1#[cfg(feature = "fuzz-spec-interpreter")]
14pub mod diff_spec;
15pub mod diff_wasmi;
16pub mod diff_wasmtime;
17pub mod dummy;
18pub mod engine;
19pub mod memory;
20mod stacks;
21
22use self::diff_wasmtime::WasmtimeInstance;
23use self::engine::{DiffEngine, DiffInstance};
24use crate::generators::{self, CompilerStrategy, DiffValue, DiffValueType};
25use crate::single_module_fuzzer::KnownValid;
26use arbitrary::Arbitrary;
27pub use stacks::check_stacks;
28use std::future::Future;
29use std::pin::Pin;
30use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering::SeqCst};
31use std::sync::{Arc, Condvar, Mutex};
32use std::task::{Context, Poll, Waker};
33use std::time::{Duration, Instant};
34use wasmtime::*;
35use wasmtime_wast::WastContext;
36
37#[cfg(not(any(windows, target_arch = "s390x", target_arch = "riscv64")))]
38mod diff_v8;
39
40static CNT: AtomicUsize = AtomicUsize::new(0);
41
42pub fn log_wasm(wasm: &[u8]) {
45 super::init_fuzzing();
46
47 if !log::log_enabled!(log::Level::Debug) {
48 return;
49 }
50
51 let i = CNT.fetch_add(1, SeqCst);
52 let name = format!("testcase{i}.wasm");
53 std::fs::write(&name, wasm).expect("failed to write wasm file");
54 log::debug!("wrote wasm file to `{name}`");
55 let wat = format!("testcase{i}.wat");
56 match wasmprinter::print_bytes(wasm) {
57 Ok(s) => std::fs::write(&wat, s).expect("failed to write wat file"),
58 Err(_) => drop(std::fs::remove_file(&wat)),
62 }
63}
64
65#[derive(Clone)]
68pub struct StoreLimits(Arc<LimitsState>);
69
70struct LimitsState {
71 remaining_memory: AtomicUsize,
73 remaining_copy_allowance: AtomicUsize,
75 oom: AtomicBool,
77}
78
79const MAX_MEMORY: usize = 1 << 30;
82
83const MAX_MEMORY_MOVED: usize = 4 << 30;
86
87impl StoreLimits {
88 pub fn new() -> StoreLimits {
90 StoreLimits(Arc::new(LimitsState {
91 remaining_memory: AtomicUsize::new(MAX_MEMORY),
92 remaining_copy_allowance: AtomicUsize::new(MAX_MEMORY_MOVED),
93 oom: AtomicBool::new(false),
94 }))
95 }
96
97 fn alloc(&mut self, amt: usize) -> bool {
98 log::trace!("alloc {amt:#x} bytes");
99
100 let prev_size = MAX_MEMORY - self.0.remaining_memory.load(SeqCst);
111 if self
112 .0
113 .remaining_copy_allowance
114 .fetch_update(SeqCst, SeqCst, |remaining| remaining.checked_sub(prev_size))
115 .is_err()
116 {
117 self.0.oom.store(true, SeqCst);
118 log::debug!("-> too many bytes moved, rejecting allocation");
119 return false;
120 }
121
122 match self
125 .0
126 .remaining_memory
127 .fetch_update(SeqCst, SeqCst, |remaining| remaining.checked_sub(amt))
128 {
129 Ok(_) => true,
130 Err(_) => {
131 self.0.oom.store(true, SeqCst);
132 log::debug!("-> OOM hit");
133 false
134 }
135 }
136 }
137
138 fn is_oom(&self) -> bool {
139 self.0.oom.load(SeqCst)
140 }
141}
142
143impl ResourceLimiter for StoreLimits {
144 fn memory_growing(
145 &mut self,
146 current: usize,
147 desired: usize,
148 _maximum: Option<usize>,
149 ) -> Result<bool> {
150 Ok(self.alloc(desired - current))
151 }
152
153 fn table_growing(
154 &mut self,
155 current: usize,
156 desired: usize,
157 _maximum: Option<usize>,
158 ) -> Result<bool> {
159 let delta = (desired - current).saturating_mul(std::mem::size_of::<usize>());
160 Ok(self.alloc(delta))
161 }
162}
163
164#[derive(Clone, Debug)]
166pub enum Timeout {
167 None,
170 Fuel(u64),
173 Epoch(Duration),
176}
177
178pub fn instantiate(
183 wasm: &[u8],
184 known_valid: KnownValid,
185 config: &generators::Config,
186 timeout: Timeout,
187) {
188 let mut store = config.to_store();
189
190 let module = match compile_module(store.engine(), wasm, known_valid, config) {
191 Some(module) => module,
192 None => return,
193 };
194
195 let mut timeout_state = HelperThread::default();
196 match timeout {
197 Timeout::Fuel(fuel) => store.set_fuel(fuel).unwrap(),
198
199 Timeout::Epoch(timeout) => {
209 let engine = store.engine().clone();
210 timeout_state.run_periodically(timeout, move || engine.increment_epoch());
211 }
212 Timeout::None => {}
213 }
214
215 instantiate_with_dummy(&mut store, &module);
216}
217
218#[derive(Arbitrary, Debug)]
220pub enum Command {
221 Instantiate(usize),
227 Terminate(usize),
236}
237
238pub fn instantiate_many(
244 modules: &[Vec<u8>],
245 known_valid: KnownValid,
246 config: &generators::Config,
247 commands: &[Command],
248) {
249 log::debug!("instantiate_many: {commands:#?}");
250
251 assert!(!config.module_config.config.allow_start_export);
252
253 let engine = Engine::new(&config.to_wasmtime()).unwrap();
254
255 let modules = modules
256 .iter()
257 .enumerate()
258 .filter_map(
259 |(i, bytes)| match compile_module(&engine, bytes, known_valid, config) {
260 Some(m) => {
261 log::debug!("successfully compiled module {i}");
262 Some(m)
263 }
264 None => {
265 log::debug!("failed to compile module {i}");
266 None
267 }
268 },
269 )
270 .collect::<Vec<_>>();
271
272 if modules.is_empty() {
274 return;
275 }
276
277 let mut stores = Vec::new();
279 let limits = StoreLimits::new();
280
281 for command in commands {
282 match command {
283 Command::Instantiate(index) => {
284 let index = *index % modules.len();
285 log::info!("instantiating {index}");
286 let module = &modules[index];
287 let mut store = Store::new(&engine, limits.clone());
288 config.configure_store(&mut store);
289
290 if instantiate_with_dummy(&mut store, module).is_some() {
291 stores.push(Some(store));
292 } else {
293 log::warn!("instantiation failed");
294 }
295 }
296 Command::Terminate(index) => {
297 if stores.is_empty() {
298 continue;
299 }
300 let index = *index % stores.len();
301
302 log::info!("dropping {index}");
303 stores.swap_remove(index);
304 }
305 }
306 }
307}
308
309fn compile_module(
310 engine: &Engine,
311 bytes: &[u8],
312 known_valid: KnownValid,
313 config: &generators::Config,
314) -> Option<Module> {
315 log_wasm(bytes);
316
317 fn is_pcc_error(e: &anyhow::Error) -> bool {
318 e.to_string().to_lowercase().contains("proof-carrying-code")
321 }
322
323 match config.compile(engine, bytes) {
324 Ok(module) => Some(module),
325 Err(e) if is_pcc_error(&e) => {
326 panic!("pcc error in input: {e:#?}");
327 }
328 Err(_) if known_valid == KnownValid::No => None,
329 Err(e) => {
330 if let generators::InstanceAllocationStrategy::Pooling(c) = &config.wasmtime.strategy {
331 let string = format!("{e:?}");
336 if string.contains("minimum element size") {
337 return None;
338 }
339
340 if string.contains("instance allocation for this module requires") {
346 return None;
347 }
348
349 if c.max_tables_per_module < (config.module_config.config.max_tables as u32)
353 && string.contains("defined tables count")
354 && string.contains("exceeds the per-instance limit")
355 {
356 return None;
357 }
358
359 if c.max_memories_per_module < (config.module_config.config.max_memories as u32)
360 && string.contains("defined memories count")
361 && string.contains("exceeds the per-instance limit")
362 {
363 return None;
364 }
365 }
366
367 panic!("failed to compile module: {e:?}");
368 }
369 }
370}
371
372pub fn instantiate_with_dummy(store: &mut Store<StoreLimits>, module: &Module) -> Option<Instance> {
383 let linker = dummy::dummy_linker(store, module);
387 if let Err(e) = &linker {
388 log::warn!("failed to create dummy linker: {e:?}");
389 }
390 let instance = linker.and_then(|l| l.instantiate(&mut *store, module));
391 unwrap_instance(store, instance)
392}
393
394fn unwrap_instance(
395 store: &Store<StoreLimits>,
396 instance: anyhow::Result<Instance>,
397) -> Option<Instance> {
398 let e = match instance {
399 Ok(i) => return Some(i),
400 Err(e) => e,
401 };
402
403 log::debug!("failed to instantiate: {e:?}");
404
405 if store.data().is_oom() {
409 return None;
410 }
411
412 if e.is::<Trap>()
415 || e.is::<wasmtime::PoolConcurrencyLimitError>()
418 || e.is::<wasmtime::GcHeapOutOfMemory<()>>()
420 || e.is::<wasmtime::ThrownException>()
422 {
423 return None;
424 }
425
426 let string = e.to_string();
427
428 if string.contains("incompatible import type") {
432 return None;
433 }
434
435 panic!("failed to instantiate: {e:?}");
437}
438
439pub fn differential(
450 lhs: &mut dyn DiffInstance,
451 lhs_engine: &dyn DiffEngine,
452 rhs: &mut WasmtimeInstance,
453 name: &str,
454 args: &[DiffValue],
455 result_tys: &[DiffValueType],
456) -> anyhow::Result<bool> {
457 log::debug!("Evaluating: `{name}` with {args:?}");
458 let lhs_results = match lhs.evaluate(name, args, result_tys) {
459 Ok(Some(results)) => Ok(results),
460 Err(e) => Err(e),
461 Ok(None) => return Ok(true),
464 };
465 log::debug!(" -> lhs results on {}: {:?}", lhs.name(), &lhs_results);
466
467 let rhs_results = rhs
468 .evaluate(name, args, result_tys)
469 .map(|results| results.unwrap());
471 log::debug!(" -> rhs results on {}: {:?}", rhs.name(), &rhs_results);
472
473 if rhs.is_oom() {
480 return Ok(false);
481 }
482
483 match DiffEqResult::new(lhs_engine, lhs_results, rhs_results) {
484 DiffEqResult::Success(lhs, rhs) => assert_eq!(lhs, rhs),
485 DiffEqResult::Poisoned => return Ok(false),
486 DiffEqResult::Failed => {}
487 }
488
489 for (global, ty) in rhs.exported_globals() {
490 log::debug!("Comparing global `{global}`");
491 let lhs = match lhs.get_global(&global, ty) {
492 Some(val) => val,
493 None => continue,
494 };
495 let rhs = rhs.get_global(&global, ty).unwrap();
496 assert_eq!(lhs, rhs);
497 }
498 for (memory, shared) in rhs.exported_memories() {
499 log::debug!("Comparing memory `{memory}`");
500 let lhs = match lhs.get_memory(&memory, shared) {
501 Some(val) => val,
502 None => continue,
503 };
504 let rhs = rhs.get_memory(&memory, shared).unwrap();
505 if lhs == rhs {
506 continue;
507 }
508 eprintln!("differential memory is {} bytes long", lhs.len());
509 eprintln!("wasmtime memory is {} bytes long", rhs.len());
510 panic!("memories have differing values");
511 }
512
513 Ok(true)
514}
515
516pub enum DiffEqResult<T, U> {
519 Success(T, U),
521 Poisoned,
524 Failed,
527}
528
529fn wasmtime_trap_is_non_deterministic(trap: &Trap) -> bool {
530 match trap {
531 Trap::AllocationTooLarge |
534 Trap::StackOverflow => true,
537 _ => false,
538 }
539}
540
541fn wasmtime_error_is_non_deterministic(error: &wasmtime::Error) -> bool {
542 match error.downcast_ref::<Trap>() {
543 Some(trap) => wasmtime_trap_is_non_deterministic(trap),
544
545 None => true,
552 }
553}
554
555impl<T, U> DiffEqResult<T, U> {
556 pub fn new(
559 lhs_engine: &dyn DiffEngine,
560 lhs_result: Result<T>,
561 rhs_result: Result<U>,
562 ) -> DiffEqResult<T, U> {
563 match (lhs_result, rhs_result) {
564 (Ok(lhs_result), Ok(rhs_result)) => DiffEqResult::Success(lhs_result, rhs_result),
565
566 (Err(lhs), _) if lhs_engine.is_non_deterministic_error(&lhs) => {
569 log::debug!("lhs failed non-deterministically: {lhs:?}");
570 DiffEqResult::Poisoned
571 }
572 (_, Err(rhs)) if wasmtime_error_is_non_deterministic(&rhs) => {
573 log::debug!("rhs failed non-deterministically: {rhs:?}");
574 DiffEqResult::Poisoned
575 }
576
577 (Err(lhs), Err(rhs)) => {
580 let rhs = rhs
581 .downcast::<Trap>()
582 .expect("non-traps handled in earlier match arm");
583
584 debug_assert!(
585 !lhs_engine.is_non_deterministic_error(&lhs),
586 "non-deterministic traps handled in earlier match arm",
587 );
588 debug_assert!(
589 !wasmtime_trap_is_non_deterministic(&rhs),
590 "non-deterministic traps handled in earlier match arm",
591 );
592
593 lhs_engine.assert_error_match(&lhs, &rhs);
594 DiffEqResult::Failed
595 }
596
597 (Ok(_), Err(err)) => panic!("only the `rhs` failed for this input: {err:?}"),
599 (Err(err), Ok(_)) => panic!("only the `lhs` failed for this input: {err:?}"),
600 }
601 }
602}
603
604pub fn make_api_calls(api: generators::api::ApiCalls) {
606 use crate::generators::api::ApiCall;
607 use std::collections::HashMap;
608
609 let mut store: Option<Store<StoreLimits>> = None;
610 let mut modules: HashMap<usize, Module> = Default::default();
611 let mut instances: HashMap<usize, Instance> = Default::default();
612
613 for call in api.calls {
614 match call {
615 ApiCall::StoreNew(config) => {
616 log::trace!("creating store");
617 assert!(store.is_none());
618 store = Some(config.to_store());
619 }
620
621 ApiCall::ModuleNew { id, wasm } => {
622 log::debug!("creating module: {id}");
623 log_wasm(&wasm);
624 let module = match Module::new(store.as_ref().unwrap().engine(), &wasm) {
625 Ok(m) => m,
626 Err(_) => continue,
627 };
628 let old = modules.insert(id, module);
629 assert!(old.is_none());
630 }
631
632 ApiCall::ModuleDrop { id } => {
633 log::trace!("dropping module: {id}");
634 drop(modules.remove(&id));
635 }
636
637 ApiCall::InstanceNew { id, module } => {
638 log::trace!("instantiating module {module} as {id}");
639 let module = match modules.get(&module) {
640 Some(m) => m,
641 None => continue,
642 };
643
644 let store = store.as_mut().unwrap();
645 if let Some(instance) = instantiate_with_dummy(store, module) {
646 instances.insert(id, instance);
647 }
648 }
649
650 ApiCall::InstanceDrop { id } => {
651 log::trace!("dropping instance {id}");
652 instances.remove(&id);
653 }
654
655 ApiCall::CallExportedFunc { instance, nth } => {
656 log::trace!("calling instance export {instance} / {nth}");
657 let instance = match instances.get(&instance) {
658 Some(i) => i,
659 None => {
660 continue;
667 }
668 };
669 let store = store.as_mut().unwrap();
670
671 let funcs = instance
672 .exports(&mut *store)
673 .filter_map(|e| match e.into_extern() {
674 Extern::Func(f) => Some(f),
675 _ => None,
676 })
677 .collect::<Vec<_>>();
678
679 if funcs.is_empty() {
680 continue;
681 }
682
683 let nth = nth % funcs.len();
684 let f = &funcs[nth];
685 let ty = f.ty(&store);
686 if let Some(params) = ty
687 .params()
688 .map(|p| p.default_value())
689 .collect::<Option<Vec<_>>>()
690 {
691 let mut results = vec![Val::I32(0); ty.results().len()];
692 let _ = f.call(store, ¶ms, &mut results);
693 }
694 }
695 }
696 }
697}
698
699pub fn wast_test(u: &mut arbitrary::Unstructured<'_>) -> arbitrary::Result<()> {
703 crate::init_fuzzing();
704
705 let mut fuzz_config: generators::Config = u.arbitrary()?;
706 let test: generators::WastTest = u.arbitrary()?;
707
708 let test = &test.test;
709
710 if test.config.component_model_async() || u.arbitrary()? {
711 fuzz_config.enable_async(u)?;
712 }
713
714 if test.config.hogs_memory.unwrap_or(false) {
718 return Err(arbitrary::Error::IncorrectFormat);
719 }
720
721 let wast_config = fuzz_config.make_wast_test_compliant(test);
724 if test.should_fail(&wast_config) {
725 return Err(arbitrary::Error::IncorrectFormat);
726 }
727
728 if fuzz_config.wasmtime.compiler_strategy == CompilerStrategy::Winch
731 && test.config.simd()
732 && (fuzz_config
733 .wasmtime
734 .codegen_flag("has_avx")
735 .is_some_and(|value| value == "false")
736 || fuzz_config
737 .wasmtime
738 .codegen_flag("has_avx2")
739 .is_some_and(|value| value == "false"))
740 {
741 log::warn!(
742 "Skipping Wast test because Winch doesn't support SIMD tests with AVX or AVX2 disabled"
743 );
744 return Err(arbitrary::Error::IncorrectFormat);
745 }
746
747 if fuzz_config.wasmtime.consume_fuel || fuzz_config.wasmtime.epoch_interruption {
750 if test.contents.contains("(thread") {
751 return Err(arbitrary::Error::IncorrectFormat);
752 }
753 }
754
755 log::debug!("running {:?}", test.path);
756 let async_ = if fuzz_config.wasmtime.async_config == generators::AsyncConfig::Disabled {
757 wasmtime_wast::Async::No
758 } else {
759 wasmtime_wast::Async::Yes
760 };
761 let engine = Engine::new(&fuzz_config.to_wasmtime()).unwrap();
762 let mut wast_context = WastContext::new(&engine, async_, move |store| {
763 fuzz_config.configure_store_epoch_and_fuel(store);
764 });
765 wast_context
766 .register_spectest(&wasmtime_wast::SpectestConfig {
767 use_shared_memory: true,
768 suppress_prints: true,
769 })
770 .unwrap();
771 wast_context
772 .run_wast(test.path.to_str().unwrap(), test.contents.as_bytes())
773 .unwrap();
774 Ok(())
775}
776
777pub fn table_ops(
782 mut fuzz_config: generators::Config,
783 mut ops: generators::table_ops::TableOps,
784) -> Result<usize> {
785 let expected_drops = Arc::new(AtomicUsize::new(0));
786 let num_dropped = Arc::new(AtomicUsize::new(0));
787
788 let num_gcs = Arc::new(AtomicUsize::new(0));
789 {
790 fuzz_config.wasmtime.consume_fuel = true;
791 let mut store = fuzz_config.to_store();
792 store.set_fuel(1_000).unwrap();
793
794 let wasm = ops.to_wasm_binary();
795 log_wasm(&wasm);
796 let module = match compile_module(store.engine(), &wasm, KnownValid::No, &fuzz_config) {
797 Some(m) => m,
798 None => return Ok(0),
799 };
800
801 let mut linker = Linker::new(store.engine());
802
803 const MAX_GCS: usize = 5;
806
807 let func_ty = FuncType::new(
808 store.engine(),
809 vec![],
810 vec![ValType::EXTERNREF, ValType::EXTERNREF, ValType::EXTERNREF],
811 );
812 let func = Func::new(&mut store, func_ty, {
813 let num_dropped = num_dropped.clone();
814 let expected_drops = expected_drops.clone();
815 let num_gcs = num_gcs.clone();
816 move |mut caller: Caller<'_, StoreLimits>, _params, results| {
817 log::info!("table_ops: GC");
818 if num_gcs.fetch_add(1, SeqCst) < MAX_GCS {
819 caller.gc(None);
820 }
821
822 let a = ExternRef::new(
823 &mut caller,
824 CountDrops::new(&expected_drops, num_dropped.clone()),
825 )?;
826 let b = ExternRef::new(
827 &mut caller,
828 CountDrops::new(&expected_drops, num_dropped.clone()),
829 )?;
830 let c = ExternRef::new(
831 &mut caller,
832 CountDrops::new(&expected_drops, num_dropped.clone()),
833 )?;
834
835 log::info!("table_ops: gc() -> ({a:?}, {b:?}, {c:?})");
836 results[0] = Some(a).into();
837 results[1] = Some(b).into();
838 results[2] = Some(c).into();
839 Ok(())
840 }
841 });
842 linker.define(&store, "", "gc", func).unwrap();
843
844 linker
845 .func_wrap("", "take_refs", {
846 let expected_drops = expected_drops.clone();
847 move |caller: Caller<'_, StoreLimits>,
848 a: Option<Rooted<ExternRef>>,
849 b: Option<Rooted<ExternRef>>,
850 c: Option<Rooted<ExternRef>>|
851 -> Result<()> {
852 log::info!("table_ops: take_refs({a:?}, {b:?}, {c:?})",);
853
854 if let Some(a) = a {
859 let a = a
860 .data(&caller)?
861 .unwrap()
862 .downcast_ref::<CountDrops>()
863 .unwrap();
864 assert!(a.0.load(SeqCst) <= expected_drops.load(SeqCst));
865 }
866 if let Some(b) = b {
867 let b = b
868 .data(&caller)?
869 .unwrap()
870 .downcast_ref::<CountDrops>()
871 .unwrap();
872 assert!(b.0.load(SeqCst) <= expected_drops.load(SeqCst));
873 }
874 if let Some(c) = c {
875 let c = c
876 .data(&caller)?
877 .unwrap()
878 .downcast_ref::<CountDrops>()
879 .unwrap();
880 assert!(c.0.load(SeqCst) <= expected_drops.load(SeqCst));
881 }
882 Ok(())
883 }
884 })
885 .unwrap();
886
887 let func_ty = FuncType::new(
888 store.engine(),
889 vec![],
890 vec![ValType::EXTERNREF, ValType::EXTERNREF, ValType::EXTERNREF],
891 );
892 let func = Func::new(&mut store, func_ty, {
893 let num_dropped = num_dropped.clone();
894 let expected_drops = expected_drops.clone();
895 move |mut caller, _params, results| {
896 log::info!("table_ops: make_refs");
897
898 let a = ExternRef::new(
899 &mut caller,
900 CountDrops::new(&expected_drops, num_dropped.clone()),
901 )?;
902 let b = ExternRef::new(
903 &mut caller,
904 CountDrops::new(&expected_drops, num_dropped.clone()),
905 )?;
906 let c = ExternRef::new(
907 &mut caller,
908 CountDrops::new(&expected_drops, num_dropped.clone()),
909 )?;
910
911 log::info!("table_ops: make_refs() -> ({a:?}, {b:?}, {c:?})");
912
913 results[0] = Some(a).into();
914 results[1] = Some(b).into();
915 results[2] = Some(c).into();
916
917 Ok(())
918 }
919 });
920 linker.define(&store, "", "make_refs", func).unwrap();
921
922 let instance = linker.instantiate(&mut store, &module).unwrap();
923 let run = instance.get_func(&mut store, "run").unwrap();
924
925 {
926 let mut scope = RootScope::new(&mut store);
927
928 log::info!(
929 "table_ops: begin allocating {} externref arguments",
930 ops.limits.num_globals
931 );
932 let args: Vec<_> = (0..ops.limits.num_params)
933 .map(|_| {
934 Ok(Val::ExternRef(Some(ExternRef::new(
935 &mut scope,
936 CountDrops::new(&expected_drops, num_dropped.clone()),
937 )?)))
938 })
939 .collect::<Result<_>>()?;
940 log::info!(
941 "table_ops: end allocating {} externref arguments",
942 ops.limits.num_globals
943 );
944
945 log::info!("table_ops: calling into Wasm `run` function");
950 let err = run.call(&mut scope, &args, &mut []).unwrap_err();
951 match err.downcast::<GcHeapOutOfMemory<CountDrops>>() {
952 Ok(_oom) => {}
953 Err(err) => {
954 let trap = err
955 .downcast::<Trap>()
956 .expect("if not GC oom, error should be a Wasm trap");
957 match trap {
958 Trap::TableOutOfBounds | Trap::OutOfFuel => {}
959 _ => panic!("unexpected trap: {trap}"),
960 }
961 }
962 }
963 }
964
965 store.gc(None);
967 }
968
969 assert_eq!(num_dropped.load(SeqCst), expected_drops.load(SeqCst));
970 return Ok(num_gcs.load(SeqCst));
971
972 struct CountDrops(Arc<AtomicUsize>);
973
974 impl CountDrops {
975 fn new(expected_drops: &AtomicUsize, num_dropped: Arc<AtomicUsize>) -> Self {
976 let expected = expected_drops.fetch_add(1, SeqCst);
977 log::info!(
978 "CountDrops::new: expected drops: {expected} -> {}",
979 expected + 1
980 );
981 Self(num_dropped)
982 }
983 }
984
985 impl Drop for CountDrops {
986 fn drop(&mut self) {
987 let drops = self.0.fetch_add(1, SeqCst);
988 log::info!("CountDrops::drop: actual drops: {drops} -> {}", drops + 1);
989 }
990 }
991}
992
993#[derive(Default)]
994struct HelperThread {
995 state: Arc<HelperThreadState>,
996 thread: Option<std::thread::JoinHandle<()>>,
997}
998
999#[derive(Default)]
1000struct HelperThreadState {
1001 should_exit: Mutex<bool>,
1002 should_exit_cvar: Condvar,
1003}
1004
1005impl HelperThread {
1006 fn run_periodically(&mut self, dur: Duration, mut closure: impl FnMut() + Send + 'static) {
1007 let state = self.state.clone();
1008 self.thread = Some(std::thread::spawn(move || {
1009 let mut should_exit = state.should_exit.lock().unwrap();
1012 while !*should_exit {
1013 let (lock, result) = state
1014 .should_exit_cvar
1015 .wait_timeout(should_exit, dur)
1016 .unwrap();
1017 should_exit = lock;
1018 if result.timed_out() {
1021 closure();
1022 }
1023 }
1024 }));
1025 }
1026}
1027
1028impl Drop for HelperThread {
1029 fn drop(&mut self) {
1030 let thread = match self.thread.take() {
1031 Some(thread) => thread,
1032 None => return,
1033 };
1034 *self.state.should_exit.lock().unwrap() = true;
1037 self.state.should_exit_cvar.notify_one();
1038
1039 thread.join().unwrap();
1042 }
1043}
1044
1045pub fn dynamic_component_api_target(input: &mut arbitrary::Unstructured) -> arbitrary::Result<()> {
1048 use crate::generators::component_types;
1049 use wasmtime::component::{Component, Linker, Val};
1050 use wasmtime_test_util::component::FuncExt;
1051 use wasmtime_test_util::component_fuzz::{
1052 EXPORT_FUNCTION, IMPORT_FUNCTION, MAX_TYPE_DEPTH, TestCase, Type,
1053 };
1054
1055 crate::init_fuzzing();
1056
1057 let mut types = Vec::new();
1058 let mut type_fuel = 500;
1059
1060 for _ in 0..5 {
1061 types.push(Type::generate(input, MAX_TYPE_DEPTH, &mut type_fuel)?);
1062 }
1063 let params = (0..input.int_in_range(0..=5)?)
1064 .map(|_| input.choose(&types))
1065 .collect::<arbitrary::Result<Vec<_>>>()?;
1066 let result = if input.arbitrary()? {
1067 Some(input.choose(&types)?)
1068 } else {
1069 None
1070 };
1071
1072 let case = TestCase {
1073 params,
1074 result,
1075 encoding1: input.arbitrary()?,
1076 encoding2: input.arbitrary()?,
1077 };
1078
1079 let mut config = wasmtime_test_util::component::config();
1080 config.debug_adapter_modules(input.arbitrary()?);
1081 let engine = Engine::new(&config).unwrap();
1082 let mut store = Store::new(&engine, (Vec::new(), None));
1083 let wat = case.declarations().make_component();
1084 let wat = wat.as_bytes();
1085 log_wasm(wat);
1086 let component = Component::new(&engine, wat).unwrap();
1087 let mut linker = Linker::new(&engine);
1088
1089 linker
1090 .root()
1091 .func_new(IMPORT_FUNCTION, {
1092 move |mut cx: StoreContextMut<'_, (Vec<Val>, Option<Vec<Val>>)>,
1093 params: &[Val],
1094 results: &mut [Val]|
1095 -> Result<()> {
1096 log::trace!("received params {params:?}");
1097 let (expected_args, expected_results) = cx.data_mut();
1098 assert_eq!(params.len(), expected_args.len());
1099 for (expected, actual) in expected_args.iter().zip(params) {
1100 assert_eq!(expected, actual);
1101 }
1102 results.clone_from_slice(&expected_results.take().unwrap());
1103 log::trace!("returning results {results:?}");
1104 Ok(())
1105 }
1106 })
1107 .unwrap();
1108
1109 let instance = linker.instantiate(&mut store, &component).unwrap();
1110 let func = instance.get_func(&mut store, EXPORT_FUNCTION).unwrap();
1111 let param_tys = func.params(&store);
1112 let result_tys = func.results(&store);
1113
1114 while input.arbitrary()? {
1115 let params = param_tys
1116 .iter()
1117 .map(|(_, ty)| component_types::arbitrary_val(ty, input))
1118 .collect::<arbitrary::Result<Vec<_>>>()?;
1119 let results = result_tys
1120 .iter()
1121 .map(|ty| component_types::arbitrary_val(ty, input))
1122 .collect::<arbitrary::Result<Vec<_>>>()?;
1123
1124 *store.data_mut() = (params.clone(), Some(results.clone()));
1125
1126 log::trace!("passing params {params:?}");
1127 let mut actual = vec![Val::Bool(false); results.len()];
1128 func.call_and_post_return(&mut store, ¶ms, &mut actual)
1129 .unwrap();
1130 log::trace!("received results {actual:?}");
1131 assert_eq!(actual, results);
1132 }
1133
1134 Ok(())
1135}
1136
1137pub fn call_async(wasm: &[u8], config: &generators::Config, mut poll_amts: &[u32]) {
1143 let mut store = config.to_store();
1144 let module = match compile_module(store.engine(), wasm, KnownValid::Yes, config) {
1145 Some(module) => module,
1146 None => return,
1147 };
1148
1149 let mut helper_thread = HelperThread::default();
1154 if let generators::AsyncConfig::YieldWithEpochs { dur, .. } = &config.wasmtime.async_config {
1155 let engine = store.engine().clone();
1156 helper_thread.run_periodically(*dur, move || engine.increment_epoch());
1157 }
1158
1159 let mut imports = Vec::new();
1162 for import in module.imports() {
1163 let item = match import.ty() {
1164 ExternType::Func(ty) => {
1165 let poll_amt = take_poll_amt(&mut poll_amts);
1166 Func::new_async(&mut store, ty.clone(), move |caller, _, results| {
1167 let ty = ty.clone();
1168 Box::new(async move {
1169 caller.engine().increment_epoch();
1170 log::info!("yielding {poll_amt} times in import");
1171 YieldN(poll_amt).await;
1172 for (ret_ty, result) in ty.results().zip(results) {
1173 *result = ret_ty.default_value().unwrap();
1174 }
1175 Ok(())
1176 })
1177 })
1178 .into()
1179 }
1180 other_ty => match other_ty.default_value(&mut store) {
1181 Ok(item) => item,
1182 Err(e) => {
1183 log::warn!("couldn't create import for {import:?}: {e:?}");
1184 return;
1185 }
1186 },
1187 };
1188 imports.push(item);
1189 }
1190
1191 let instance = run(Timeout {
1195 future: Instance::new_async(&mut store, &module, &imports),
1196 polls: take_poll_amt(&mut poll_amts),
1197 end: Instant::now() + Duration::from_millis(2_000),
1198 });
1199 let instance = match instance {
1200 Ok(instantiation_result) => match unwrap_instance(&store, instantiation_result) {
1201 Some(instance) => instance,
1202 None => {
1203 log::info!("instantiation hit a nominal error");
1204 return; }
1206 },
1207 Err(_) => {
1208 log::info!("instantiation failed to complete");
1209 return; }
1211 };
1212
1213 let funcs = instance
1220 .exports(&mut store)
1221 .filter_map(|e| {
1222 let name = e.name().to_string();
1223 let func = e.into_extern().into_func()?;
1224 Some((name, func))
1225 })
1226 .collect::<Vec<_>>();
1227 for (name, func) in funcs {
1228 let ty = func.ty(&store);
1229 let params = ty
1230 .params()
1231 .map(|ty| ty.default_value().unwrap())
1232 .collect::<Vec<_>>();
1233 let mut results = ty
1234 .results()
1235 .map(|ty| ty.default_value().unwrap())
1236 .collect::<Vec<_>>();
1237
1238 log::info!("invoking export {name:?}");
1239 let future = func.call_async(&mut store, ¶ms, &mut results);
1240 match run(Timeout {
1241 future,
1242 polls: take_poll_amt(&mut poll_amts),
1243 end: Instant::now() + Duration::from_millis(2_000),
1244 }) {
1245 Ok(_) | Err(Exhausted::Polls) => {}
1247
1248 Err(Exhausted::Time) => return,
1252 }
1253 }
1254
1255 fn take_poll_amt(polls: &mut &[u32]) -> u32 {
1256 match polls.split_first() {
1257 Some((a, rest)) => {
1258 *polls = rest;
1259 *a
1260 }
1261 None => 0,
1262 }
1263 }
1264
1265 struct YieldN(u32);
1267
1268 impl Future for YieldN {
1269 type Output = ();
1270
1271 fn poll(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<()> {
1272 if self.0 == 0 {
1273 Poll::Ready(())
1274 } else {
1275 self.0 -= 1;
1276 cx.waker().wake_by_ref();
1277 Poll::Pending
1278 }
1279 }
1280 }
1281
1282 struct Timeout<F> {
1287 future: F,
1288 end: Instant,
1291 polls: u32,
1294 }
1295
1296 enum Exhausted {
1297 Time,
1298 Polls,
1299 }
1300
1301 impl<F: Future> Future for Timeout<F> {
1302 type Output = Result<F::Output, Exhausted>;
1303
1304 fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
1305 let (end, polls, future) = unsafe {
1306 let me = self.get_unchecked_mut();
1307 (me.end, &mut me.polls, Pin::new_unchecked(&mut me.future))
1308 };
1309 match future.poll(cx) {
1310 Poll::Ready(val) => Poll::Ready(Ok(val)),
1311 Poll::Pending => {
1312 if Instant::now() >= end {
1313 log::warn!("future operation timed out");
1314 return Poll::Ready(Err(Exhausted::Time));
1315 }
1316 if *polls == 0 {
1317 log::warn!("future operation ran out of polls");
1318 return Poll::Ready(Err(Exhausted::Polls));
1319 }
1320 *polls -= 1;
1321 Poll::Pending
1322 }
1323 }
1324 }
1325 }
1326
1327 fn run<F: Future>(future: F) -> F::Output {
1328 let mut f = Box::pin(future);
1329 let mut cx = Context::from_waker(Waker::noop());
1330 loop {
1331 match f.as_mut().poll(&mut cx) {
1332 Poll::Ready(val) => break val,
1333 Poll::Pending => {}
1334 }
1335 }
1336 }
1337}
1338
1339#[cfg(test)]
1340mod tests {
1341 use super::*;
1342 use arbitrary::Unstructured;
1343 use rand::prelude::*;
1344 use wasmparser::{Validator, WasmFeatures};
1345
1346 fn gen_until_pass<T: for<'a> Arbitrary<'a>>(
1347 mut f: impl FnMut(T, &mut Unstructured<'_>) -> Result<bool>,
1348 ) -> bool {
1349 let mut rng = SmallRng::seed_from_u64(0);
1350 let mut buf = vec![0; 2048];
1351 let n = 3000;
1352 for _ in 0..n {
1353 rng.fill_bytes(&mut buf);
1354 let mut u = Unstructured::new(&buf);
1355
1356 if let Ok(config) = u.arbitrary() {
1357 if f(config, &mut u).unwrap() {
1358 return true;
1359 }
1360 }
1361 }
1362 false
1363 }
1364
1365 fn test_n_times<T: for<'a> Arbitrary<'a>>(
1367 iters: u32,
1368 mut f: impl FnMut(T, &mut Unstructured<'_>) -> arbitrary::Result<()>,
1369 ) {
1370 let mut to_test = 0..iters;
1371 let ok = gen_until_pass(|a, b| {
1372 if f(a, b).is_ok() {
1373 Ok(to_test.next().is_none())
1374 } else {
1375 Ok(false)
1376 }
1377 });
1378 assert!(ok);
1379 }
1380
1381 #[test]
1386 fn table_ops_eventually_gcs() {
1387 if std::env::var("WASMTIME_TEST_NO_HOG_MEMORY").is_ok() {
1390 return;
1391 }
1392
1393 let ok = gen_until_pass(|(config, test), _| {
1394 let result = table_ops(config, test)?;
1395 Ok(result > 0)
1396 });
1397
1398 if !ok {
1399 panic!("gc was never found");
1400 }
1401 }
1402
1403 #[test]
1404 fn module_generation_uses_expected_proposals() {
1405 let mut expected = WasmFeatures::MUTABLE_GLOBAL
1408 | WasmFeatures::FLOATS
1409 | WasmFeatures::SIGN_EXTENSION
1410 | WasmFeatures::SATURATING_FLOAT_TO_INT
1411 | WasmFeatures::MULTI_VALUE
1412 | WasmFeatures::BULK_MEMORY
1413 | WasmFeatures::REFERENCE_TYPES
1414 | WasmFeatures::SIMD
1415 | WasmFeatures::MULTI_MEMORY
1416 | WasmFeatures::RELAXED_SIMD
1417 | WasmFeatures::THREADS
1418 | WasmFeatures::TAIL_CALL
1419 | WasmFeatures::WIDE_ARITHMETIC
1420 | WasmFeatures::MEMORY64
1421 | WasmFeatures::FUNCTION_REFERENCES
1422 | WasmFeatures::GC
1423 | WasmFeatures::GC_TYPES
1424 | WasmFeatures::CUSTOM_PAGE_SIZES
1425 | WasmFeatures::EXTENDED_CONST
1426 | WasmFeatures::EXCEPTIONS;
1427
1428 let unexpected = WasmFeatures::all() ^ expected;
1434
1435 let ok = gen_until_pass(|config: generators::Config, u| {
1436 let wasm = config.generate(u, None)?.to_bytes();
1437
1438 Validator::new_with_features(WasmFeatures::all()).validate_all(&wasm)?;
1440
1441 for feature in unexpected.iter() {
1444 let ok =
1445 Validator::new_with_features(WasmFeatures::all() ^ feature).validate_all(&wasm);
1446 if ok.is_err() {
1447 anyhow::bail!("generated a module with {feature:?} but that wasn't expected");
1448 }
1449 }
1450
1451 for feature in expected.iter() {
1455 let ok =
1456 Validator::new_with_features(WasmFeatures::all() ^ feature).validate_all(&wasm);
1457 if ok.is_err() {
1458 expected ^= feature;
1459 }
1460 }
1461
1462 Ok(expected.is_empty())
1463 });
1464
1465 if !ok {
1466 panic!("never generated wasm module using {expected:?}");
1467 }
1468 }
1469
1470 #[test]
1471 fn wast_smoke_test() {
1472 test_n_times(50, |(), u| super::wast_test(u));
1473 }
1474}