Skip to content

PreserveImportsExportsJS Fuzzer: Fix reduction#8621

Open
kripken wants to merge 7 commits intoWebAssembly:mainfrom
kripken:fuzz.piejs
Open

PreserveImportsExportsJS Fuzzer: Fix reduction#8621
kripken wants to merge 7 commits intoWebAssembly:mainfrom
kripken:fuzz.piejs

Conversation

@kripken
Copy link
Copy Markdown
Member

@kripken kripken commented Apr 17, 2026

This fuzzer generates its own files, so reducing it needs some hacks,
unfortunately. Another option might be to separate this fuzzer out
entirely to its own file, or to at least not run multiple fuzzers on the
same testcase (see below), but I'm not sure those are better options.

When the main fuzzer runs multiple internal testcase handlers on a
single wasm file, we must make sure while reducing that only
PreserveImportsExportsJS receives its wasm. That wasm only works
with its JS, so other fuzzers will fail on it. To do so, use an env var
BINARYEN_PIEJS_WASM which tells the fuzzer we are reducing
in such a situation. The fuzzer reduction script then passes in the
reduced file that way, rather than the usual way, so other fuzzers
do not notice it.

Also rename orig.wasm to initial.wasm as this was confusing
given that reduction always starts from original.wasm.

@kripken kripken requested a review from a team as a code owner April 17, 2026 16:37
@kripken kripken requested review from aheejin and removed request for a team April 17, 2026 16:37
Copy link
Copy Markdown
Member

@aheejin aheejin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Haven't read this all yet (I've got to go now) but a typo.
(In case another person LGTMs it don't wait for me)

Comment thread scripts/fuzz_opt.py
#
# Note that bugs found by this fuzzer require BINARYEN_TRUST_GIVEN_WASM=1 in the
# env for reduction. TODO: simplify this
# Note that bugs found by this fuzzer require BINARYEN_PIEJS_WASM=1 in the
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BINARYEN_PIEJS_WASM is a file name and not 0/1, based on the code below

  BINARYEN_PIEJS_WASM={temp_wasm} ./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} 

@tlively
Copy link
Copy Markdown
Member

tlively commented Apr 18, 2026

As an alternative approach, how about we give the fuzzer options to say what fuzz handler to run? Then the reducer script can specify exactly the failing handler. This would be useful for manual investigations as well. A tricky bit is that random choices in one handler should never be affected by previous handlers so that reducing the number of handlers executed does not change their behavior. This could be done by snapshotting the random state before executing each handler and restoring it afterward.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants