-
Notifications
You must be signed in to change notification settings - Fork 821
Improve fuzzing of Two #8006
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Improve fuzzing of Two #8006
Changes from 21 commits
3a436dd
73579e8
7bd42a1
c6c0727
48e038f
63f54be
c896f7c
eb7c349
157b75b
17c51f9
01ed1fa
e3bb71c
b201477
3c9f590
592b021
3b8ffa4
05eb34a
b41b2bc
ff450c7
76829f8
ab7d9b0
9511513
acb2dbb
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -1786,32 +1786,53 @@ def ensure(self): | |
| # Tests linking two wasm files at runtime, and that optimizations do not break | ||
| # anything. This is similar to Split(), but rather than split a wasm file into | ||
| # two and link them at runtime, this starts with two separate wasm files. | ||
| # | ||
| # Fuzzing failures here is a little trickier, as there are two wasm files. | ||
| # You can reduce the primary file by finding the secondary one in the log | ||
| # (usually out/test/second.wasm), copy that to the side, and add | ||
| # | ||
| # BINARYEN_SECOND_WASM=${saved_second} | ||
| # | ||
| # in the env. That will keep the secondary wasm fixed as you reduce the primary | ||
| # one. | ||
| # | ||
| # Note it may be better to reduce the second one first, so it imports less from | ||
| # the first (otherwise, when the second one imports many things, the first will | ||
| # fail to remove exports that are used). To reduce the second one, set | ||
| # | ||
| # BINARYEN_FIRST_WASM=${saved_first} | ||
| # | ||
| # The reduce.sh script will then do the right thing, using that as the first | ||
| # wasm, and reducing on the second one, if you replace "original.wasm" in the | ||
| # command with "second.wasm" as needed. | ||
| # | ||
| # In both cases, make sure to copy the files to a saved location first (do not | ||
| # use a path to the scratch files that get constantly overwritten). | ||
| class Two(TestCaseHandler): | ||
| # Run at relatively high priority, as this is the main place we check cross- | ||
| # module interactions. | ||
| frequency = 1 | ||
|
|
||
| def handle(self, wasm): | ||
| # Generate a second wasm file, unless we were given one (useful during | ||
| # reduction). | ||
| # Generate a second wasm file. (For fuzzing, we may be given one, but we | ||
| # still generate it to avoid changes to random numbers later; we just | ||
| # discard it after.) | ||
|
||
| second_wasm = abspath('second.wasm') | ||
| second_input = abspath('second_input.dat') | ||
| second_size = random_size() | ||
| make_random_input(second_size, second_input) | ||
| args = [second_input, '-ttf'] | ||
| # Most of the time, use the first wasm as an import to the second. | ||
| if random.random() < 0.8: | ||
| args += ['--fuzz-import=' + wasm] | ||
|
|
||
| given = os.environ.get('BINARYEN_SECOND_WASM') | ||
| if given: | ||
| # TODO: should we de-nan this etc. as with the primary? | ||
| shutil.copyfile(given, second_wasm) | ||
| if not given: | ||
| print('Generate second wasm') | ||
| run([in_bin('wasm-opt'), '-o', second_wasm] + args + GEN_ARGS + FEATURE_OPTS) | ||
| else: | ||
| # generate a second wasm file to merge. pick a smaller size when | ||
| # the main wasm file is smaller, so reduction shrinks this too. | ||
| wasm_size = os.stat(wasm).st_size | ||
| second_size = min(wasm_size, random_size()) | ||
|
|
||
| second_input = abspath('second_input.dat') | ||
| make_random_input(second_size, second_input) | ||
| args = [second_input, '-ttf', '-o', second_wasm] | ||
| # Most of the time, use the first wasm as an import to the second. | ||
| if random.random() < 0.8: | ||
| args += ['--fuzz-import=' + wasm] | ||
| run([in_bin('wasm-opt')] + args + GEN_ARGS + FEATURE_OPTS) | ||
| print(f'Use given second wasm {given}') | ||
| shutil.copyfile(given, second_wasm) | ||
|
|
||
| # Run the wasm. | ||
| # | ||
|
|
@@ -2590,9 +2611,18 @@ def get_random_opts(): | |
| %(wasm_opt)s %(features)s %(temp_wasm)s | ||
| echo " " $? | ||
|
|
||
| # run the command | ||
| echo "The following value should be 1:" | ||
| ./scripts/fuzz_opt.py %(auto_init)s --binaryen-bin %(bin)s %(seed)d %(temp_wasm)s > o 2> e | ||
|
|
||
| if [ -z "$BINARYEN_FIRST_WASM" ]; then | ||
| # run the command normally | ||
| ./scripts/fuzz_opt.py %(auto_init)s --binaryen-bin %(bin)s %(seed)d %(temp_wasm)s > o 2> e | ||
| else | ||
| # BINARYEN_FIRST_WASM was provided so we should actually reduce the *second* | ||
| # file. pass the first one in as the main file, and use the env var for the | ||
| # second. | ||
| BINARYEN_SECOND_WASM=%(temp_wasm)s ./scripts/fuzz_opt.py %(auto_init)s --binaryen-bin %(bin)s %(seed)d $BINARYEN_FIRST_WASM > o 2> e | ||
| fi | ||
|
|
||
| echo " " $? | ||
|
|
||
| # | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Does this mean replacing "original.wasm" in the text of reduce.sh? If not, which "original.wasm" is this referring to?
It would be useful to print these instructions in the fuzzer error message that provides the reduction command.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
"original.wasm" appears in the command that the fuzzer tells you to run. I clarified this now.