;
+        return tweak(value);
       }
     }
-    WASM_UNREACHABLE("invalide value");
+    WASM_UNREACHABLE("invalid value");
   }
 
   Expression* makeConst(Type type) {
diff --git a/test/passes/fuzz_metrics_noprint.bin.txt b/test/passes/fuzz_metrics_noprint.bin.txt
@@ -1,31 +1,29 @@
 total
  [events]       : 0       
- [exports]      : 31      
- [funcs]        : 45      
+ [exports]      : 35      
+ [funcs]        : 57      
  [globals]      : 7       
  [imports]      : 4       
  [memory-data]  : 4       
- [table-data]   : 16      
- [total]        : 5788    
- [vars]         : 115     
- binary         : 453     
- block          : 823     
- break          : 242     
- call           : 208     
- call_indirect  : 47      
- const          : 997     
- drop           : 46      
- global.get     : 473     
- global.set     : 208     
- if             : 323     
- load           : 99      
- local.get      : 491     
- local.set      : 364     
- loop           : 148     
- nop            : 109     
- return         : 228     
- select         : 46      
- store          : 55      
- switch         : 3       
- unary          : 422     
- unreachable    : 3       
+ [table-data]   : 30      
+ [total]        : 2111    
+ [vars]         : 153     
+ binary         : 184     
+ block          : 311     
+ break          : 56      
+ call           : 110     
+ call_indirect  : 10      
+ const          : 362     
+ drop           : 29      
+ global.get     : 187     
+ global.set     : 80      
+ if             : 114     
+ load           : 46      
+ local.get      : 153     
+ local.set      : 112     
+ loop           : 36      
+ nop            : 46      
+ return         : 105     
+ select         : 13      
+ store          : 11      
+ unary          : 146     
diff --git a/test/passes/translate-to-fuzz_all-features.txt b/test/passes/translate-to-fuzz_all-features.txt
