Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 34 additions & 19 deletions scripts/fuzz_opt.py
Original file line number Diff line number Diff line change
Expand Up @@ -2107,20 +2107,22 @@ def get_relevant_lines(wat):
# This reads wasm+js combinations from the test/js_wasm directory, so as new
# testcases are added there, this will fuzz them.
#
# Note that bugs found by this fuzzer require BINARYEN_TRUST_GIVEN_WASM=1 in the
# env for reduction. TODO: simplify this
# Note that bugs found by this fuzzer require BINARYEN_PIEJS_WASM=1 in the
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BINARYEN_PIEJS_WASM is a file name and not 0/1, based on the code below

  BINARYEN_PIEJS_WASM={temp_wasm} ./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} 

# env for reduction. TODO: simplify this, and show it when the fuzzer prints out
# the command to reduce.
class PreserveImportsExportsJS(TestCaseHandler):
frequency = 1

def handle_pair(self, input, before_wasm, after_wasm, opts):
try:
self.do_handle_pair(input, before_wasm, after_wasm, opts)
except Exception as e:
if not os.environ.get('BINARYEN_TRUST_GIVEN_WASM'):
# We errored, and we were not given a wasm file to trust as we
# reduce, so this is the first time we hit an error. Save the
if not os.environ.get('BINARYEN_PIEJS_WASM'):
# We errored, and we were not in the middle of reducing a given
# file, so this is the first time we hit an error. Save the
# pre wasm file, the one we began with, as `before_wasm`, so
# that the reducer will make us proceed exactly from there.
print(f'copying {self.pre_wasm} to original for reduction: {before_wasm}')
shutil.copyfile(self.pre_wasm, before_wasm)
raise e

Expand Down Expand Up @@ -2151,9 +2153,9 @@ def do_handle_pair(self, input, before_wasm, after_wasm, opts):

# Make sure the testcase runs by itself - there should be no invalid
# testcases.
original_wasm = 'orig.wasm'
run([in_bin('wasm-opt'), wat_file, '-o', original_wasm] + FEATURE_OPTS)
D8().run_js(js_file, original_wasm)
initial_wasm = 'initial.wasm'
run([in_bin('wasm-opt'), wat_file, '-o', initial_wasm] + FEATURE_OPTS)
D8().run_js(js_file, initial_wasm)

# Modify the initial wat to get the pre-optimizations wasm.
pre_wasm = abspath('pre.wasm')
Expand All @@ -2172,9 +2174,10 @@ def do_handle_pair(self, input, before_wasm, after_wasm, opts):
# If we were given a wasm file, use that instead of all the above. We
# do this now, after creating pre_wasm, because we still need to consume
# all the randomness normally.
if os.environ.get('BINARYEN_TRUST_GIVEN_WASM'):
print('using given wasm', before_wasm)
pre_wasm = before_wasm
given_wasm = os.environ.get('BINARYEN_PIEJS_WASM')
if given_wasm:
print('using BINARYEN_PIEJS_WASM', given_wasm)
pre_wasm = given_wasm

# Pick a vm and run before we optimize the wasm.
vms = [
Expand Down Expand Up @@ -2866,7 +2869,12 @@ def get_random_opts():
# longer working on the original test case but modified one, which
# is likely to be called within wasm-reduce script itself, so
# original.wasm and reduce.sh should not be overwritten.
if not given_wasm:
#
# We must also consider the case of BINARYEN_PIEJS_WASM as us being
# given a wasm file. We are given one in this case, but only for
# that particular fuzzer, hence it is passed in through an env var
# and not the usual mechanism.
if not given_wasm and not os.environ.get('BINARYEN_PIEJS_WASM'):
# We can't do this if a.wasm doesn't exist, which can be the
# case if we failed to even generate the wasm.
if not os.path.exists('a.wasm'):
Expand All @@ -2892,6 +2900,7 @@ def get_random_opts():
# the side, so that we can autoreduce using the name "a.wasm"
# which we use internally)
original_wasm = abspath('original.wasm')
print(f'copying a.wasm to original for reduction: {original_wasm}')
shutil.copyfile('a.wasm', original_wasm)
# write out a useful reduce.sh
auto_init = ''
Expand All @@ -2913,14 +2922,21 @@ def get_random_opts():

echo "The following value should be >0:"

if [ -z "$BINARYEN_FIRST_WASM" ]; then
# run the command normally
./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} {seed} {temp_wasm} > o 2> e
else
# BINARYEN_FIRST_WASM was provided so we should actually reduce the *second*
if [ -n "$BINARYEN_FIRST_WASM" ]; then
# BINARYEN_FIRST_WASM was provided, so we should actually reduce the *second*
# file. pass the first one in as the main file, and use the env var for the
# second.
BINARYEN_SECOND_WASM={temp_wasm} ./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} {seed} $BINARYEN_FIRST_WASM > o 2> e
elif [ -n "$BINARYEN_PIEJS_WASM" ]; then
# BINARYEN_PIEJS_WASM was provided, so we want to give that fuzzer the actual
# file we are reducing. All other fuzzers should *not* be given this file, as
# it may not even be valid for them (that fuzzer uses special js/wasm
# combinations). We therefore provide the temp wasm file to BINARYEN_PIEJS_WASM
# and *not* as a Python argument after the seed.
BINARYEN_PIEJS_WASM={temp_wasm} ./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} {seed} > o 2> e
else
# run the command normally
./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} {seed} {temp_wasm} > o 2> e
fi

echo " " $?
Expand Down Expand Up @@ -2948,8 +2964,7 @@ def get_random_opts():
#
# You may also need to add --timeout 5 or such if the testcase is a slow one.
#
# If the testcase handler uses a second wasm file, you may be able to reduce it
# using BINARYEN_SECOND_WASM.
# For reducing Two and PreserveImportsExportsJS, see the comments there.
#
''')

Expand Down
Loading