Fuzzing support for waitqueue instructions

Author: stevenfontanella

src/tools/fuzzing.h

@@ -220,6 +220,9 @@ class TranslateToFuzzReader {
   // All struct fields that are mutable.
   std::vector<StructField> mutableStructFields;
 
+  // All struct fields that can be waited on.
+  std::vector<StructField> structWaitFields;
+
   // All arrays that are mutable.
   std::vector<HeapType> mutableArrays;
 
@@ -560,6 +563,8 @@ class TranslateToFuzzReader {
   Expression* makeStructRMW(Type type);
   Expression* makeStructCmpxchg(Type type);
   Expression* makeStructSet(Type type);
+  Expression* makeStructWait(Type type);
+  Expression* makeWaitqueueNotify(Type type);
   Expression* makeArrayGet(Type type);
   Expression* makeArraySet(Type type);
   Expression* makeArrayRMW(Type type);

src/tools/fuzzing/fuzzing.cpp

@@ -603,11 +603,19 @@ void TranslateToFuzzReader::setupHeapTypes() {
         interestingHeapSubTypes[struct_].push_back(type);
         interestingHeapSubTypes[eq].push_back(type);
         interestingHeapSubTypes[any].push_back(type);
-        // Note the mutable fields.
-        auto& fields = type.getStruct().fields;
+        // Note the mutable fields and fields that can be waited on.
+        const auto& fields = type.getStruct().fields;
         for (Index i = 0; i < fields.size(); i++) {
           if (fields[i].mutable_) {
-            mutableStructFields.push_back(StructField{type, i});
+            mutableStructFields.emplace_back(type, i);
+          }
+          if (!fields[i].isPacked()) {
+            auto fieldType = fields[i].type;
+            if (fieldType == Type::i32 || fieldType == Type::i64 ||
+                Type::isSubType(
+                  fieldType, Type(HeapTypes::eq.getBasic(Shared), Nullable))) {
+              structWaitFields.emplace_back(type, i);
+            }
           }
         }
         break;
@@ -1752,6 +1760,18 @@ void TranslateToFuzzReader::processFunctions() {
     }
   }
 
+  // if (!ATOMIC_WAITS) {
+  //   for (auto& func : wasm.functions) {
+  //     if (!func->imported()) {
+  //       for (auto* wait : FindAll<StructWait>(func->body).list) {
+  //         if (wait->timeout->type == Type::i64) {
+  //           wait->timeout = builder.makeConst(int64_t(0));
+  //         }
+  //       }
+  //     }
+  //   }
+  // }
+
   // Also fix up closed world, if we need to. We must do this at the end, so
   // nothing can break the closed world assumptions after.
   if (worldMode == WorldMode::Closed) {
@@ -1901,6 +1921,13 @@ void TranslateToFuzzReader::addHangLimitChecks(Function* func) {
         AndInt32, arrayNew->size, builder.makeConst(int32_t(1024 - 1)));
     }
   }
+  if (!ATOMIC_WAITS) {
+    for (auto* wait : FindAll<StructWait>(func->body).list) {
+      if (wait->timeout->type == Type::i64) {
+        wait->timeout = builder.makeConst(int64_t(0));
+      }
+    }
+  }
 }
 
 void TranslateToFuzzReader::recombine(Function* func) {
@@ -2436,6 +2463,14 @@ void TranslateToFuzzReader::fixAfterChanges(Function* func) {
   } fixer(wasm, *this);
   fixer.walk(func->body);
 
+  // if (!ATOMIC_WAITS) {
+  //   for (auto* wait : FindAll<StructWait>(func->body).list) {
+  //     if (wait->timeout->type == Type::i64) {
+  //       wait->timeout = builder.makeConst(int64_t(0));
+  //     }
+  //   }
+  // }
+
   // Refinalize at the end, after labels are all fixed up.
   ReFinalize().walkFunctionInModule(func, &wasm);
 }
@@ -2881,6 +2916,13 @@ Expression* TranslateToFuzzReader::_makeConcrete(Type type) {
                 &Self::makeStringEq,
                 &Self::makeStringMeasure,
                 &Self::makeStringGet);
+    options.add(FeatureSet::ReferenceTypes | FeatureSet::SharedEverything,
+                &Self::makeWaitqueueNotify);
+    if (!structWaitFields.empty()) {
+      options.add(FeatureSet::ReferenceTypes | FeatureSet::GC |
+                    FeatureSet::SharedEverything,
+                  &Self::makeStructWait);
+    }
   }
   if (type == Type::i64) {
     options.add(FeatureSet::WideArithmetic | FeatureSet::Multivalue,
@@ -4407,17 +4449,20 @@ Expression* TranslateToFuzzReader::makeBasicRef(Type type) {
     case HeapType::noext:
     case HeapType::nofunc:
     case HeapType::nocont:
-    case HeapType::noexn: {
+    case HeapType::noexn:
+    case HeapType::nowaitqueue: {
       auto null = builder.makeRefNull(heapType.getBasic(share));
       if (!type.isNullable()) {
         return builder.makeRefAs(RefAsNonNull, null);
       }
       return null;
     }
 
-    case HeapType::waitqueue:
-    case HeapType::nowaitqueue: {
-      WASM_UNREACHABLE("waitqueue is unimplemented in the fuzzer");
+    case HeapType::waitqueue: {
+      if (type.isNullable() && oneIn(2)) {
+        return builder.makeRefNull(HeapTypes::sharedWaitqueue.getBasic(share));
+      }
+      return builder.makeWaitqueueNew();
     }
   }
   WASM_UNREACHABLE("invalid basic ref type");
@@ -6060,8 +6105,8 @@ Expression* TranslateToFuzzReader::makeStructSet(Type type) {
     return makeTrivial(type);
   }
   auto [structType, fieldIndex] = pick(mutableStructFields);
-  auto fieldType = structType.getStruct().fields[fieldIndex].type;
   auto* ref = makeTrappingRefUse(structType);
+  auto fieldType = structType.getStruct().fields[fieldIndex].type;
   auto* value = make(fieldType);
   auto order = MemoryOrder::Unordered;
   if (wasm.features.hasAtomics() && wasm.features.hasSharedEverything() &&
@@ -6071,6 +6116,35 @@ Expression* TranslateToFuzzReader::makeStructSet(Type type) {
   return builder.makeStructSet(fieldIndex, ref, value, order);
 }
 
+Expression* TranslateToFuzzReader::makeStructWait(Type type) {
+  assert(type == Type::i32);
+  assert(!structWaitFields.empty());
+  auto [structType, fieldIndex] = pick(structWaitFields);
+  auto* ref = makeTrappingRefUse(structType);
+  auto* waitqueue =
+    makeTrappingRefUse(Type(HeapTypes::sharedWaitqueue, Nullable));
+  auto expectedType = structType.getStruct().fields[fieldIndex].type;
+  if (expectedType.isRef()) {
+    expectedType = Type(HeapTypes::eq.getBasic(Shared), Nullable);
+  }
+  auto* expected = make(expectedType);
+  Expression* timeout = nullptr;
+  if (ATOMIC_WAITS && oneIn(2)) {
+    timeout = make(Type::i64);
+  } else {
+    timeout = builder.makeConst(int64_t{0});
+  }
+  return builder.makeStructWait(fieldIndex, ref, waitqueue, expected, timeout);
+}
+
+Expression* TranslateToFuzzReader::makeWaitqueueNotify(Type type) {
+  assert(type == Type::i32);
+  auto* waitqueue =
+    makeTrappingRefUse(Type(HeapTypes::sharedWaitqueue, Nullable));
+  auto* count = make(Type::i32);
+  return builder.makeWaitqueueNotify(waitqueue, count);
+}
+
 // Make a bounds check for an array operation, given a ref + index. An optional
 // additional length parameter can be provided, which is added to the index if
 // so (that is useful for something like array.fill, which operations on not a
@@ -6705,11 +6779,11 @@ HeapType TranslateToFuzzReader::getSubType(HeapType type) {
       case HeapType::nofunc:
       case HeapType::nocont:
       case HeapType::noexn:
+      case HeapType::nowaitqueue:
         break;
       case HeapType::waitqueue:
-      case HeapType::nowaitqueue: {
-        WASM_UNREACHABLE("waitqueue is unimplemented in the fuzzer");
-      }
+        return pick(HeapTypes::sharedWaitqueue, HeapTypes::sharedNowaitqueue)
+          .getBasic(share);
     }
   }
   // Look for an interesting subtype.

src/tools/fuzzing/heap-types.cpp

@@ -344,6 +344,9 @@ struct HeapTypeGeneratorImpl {
       if (features.hasStackSwitching() && share == Unshared) {
         bottoms.push_back(HeapType::nocont);
       }
+      if (features.hasSharedEverything() && share == Shared) {
+        bottoms.push_back(HeapType::nowaitqueue);
+      }
       return rand.pick(bottoms).getBasic(share);
     }
 
@@ -366,6 +369,9 @@ struct HeapTypeGeneratorImpl {
     if (features.hasExceptionHandling() && share == Unshared) {
       options.push_back(HeapType::exn);
     }
+    if (features.hasSharedEverything() && share == Shared) {
+      options.push_back(HeapType::waitqueue);
+    }
     auto ht = rand.pick(options);
     return ht.getBasic(share);
   }
@@ -691,11 +697,13 @@ struct HeapTypeGeneratorImpl {
         case HeapType::nofunc:
         case HeapType::nocont:
         case HeapType::noexn:
+        case HeapType::nowaitqueue:
           return type;
         case HeapType::waitqueue:
-        case HeapType::nowaitqueue: {
-          WASM_UNREACHABLE("waitqueue is unimplemented in the fuzzer");
-        }
+          if (rand.oneIn(2)) {
+            return HeapTypes::sharedNowaitqueue.getBasic(share);
+          }
+          return type;
       }
       WASM_UNREACHABLE("unexpected type");
     }
@@ -743,6 +751,7 @@ struct HeapTypeGeneratorImpl {
       case HeapType::exn:
       case HeapType::cont:
       case HeapType::any:
+      case HeapType::waitqueue:
         break;
       case HeapType::eq:
         candidates.push_back(HeapTypes::any.getBasic(share));
@@ -768,10 +777,9 @@ struct HeapTypeGeneratorImpl {
       case HeapType::noexn:
         candidates.push_back(HeapTypes::exn.getBasic(share));
         break;
-      case HeapType::waitqueue:
-      case HeapType::nowaitqueue: {
-        WASM_UNREACHABLE("waitqueue is unimplemented in the fuzzer");
-      }
+      case HeapType::nowaitqueue:
+        candidates.push_back(HeapTypes::sharedWaitqueue.getBasic(share));
+        break;
     }
     assert(!candidates.empty());
     return rand.pick(candidates);

test/lit/fuzz-types.test

@@ -1,6 +1,6 @@
 ;; RUN: wasm-fuzz-types -v --seed=3 | filecheck %s
 
-;; CHECK:      Running with seed 3
+;; CHECK:       Running with seed 3
 ;; CHECK-NEXT: Built 20 types:
 ;; CHECK-NEXT: (rec
 ;; CHECK-NEXT:  (type $0 (sub (shared (func (param i64 f64 exnref (ref null $0)) (result (ref cont))))))