1#[cfg(feature = "fuzz-spec-interpreter")]
14pub mod diff_spec;
15pub mod diff_wasmi;
16pub mod diff_wasmtime;
17pub mod dummy;
18pub mod engine;
19pub mod memory;
20mod stacks;
21
22use self::diff_wasmtime::WasmtimeInstance;
23use self::engine::{DiffEngine, DiffInstance};
24use crate::generators::{self, CompilerStrategy, DiffValue, DiffValueType};
25use crate::single_module_fuzzer::KnownValid;
26use arbitrary::Arbitrary;
27pub use stacks::check_stacks;
28use std::future::Future;
29use std::pin::Pin;
30use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering::SeqCst};
31use std::sync::{Arc, Condvar, Mutex};
32use std::task::{Context, Poll, Waker};
33use std::time::{Duration, Instant};
34use wasmtime::*;
35use wasmtime_wast::WastContext;
36
37#[cfg(not(any(windows, target_arch = "s390x", target_arch = "riscv64")))]
38mod diff_v8;
39
40static CNT: AtomicUsize = AtomicUsize::new(0);
41
42pub fn log_wasm(wasm: &[u8]) {
45 super::init_fuzzing();
46
47 if !log::log_enabled!(log::Level::Debug) {
48 return;
49 }
50
51 let i = CNT.fetch_add(1, SeqCst);
52 let name = format!("testcase{i}.wasm");
53 std::fs::write(&name, wasm).expect("failed to write wasm file");
54 log::debug!("wrote wasm file to `{}`", name);
55 let wat = format!("testcase{i}.wat");
56 match wasmprinter::print_bytes(wasm) {
57 Ok(s) => std::fs::write(&wat, s).expect("failed to write wat file"),
58 Err(_) => drop(std::fs::remove_file(&wat)),
62 }
63}
64
65#[derive(Clone)]
68pub struct StoreLimits(Arc<LimitsState>);
69
70struct LimitsState {
71 remaining_memory: AtomicUsize,
73 remaining_copy_allowance: AtomicUsize,
75 oom: AtomicBool,
77}
78
79const MAX_MEMORY: usize = 1 << 30;
82
83const MAX_MEMORY_MOVED: usize = 4 << 30;
86
87impl StoreLimits {
88 pub fn new() -> StoreLimits {
90 StoreLimits(Arc::new(LimitsState {
91 remaining_memory: AtomicUsize::new(MAX_MEMORY),
92 remaining_copy_allowance: AtomicUsize::new(MAX_MEMORY_MOVED),
93 oom: AtomicBool::new(false),
94 }))
95 }
96
97 fn alloc(&mut self, amt: usize) -> bool {
98 log::trace!("alloc {amt:#x} bytes");
99
100 let prev_size = MAX_MEMORY - self.0.remaining_memory.load(SeqCst);
111 if self
112 .0
113 .remaining_copy_allowance
114 .fetch_update(SeqCst, SeqCst, |remaining| remaining.checked_sub(prev_size))
115 .is_err()
116 {
117 self.0.oom.store(true, SeqCst);
118 log::debug!("-> too many bytes moved, rejecting allocation");
119 return false;
120 }
121
122 match self
125 .0
126 .remaining_memory
127 .fetch_update(SeqCst, SeqCst, |remaining| remaining.checked_sub(amt))
128 {
129 Ok(_) => true,
130 Err(_) => {
131 self.0.oom.store(true, SeqCst);
132 log::debug!("-> OOM hit");
133 false
134 }
135 }
136 }
137
138 fn is_oom(&self) -> bool {
139 self.0.oom.load(SeqCst)
140 }
141}
142
143impl ResourceLimiter for StoreLimits {
144 fn memory_growing(
145 &mut self,
146 current: usize,
147 desired: usize,
148 _maximum: Option<usize>,
149 ) -> Result<bool> {
150 Ok(self.alloc(desired - current))
151 }
152
153 fn table_growing(
154 &mut self,
155 current: usize,
156 desired: usize,
157 _maximum: Option<usize>,
158 ) -> Result<bool> {
159 let delta = (desired - current).saturating_mul(std::mem::size_of::<usize>());
160 Ok(self.alloc(delta))
161 }
162}
163
164#[derive(Clone, Debug)]
166pub enum Timeout {
167 None,
170 Fuel(u64),
173 Epoch(Duration),
176}
177
178pub fn instantiate(
183 wasm: &[u8],
184 known_valid: KnownValid,
185 config: &generators::Config,
186 timeout: Timeout,
187) {
188 let mut store = config.to_store();
189
190 let module = match compile_module(store.engine(), wasm, known_valid, config) {
191 Some(module) => module,
192 None => return,
193 };
194
195 let mut timeout_state = HelperThread::default();
196 match timeout {
197 Timeout::Fuel(fuel) => store.set_fuel(fuel).unwrap(),
198
199 Timeout::Epoch(timeout) => {
209 let engine = store.engine().clone();
210 timeout_state.run_periodically(timeout, move || engine.increment_epoch());
211 }
212 Timeout::None => {}
213 }
214
215 instantiate_with_dummy(&mut store, &module);
216}
217
218#[derive(Arbitrary, Debug)]
220pub enum Command {
221 Instantiate(usize),
227 Terminate(usize),
236}
237
238pub fn instantiate_many(
244 modules: &[Vec<u8>],
245 known_valid: KnownValid,
246 config: &generators::Config,
247 commands: &[Command],
248) {
249 log::debug!("instantiate_many: {commands:#?}");
250
251 assert!(!config.module_config.config.allow_start_export);
252
253 let engine = Engine::new(&config.to_wasmtime()).unwrap();
254
255 let modules = modules
256 .iter()
257 .enumerate()
258 .filter_map(
259 |(i, bytes)| match compile_module(&engine, bytes, known_valid, config) {
260 Some(m) => {
261 log::debug!("successfully compiled module {i}");
262 Some(m)
263 }
264 None => {
265 log::debug!("failed to compile module {i}");
266 None
267 }
268 },
269 )
270 .collect::<Vec<_>>();
271
272 if modules.is_empty() {
274 return;
275 }
276
277 let mut stores = Vec::new();
279 let limits = StoreLimits::new();
280
281 for command in commands {
282 match command {
283 Command::Instantiate(index) => {
284 let index = *index % modules.len();
285 log::info!("instantiating {}", index);
286 let module = &modules[index];
287 let mut store = Store::new(&engine, limits.clone());
288 config.configure_store(&mut store);
289
290 if instantiate_with_dummy(&mut store, module).is_some() {
291 stores.push(Some(store));
292 } else {
293 log::warn!("instantiation failed");
294 }
295 }
296 Command::Terminate(index) => {
297 if stores.is_empty() {
298 continue;
299 }
300 let index = *index % stores.len();
301
302 log::info!("dropping {}", index);
303 stores.swap_remove(index);
304 }
305 }
306 }
307}
308
309fn compile_module(
310 engine: &Engine,
311 bytes: &[u8],
312 known_valid: KnownValid,
313 config: &generators::Config,
314) -> Option<Module> {
315 log_wasm(bytes);
316
317 fn is_pcc_error(e: &anyhow::Error) -> bool {
318 e.to_string().to_lowercase().contains("proof-carrying-code")
321 }
322
323 match config.compile(engine, bytes) {
324 Ok(module) => Some(module),
325 Err(e) if is_pcc_error(&e) => {
326 panic!("pcc error in input: {e:#?}");
327 }
328 Err(_) if known_valid == KnownValid::No => None,
329 Err(e) => {
330 if let generators::InstanceAllocationStrategy::Pooling(c) = &config.wasmtime.strategy {
331 let string = format!("{e:?}");
336 if string.contains("minimum element size") {
337 return None;
338 }
339
340 if string.contains("instance allocation for this module requires") {
346 return None;
347 }
348
349 if c.max_tables_per_module < (config.module_config.config.max_tables as u32)
353 && string.contains("defined tables count")
354 && string.contains("exceeds the per-instance limit")
355 {
356 return None;
357 }
358
359 if c.max_memories_per_module < (config.module_config.config.max_memories as u32)
360 && string.contains("defined memories count")
361 && string.contains("exceeds the per-instance limit")
362 {
363 return None;
364 }
365 }
366
367 panic!("failed to compile module: {e:?}");
368 }
369 }
370}
371
372pub fn instantiate_with_dummy(store: &mut Store<StoreLimits>, module: &Module) -> Option<Instance> {
383 let linker = dummy::dummy_linker(store, module);
387 if let Err(e) = &linker {
388 log::warn!("failed to create dummy linker: {e:?}");
389 }
390 let instance = linker.and_then(|l| l.instantiate(&mut *store, module));
391 unwrap_instance(store, instance)
392}
393
394fn unwrap_instance(
395 store: &Store<StoreLimits>,
396 instance: anyhow::Result<Instance>,
397) -> Option<Instance> {
398 let e = match instance {
399 Ok(i) => return Some(i),
400 Err(e) => e,
401 };
402
403 log::debug!("failed to instantiate: {e:?}");
404
405 if store.data().is_oom() {
409 return None;
410 }
411
412 if e.is::<Trap>()
415 || e.is::<wasmtime::PoolConcurrencyLimitError>()
418 || e.is::<wasmtime::GcHeapOutOfMemory<()>>()
420 {
421 return None;
422 }
423
424 let string = e.to_string();
425
426 if string.contains("incompatible import type") {
430 return None;
431 }
432
433 panic!("failed to instantiate: {e:?}");
435}
436
437pub fn differential(
448 lhs: &mut dyn DiffInstance,
449 lhs_engine: &dyn DiffEngine,
450 rhs: &mut WasmtimeInstance,
451 name: &str,
452 args: &[DiffValue],
453 result_tys: &[DiffValueType],
454) -> anyhow::Result<bool> {
455 log::debug!("Evaluating: `{}` with {:?}", name, args);
456 let lhs_results = match lhs.evaluate(name, args, result_tys) {
457 Ok(Some(results)) => Ok(results),
458 Err(e) => Err(e),
459 Ok(None) => return Ok(true),
462 };
463 log::debug!(" -> lhs results on {}: {:?}", lhs.name(), &lhs_results);
464
465 let rhs_results = rhs
466 .evaluate(name, args, result_tys)
467 .map(|results| results.unwrap());
469 log::debug!(" -> rhs results on {}: {:?}", rhs.name(), &rhs_results);
470
471 if rhs.is_oom() {
478 return Ok(false);
479 }
480
481 match DiffEqResult::new(lhs_engine, lhs_results, rhs_results) {
482 DiffEqResult::Success(lhs, rhs) => assert_eq!(lhs, rhs),
483 DiffEqResult::Poisoned => return Ok(false),
484 DiffEqResult::Failed => {}
485 }
486
487 for (global, ty) in rhs.exported_globals() {
488 log::debug!("Comparing global `{global}`");
489 let lhs = match lhs.get_global(&global, ty) {
490 Some(val) => val,
491 None => continue,
492 };
493 let rhs = rhs.get_global(&global, ty).unwrap();
494 assert_eq!(lhs, rhs);
495 }
496 for (memory, shared) in rhs.exported_memories() {
497 log::debug!("Comparing memory `{memory}`");
498 let lhs = match lhs.get_memory(&memory, shared) {
499 Some(val) => val,
500 None => continue,
501 };
502 let rhs = rhs.get_memory(&memory, shared).unwrap();
503 if lhs == rhs {
504 continue;
505 }
506 eprintln!("differential memory is {} bytes long", lhs.len());
507 eprintln!("wasmtime memory is {} bytes long", rhs.len());
508 panic!("memories have differing values");
509 }
510
511 Ok(true)
512}
513
514pub enum DiffEqResult<T, U> {
517 Success(T, U),
519 Poisoned,
522 Failed,
525}
526
527fn wasmtime_trap_is_non_deterministic(trap: &Trap) -> bool {
528 match trap {
529 Trap::AllocationTooLarge |
532 Trap::StackOverflow => true,
535 _ => false,
536 }
537}
538
539fn wasmtime_error_is_non_deterministic(error: &wasmtime::Error) -> bool {
540 match error.downcast_ref::<Trap>() {
541 Some(trap) => wasmtime_trap_is_non_deterministic(trap),
542
543 None => true,
550 }
551}
552
553impl<T, U> DiffEqResult<T, U> {
554 pub fn new(
557 lhs_engine: &dyn DiffEngine,
558 lhs_result: Result<T>,
559 rhs_result: Result<U>,
560 ) -> DiffEqResult<T, U> {
561 match (lhs_result, rhs_result) {
562 (Ok(lhs_result), Ok(rhs_result)) => DiffEqResult::Success(lhs_result, rhs_result),
563
564 (Err(lhs), _) if lhs_engine.is_non_deterministic_error(&lhs) => {
567 log::debug!("lhs failed non-deterministically: {lhs:?}");
568 DiffEqResult::Poisoned
569 }
570 (_, Err(rhs)) if wasmtime_error_is_non_deterministic(&rhs) => {
571 log::debug!("rhs failed non-deterministically: {rhs:?}");
572 DiffEqResult::Poisoned
573 }
574
575 (Err(lhs), Err(rhs)) => {
578 let rhs = rhs
579 .downcast::<Trap>()
580 .expect("non-traps handled in earlier match arm");
581
582 debug_assert!(
583 !lhs_engine.is_non_deterministic_error(&lhs),
584 "non-deterministic traps handled in earlier match arm",
585 );
586 debug_assert!(
587 !wasmtime_trap_is_non_deterministic(&rhs),
588 "non-deterministic traps handled in earlier match arm",
589 );
590
591 lhs_engine.assert_error_match(&lhs, &rhs);
592 DiffEqResult::Failed
593 }
594
595 (Ok(_), Err(err)) => panic!("only the `rhs` failed for this input: {err:?}"),
597 (Err(err), Ok(_)) => panic!("only the `lhs` failed for this input: {err:?}"),
598 }
599 }
600}
601
602pub fn make_api_calls(api: generators::api::ApiCalls) {
604 use crate::generators::api::ApiCall;
605 use std::collections::HashMap;
606
607 let mut store: Option<Store<StoreLimits>> = None;
608 let mut modules: HashMap<usize, Module> = Default::default();
609 let mut instances: HashMap<usize, Instance> = Default::default();
610
611 for call in api.calls {
612 match call {
613 ApiCall::StoreNew(config) => {
614 log::trace!("creating store");
615 assert!(store.is_none());
616 store = Some(config.to_store());
617 }
618
619 ApiCall::ModuleNew { id, wasm } => {
620 log::debug!("creating module: {}", id);
621 log_wasm(&wasm);
622 let module = match Module::new(store.as_ref().unwrap().engine(), &wasm) {
623 Ok(m) => m,
624 Err(_) => continue,
625 };
626 let old = modules.insert(id, module);
627 assert!(old.is_none());
628 }
629
630 ApiCall::ModuleDrop { id } => {
631 log::trace!("dropping module: {}", id);
632 drop(modules.remove(&id));
633 }
634
635 ApiCall::InstanceNew { id, module } => {
636 log::trace!("instantiating module {} as {}", module, id);
637 let module = match modules.get(&module) {
638 Some(m) => m,
639 None => continue,
640 };
641
642 let store = store.as_mut().unwrap();
643 if let Some(instance) = instantiate_with_dummy(store, module) {
644 instances.insert(id, instance);
645 }
646 }
647
648 ApiCall::InstanceDrop { id } => {
649 log::trace!("dropping instance {}", id);
650 instances.remove(&id);
651 }
652
653 ApiCall::CallExportedFunc { instance, nth } => {
654 log::trace!("calling instance export {} / {}", instance, nth);
655 let instance = match instances.get(&instance) {
656 Some(i) => i,
657 None => {
658 continue;
665 }
666 };
667 let store = store.as_mut().unwrap();
668
669 let funcs = instance
670 .exports(&mut *store)
671 .filter_map(|e| match e.into_extern() {
672 Extern::Func(f) => Some(f),
673 _ => None,
674 })
675 .collect::<Vec<_>>();
676
677 if funcs.is_empty() {
678 continue;
679 }
680
681 let nth = nth % funcs.len();
682 let f = &funcs[nth];
683 let ty = f.ty(&store);
684 if let Some(params) = ty
685 .params()
686 .map(|p| p.default_value())
687 .collect::<Option<Vec<_>>>()
688 {
689 let mut results = vec![Val::I32(0); ty.results().len()];
690 let _ = f.call(store, ¶ms, &mut results);
691 }
692 }
693 }
694 }
695}
696
697pub fn wast_test(u: &mut arbitrary::Unstructured<'_>) -> arbitrary::Result<()> {
701 crate::init_fuzzing();
702
703 let mut fuzz_config: generators::Config = u.arbitrary()?;
704 let test: generators::WastTest = u.arbitrary()?;
705 if u.arbitrary()? {
706 fuzz_config.enable_async(u)?;
707 }
708
709 let test = &test.test;
710
711 if test.config.hogs_memory.unwrap_or(false) {
715 return Err(arbitrary::Error::IncorrectFormat);
716 }
717
718 let wast_config = fuzz_config.make_wast_test_compliant(test);
721 if test.should_fail(&wast_config) {
722 return Err(arbitrary::Error::IncorrectFormat);
723 }
724
725 if fuzz_config.wasmtime.compiler_strategy == CompilerStrategy::Winch
728 && test.config.simd()
729 && (fuzz_config
730 .wasmtime
731 .codegen_flag("has_avx")
732 .is_some_and(|value| value == "false")
733 || fuzz_config
734 .wasmtime
735 .codegen_flag("has_avx2")
736 .is_some_and(|value| value == "false"))
737 {
738 log::warn!(
739 "Skipping Wast test because Winch doesn't support SIMD tests with AVX or AVX2 disabled"
740 );
741 return Err(arbitrary::Error::IncorrectFormat);
742 }
743
744 if fuzz_config.wasmtime.consume_fuel || fuzz_config.wasmtime.epoch_interruption {
747 if test.contents.contains("(thread") {
748 return Err(arbitrary::Error::IncorrectFormat);
749 }
750 }
751
752 log::debug!("running {:?}", test.path);
753 let async_ = if fuzz_config.wasmtime.async_config == generators::AsyncConfig::Disabled {
754 wasmtime_wast::Async::No
755 } else {
756 wasmtime_wast::Async::Yes
757 };
758 let mut wast_context = WastContext::new(fuzz_config.to_store(), async_);
759 wast_context
760 .register_spectest(&wasmtime_wast::SpectestConfig {
761 use_shared_memory: true,
762 suppress_prints: true,
763 })
764 .unwrap();
765 wast_context
766 .run_buffer(test.path.to_str().unwrap(), test.contents.as_bytes())
767 .unwrap();
768 Ok(())
769}
770
771pub fn table_ops(
776 mut fuzz_config: generators::Config,
777 ops: generators::table_ops::TableOps,
778) -> Result<usize> {
779 let expected_drops = Arc::new(AtomicUsize::new(0));
780 let num_dropped = Arc::new(AtomicUsize::new(0));
781
782 let num_gcs = Arc::new(AtomicUsize::new(0));
783 {
784 fuzz_config.wasmtime.consume_fuel = true;
785 let mut store = fuzz_config.to_store();
786 store.set_fuel(1_000).unwrap();
787
788 let wasm = ops.to_wasm_binary();
789 log_wasm(&wasm);
790 let module = match compile_module(store.engine(), &wasm, KnownValid::No, &fuzz_config) {
791 Some(m) => m,
792 None => return Ok(0),
793 };
794
795 let mut linker = Linker::new(store.engine());
796
797 const MAX_GCS: usize = 5;
800
801 let func_ty = FuncType::new(
802 store.engine(),
803 vec![],
804 vec![ValType::EXTERNREF, ValType::EXTERNREF, ValType::EXTERNREF],
805 );
806 let func = Func::new(&mut store, func_ty, {
807 let num_dropped = num_dropped.clone();
808 let expected_drops = expected_drops.clone();
809 let num_gcs = num_gcs.clone();
810 move |mut caller: Caller<'_, StoreLimits>, _params, results| {
811 log::info!("table_ops: GC");
812 if num_gcs.fetch_add(1, SeqCst) < MAX_GCS {
813 caller.gc(None);
814 }
815
816 let a = ExternRef::new(
817 &mut caller,
818 CountDrops::new(&expected_drops, num_dropped.clone()),
819 )?;
820 let b = ExternRef::new(
821 &mut caller,
822 CountDrops::new(&expected_drops, num_dropped.clone()),
823 )?;
824 let c = ExternRef::new(
825 &mut caller,
826 CountDrops::new(&expected_drops, num_dropped.clone()),
827 )?;
828
829 log::info!("table_ops: gc() -> ({:?}, {:?}, {:?})", a, b, c);
830 results[0] = Some(a).into();
831 results[1] = Some(b).into();
832 results[2] = Some(c).into();
833 Ok(())
834 }
835 });
836 linker.define(&store, "", "gc", func).unwrap();
837
838 linker
839 .func_wrap("", "take_refs", {
840 let expected_drops = expected_drops.clone();
841 move |caller: Caller<'_, StoreLimits>,
842 a: Option<Rooted<ExternRef>>,
843 b: Option<Rooted<ExternRef>>,
844 c: Option<Rooted<ExternRef>>|
845 -> Result<()> {
846 log::info!("table_ops: take_refs({a:?}, {b:?}, {c:?})",);
847
848 if let Some(a) = a {
853 let a = a
854 .data(&caller)?
855 .unwrap()
856 .downcast_ref::<CountDrops>()
857 .unwrap();
858 assert!(a.0.load(SeqCst) <= expected_drops.load(SeqCst));
859 }
860 if let Some(b) = b {
861 let b = b
862 .data(&caller)?
863 .unwrap()
864 .downcast_ref::<CountDrops>()
865 .unwrap();
866 assert!(b.0.load(SeqCst) <= expected_drops.load(SeqCst));
867 }
868 if let Some(c) = c {
869 let c = c
870 .data(&caller)?
871 .unwrap()
872 .downcast_ref::<CountDrops>()
873 .unwrap();
874 assert!(c.0.load(SeqCst) <= expected_drops.load(SeqCst));
875 }
876 Ok(())
877 }
878 })
879 .unwrap();
880
881 let func_ty = FuncType::new(
882 store.engine(),
883 vec![],
884 vec![ValType::EXTERNREF, ValType::EXTERNREF, ValType::EXTERNREF],
885 );
886 let func = Func::new(&mut store, func_ty, {
887 let num_dropped = num_dropped.clone();
888 let expected_drops = expected_drops.clone();
889 move |mut caller, _params, results| {
890 log::info!("table_ops: make_refs");
891
892 let a = ExternRef::new(
893 &mut caller,
894 CountDrops::new(&expected_drops, num_dropped.clone()),
895 )?;
896 let b = ExternRef::new(
897 &mut caller,
898 CountDrops::new(&expected_drops, num_dropped.clone()),
899 )?;
900 let c = ExternRef::new(
901 &mut caller,
902 CountDrops::new(&expected_drops, num_dropped.clone()),
903 )?;
904
905 log::info!("table_ops: make_refs() -> ({:?}, {:?}, {:?})", a, b, c);
906
907 results[0] = Some(a).into();
908 results[1] = Some(b).into();
909 results[2] = Some(c).into();
910
911 Ok(())
912 }
913 });
914 linker.define(&store, "", "make_refs", func).unwrap();
915
916 let instance = linker.instantiate(&mut store, &module).unwrap();
917 let run = instance.get_func(&mut store, "run").unwrap();
918
919 {
920 let mut scope = RootScope::new(&mut store);
921
922 log::info!(
923 "table_ops: begin allocating {} externref arguments",
924 ops.num_globals
925 );
926 let args: Vec<_> = (0..ops.num_params)
927 .map(|_| {
928 Ok(Val::ExternRef(Some(ExternRef::new(
929 &mut scope,
930 CountDrops::new(&expected_drops, num_dropped.clone()),
931 )?)))
932 })
933 .collect::<Result<_>>()?;
934 log::info!(
935 "table_ops: end allocating {} externref arguments",
936 ops.num_globals
937 );
938
939 log::info!("table_ops: calling into Wasm `run` function");
944 let err = run.call(&mut scope, &args, &mut []).unwrap_err();
945 match err.downcast::<GcHeapOutOfMemory<CountDrops>>() {
946 Ok(_oom) => {}
947 Err(err) => {
948 let trap = err
949 .downcast::<Trap>()
950 .expect("if not GC oom, error should be a Wasm trap");
951 match trap {
952 Trap::TableOutOfBounds | Trap::OutOfFuel => {}
953 _ => panic!("unexpected trap: {trap}"),
954 }
955 }
956 }
957 }
958
959 store.gc(None);
961 }
962
963 assert_eq!(num_dropped.load(SeqCst), expected_drops.load(SeqCst));
964 return Ok(num_gcs.load(SeqCst));
965
966 struct CountDrops(Arc<AtomicUsize>);
967
968 impl CountDrops {
969 fn new(expected_drops: &AtomicUsize, num_dropped: Arc<AtomicUsize>) -> Self {
970 let expected = expected_drops.fetch_add(1, SeqCst);
971 log::info!(
972 "CountDrops::new: expected drops: {expected} -> {}",
973 expected + 1
974 );
975 Self(num_dropped)
976 }
977 }
978
979 impl Drop for CountDrops {
980 fn drop(&mut self) {
981 let drops = self.0.fetch_add(1, SeqCst);
982 log::info!("CountDrops::drop: actual drops: {drops} -> {}", drops + 1);
983 }
984 }
985}
986
987#[derive(Default)]
988struct HelperThread {
989 state: Arc<HelperThreadState>,
990 thread: Option<std::thread::JoinHandle<()>>,
991}
992
993#[derive(Default)]
994struct HelperThreadState {
995 should_exit: Mutex<bool>,
996 should_exit_cvar: Condvar,
997}
998
999impl HelperThread {
1000 fn run_periodically(&mut self, dur: Duration, mut closure: impl FnMut() + Send + 'static) {
1001 let state = self.state.clone();
1002 self.thread = Some(std::thread::spawn(move || {
1003 let mut should_exit = state.should_exit.lock().unwrap();
1006 while !*should_exit {
1007 let (lock, result) = state
1008 .should_exit_cvar
1009 .wait_timeout(should_exit, dur)
1010 .unwrap();
1011 should_exit = lock;
1012 if result.timed_out() {
1015 closure();
1016 }
1017 }
1018 }));
1019 }
1020}
1021
1022impl Drop for HelperThread {
1023 fn drop(&mut self) {
1024 let thread = match self.thread.take() {
1025 Some(thread) => thread,
1026 None => return,
1027 };
1028 *self.state.should_exit.lock().unwrap() = true;
1031 self.state.should_exit_cvar.notify_one();
1032
1033 thread.join().unwrap();
1036 }
1037}
1038
1039pub fn dynamic_component_api_target(input: &mut arbitrary::Unstructured) -> arbitrary::Result<()> {
1042 use crate::generators::component_types;
1043 use wasmtime::component::{Component, Linker, Val};
1044 use wasmtime_test_util::component::FuncExt;
1045 use wasmtime_test_util::component_fuzz::{
1046 EXPORT_FUNCTION, IMPORT_FUNCTION, MAX_TYPE_DEPTH, TestCase, Type,
1047 };
1048
1049 crate::init_fuzzing();
1050
1051 let mut types = Vec::new();
1052 let mut type_fuel = 500;
1053
1054 for _ in 0..5 {
1055 types.push(Type::generate(input, MAX_TYPE_DEPTH, &mut type_fuel)?);
1056 }
1057 let params = (0..input.int_in_range(0..=5)?)
1058 .map(|_| input.choose(&types))
1059 .collect::<arbitrary::Result<Vec<_>>>()?;
1060 let result = if input.arbitrary()? {
1061 Some(input.choose(&types)?)
1062 } else {
1063 None
1064 };
1065
1066 let case = TestCase {
1067 params,
1068 result,
1069 encoding1: input.arbitrary()?,
1070 encoding2: input.arbitrary()?,
1071 };
1072
1073 let mut config = wasmtime_test_util::component::config();
1074 config.debug_adapter_modules(input.arbitrary()?);
1075 let engine = Engine::new(&config).unwrap();
1076 let mut store = Store::new(&engine, (Vec::new(), None));
1077 let wat = case.declarations().make_component();
1078 let wat = wat.as_bytes();
1079 log_wasm(wat);
1080 let component = Component::new(&engine, wat).unwrap();
1081 let mut linker = Linker::new(&engine);
1082
1083 linker
1084 .root()
1085 .func_new(IMPORT_FUNCTION, {
1086 move |mut cx: StoreContextMut<'_, (Vec<Val>, Option<Vec<Val>>)>,
1087 params: &[Val],
1088 results: &mut [Val]|
1089 -> Result<()> {
1090 log::trace!("received params {params:?}");
1091 let (expected_args, expected_results) = cx.data_mut();
1092 assert_eq!(params.len(), expected_args.len());
1093 for (expected, actual) in expected_args.iter().zip(params) {
1094 assert_eq!(expected, actual);
1095 }
1096 results.clone_from_slice(&expected_results.take().unwrap());
1097 log::trace!("returning results {results:?}");
1098 Ok(())
1099 }
1100 })
1101 .unwrap();
1102
1103 let instance = linker.instantiate(&mut store, &component).unwrap();
1104 let func = instance.get_func(&mut store, EXPORT_FUNCTION).unwrap();
1105 let param_tys = func.params(&store);
1106 let result_tys = func.results(&store);
1107
1108 while input.arbitrary()? {
1109 let params = param_tys
1110 .iter()
1111 .map(|(_, ty)| component_types::arbitrary_val(ty, input))
1112 .collect::<arbitrary::Result<Vec<_>>>()?;
1113 let results = result_tys
1114 .iter()
1115 .map(|ty| component_types::arbitrary_val(ty, input))
1116 .collect::<arbitrary::Result<Vec<_>>>()?;
1117
1118 *store.data_mut() = (params.clone(), Some(results.clone()));
1119
1120 log::trace!("passing params {params:?}");
1121 let mut actual = vec![Val::Bool(false); results.len()];
1122 func.call_and_post_return(&mut store, ¶ms, &mut actual)
1123 .unwrap();
1124 log::trace!("received results {actual:?}");
1125 assert_eq!(actual, results);
1126 }
1127
1128 Ok(())
1129}
1130
1131pub fn call_async(wasm: &[u8], config: &generators::Config, mut poll_amts: &[u32]) {
1137 let mut store = config.to_store();
1138 let module = match compile_module(store.engine(), wasm, KnownValid::Yes, config) {
1139 Some(module) => module,
1140 None => return,
1141 };
1142
1143 let mut helper_thread = HelperThread::default();
1148 if let generators::AsyncConfig::YieldWithEpochs { dur, .. } = &config.wasmtime.async_config {
1149 let engine = store.engine().clone();
1150 helper_thread.run_periodically(*dur, move || engine.increment_epoch());
1151 }
1152
1153 let mut imports = Vec::new();
1156 for import in module.imports() {
1157 let item = match import.ty() {
1158 ExternType::Func(ty) => {
1159 let poll_amt = take_poll_amt(&mut poll_amts);
1160 Func::new_async(&mut store, ty.clone(), move |caller, _, results| {
1161 let ty = ty.clone();
1162 Box::new(async move {
1163 caller.engine().increment_epoch();
1164 log::info!("yielding {} times in import", poll_amt);
1165 YieldN(poll_amt).await;
1166 for (ret_ty, result) in ty.results().zip(results) {
1167 *result = ret_ty.default_value().unwrap();
1168 }
1169 Ok(())
1170 })
1171 })
1172 .into()
1173 }
1174 other_ty => match other_ty.default_value(&mut store) {
1175 Ok(item) => item,
1176 Err(e) => {
1177 log::warn!("couldn't create import for {import:?}: {e:?}");
1178 return;
1179 }
1180 },
1181 };
1182 imports.push(item);
1183 }
1184
1185 let instance = run(Timeout {
1189 future: Instance::new_async(&mut store, &module, &imports),
1190 polls: take_poll_amt(&mut poll_amts),
1191 end: Instant::now() + Duration::from_millis(2_000),
1192 });
1193 let instance = match instance {
1194 Ok(instantiation_result) => match unwrap_instance(&store, instantiation_result) {
1195 Some(instance) => instance,
1196 None => {
1197 log::info!("instantiation hit a nominal error");
1198 return; }
1200 },
1201 Err(_) => {
1202 log::info!("instantiation failed to complete");
1203 return; }
1205 };
1206
1207 let funcs = instance
1214 .exports(&mut store)
1215 .filter_map(|e| {
1216 let name = e.name().to_string();
1217 let func = e.into_extern().into_func()?;
1218 Some((name, func))
1219 })
1220 .collect::<Vec<_>>();
1221 for (name, func) in funcs {
1222 let ty = func.ty(&store);
1223 let params = ty
1224 .params()
1225 .map(|ty| ty.default_value().unwrap())
1226 .collect::<Vec<_>>();
1227 let mut results = ty
1228 .results()
1229 .map(|ty| ty.default_value().unwrap())
1230 .collect::<Vec<_>>();
1231
1232 log::info!("invoking export {:?}", name);
1233 let future = func.call_async(&mut store, ¶ms, &mut results);
1234 match run(Timeout {
1235 future,
1236 polls: take_poll_amt(&mut poll_amts),
1237 end: Instant::now() + Duration::from_millis(2_000),
1238 }) {
1239 Ok(_) | Err(Exhausted::Polls) => {}
1241
1242 Err(Exhausted::Time) => return,
1246 }
1247 }
1248
1249 fn take_poll_amt(polls: &mut &[u32]) -> u32 {
1250 match polls.split_first() {
1251 Some((a, rest)) => {
1252 *polls = rest;
1253 *a
1254 }
1255 None => 0,
1256 }
1257 }
1258
1259 struct YieldN(u32);
1261
1262 impl Future for YieldN {
1263 type Output = ();
1264
1265 fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
1266 if self.0 == 0 {
1267 Poll::Ready(())
1268 } else {
1269 self.0 -= 1;
1270 cx.waker().wake_by_ref();
1271 Poll::Pending
1272 }
1273 }
1274 }
1275
1276 struct Timeout<F> {
1281 future: F,
1282 end: Instant,
1285 polls: u32,
1288 }
1289
1290 enum Exhausted {
1291 Time,
1292 Polls,
1293 }
1294
1295 impl<F: Future> Future for Timeout<F> {
1296 type Output = Result<F::Output, Exhausted>;
1297
1298 fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
1299 let (end, polls, future) = unsafe {
1300 let me = self.get_unchecked_mut();
1301 (me.end, &mut me.polls, Pin::new_unchecked(&mut me.future))
1302 };
1303 match future.poll(cx) {
1304 Poll::Ready(val) => Poll::Ready(Ok(val)),
1305 Poll::Pending => {
1306 if Instant::now() >= end {
1307 log::warn!("future operation timed out");
1308 return Poll::Ready(Err(Exhausted::Time));
1309 }
1310 if *polls == 0 {
1311 log::warn!("future operation ran out of polls");
1312 return Poll::Ready(Err(Exhausted::Polls));
1313 }
1314 *polls -= 1;
1315 Poll::Pending
1316 }
1317 }
1318 }
1319 }
1320
1321 fn run<F: Future>(future: F) -> F::Output {
1322 let mut f = Box::pin(future);
1323 let mut cx = Context::from_waker(Waker::noop());
1324 loop {
1325 match f.as_mut().poll(&mut cx) {
1326 Poll::Ready(val) => break val,
1327 Poll::Pending => {}
1328 }
1329 }
1330 }
1331}
1332
1333#[cfg(test)]
1334mod tests {
1335 use super::*;
1336 use arbitrary::Unstructured;
1337 use rand::prelude::*;
1338 use wasmparser::{Validator, WasmFeatures};
1339
1340 fn gen_until_pass<T: for<'a> Arbitrary<'a>>(
1341 mut f: impl FnMut(T, &mut Unstructured<'_>) -> Result<bool>,
1342 ) -> bool {
1343 let mut rng = SmallRng::seed_from_u64(0);
1344 let mut buf = vec![0; 2048];
1345 let n = 3000;
1346 for _ in 0..n {
1347 rng.fill_bytes(&mut buf);
1348 let mut u = Unstructured::new(&buf);
1349
1350 if let Ok(config) = u.arbitrary() {
1351 if f(config, &mut u).unwrap() {
1352 return true;
1353 }
1354 }
1355 }
1356 false
1357 }
1358
1359 fn test_n_times<T: for<'a> Arbitrary<'a>>(
1361 iters: u32,
1362 mut f: impl FnMut(T, &mut Unstructured<'_>) -> arbitrary::Result<()>,
1363 ) {
1364 let mut to_test = 0..iters;
1365 let ok = gen_until_pass(|a, b| {
1366 if f(a, b).is_ok() {
1367 Ok(to_test.next().is_none())
1368 } else {
1369 Ok(false)
1370 }
1371 });
1372 assert!(ok);
1373 }
1374
1375 #[test]
1380 fn table_ops_eventually_gcs() {
1381 if std::env::var("WASMTIME_TEST_NO_HOG_MEMORY").is_ok() {
1384 return;
1385 }
1386
1387 let ok = gen_until_pass(|(config, test), _| {
1388 let result = table_ops(config, test)?;
1389 Ok(result > 0)
1390 });
1391
1392 if !ok {
1393 panic!("gc was never found");
1394 }
1395 }
1396
1397 #[test]
1398 fn module_generation_uses_expected_proposals() {
1399 let mut expected = WasmFeatures::MUTABLE_GLOBAL
1402 | WasmFeatures::FLOATS
1403 | WasmFeatures::SIGN_EXTENSION
1404 | WasmFeatures::SATURATING_FLOAT_TO_INT
1405 | WasmFeatures::MULTI_VALUE
1406 | WasmFeatures::BULK_MEMORY
1407 | WasmFeatures::REFERENCE_TYPES
1408 | WasmFeatures::SIMD
1409 | WasmFeatures::MULTI_MEMORY
1410 | WasmFeatures::RELAXED_SIMD
1411 | WasmFeatures::THREADS
1412 | WasmFeatures::TAIL_CALL
1413 | WasmFeatures::WIDE_ARITHMETIC
1414 | WasmFeatures::MEMORY64
1415 | WasmFeatures::FUNCTION_REFERENCES
1416 | WasmFeatures::GC
1417 | WasmFeatures::GC_TYPES
1418 | WasmFeatures::CUSTOM_PAGE_SIZES
1419 | WasmFeatures::EXTENDED_CONST;
1420
1421 let unexpected = WasmFeatures::all() ^ expected;
1427
1428 let ok = gen_until_pass(|config: generators::Config, u| {
1429 let wasm = config.generate(u, None)?.to_bytes();
1430
1431 Validator::new_with_features(WasmFeatures::all()).validate_all(&wasm)?;
1433
1434 for feature in unexpected.iter() {
1437 let ok =
1438 Validator::new_with_features(WasmFeatures::all() ^ feature).validate_all(&wasm);
1439 if ok.is_err() {
1440 anyhow::bail!("generated a module with {feature:?} but that wasn't expected");
1441 }
1442 }
1443
1444 for feature in expected.iter() {
1448 let ok =
1449 Validator::new_with_features(WasmFeatures::all() ^ feature).validate_all(&wasm);
1450 if ok.is_err() {
1451 expected ^= feature;
1452 }
1453 }
1454
1455 Ok(expected.is_empty())
1456 });
1457
1458 if !ok {
1459 panic!("never generated wasm module using {expected:?}");
1460 }
1461 }
1462
1463 #[test]
1464 fn wast_smoke_test() {
1465 test_n_times(50, |(), u| super::wast_test(u));
1466 }
1467}