Skip to content

Fuzzer support for br_on_cast_desc_eq #8935

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tlively merged 2 commits into from
Jul 24, 2026
Merged

Fuzzer support for br_on_cast_desc_eq #8935

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8610aed
Fuzzer support for br_on_cast_desc_eq
tlively Jul 24, 2026
f753c76
update tests
tlively Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions src/tools/fuzzing/fuzzing.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5813,8 +5813,18 @@ Expression* TranslateToFuzzReader::makeBrOn(Type type) {
WASM_UNREACHABLE("bad br_on op");
}
}
return fixFlowingType(
builder.makeBrOn(op, targetName, make(refType), castType));
auto* ref = make(refType);
if (op == BrOnCast || op == BrOnCastFail) {
auto desc = castType.getHeapType().getDescriptorType();
if (desc && !oneIn(2)) {
auto descOp = op == BrOnCast ? BrOnCastDescEq : BrOnCastDescEqFail;
auto descType = Type(*desc, Nullable, castType.getExactness());
auto* descRef = makeTrappingRefUse(descType);
auto* brOn = builder.makeBrOn(descOp, targetName, ref, castType, descRef);
return fixFlowingType(brOn);
}
}
return fixFlowingType(builder.makeBrOn(op, targetName, ref, castType));
}

Expression* TranslateToFuzzReader::makeContBind(Type type) {
Expand Down
3 changes: 2 additions & 1 deletion src/wasm/wasm-validator.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3304,7 +3304,8 @@ void FunctionValidator::visitBrOn(BrOn* curr) {
curr->castType.isCastable(), curr, "br_on cannot cast to invalid type");
}

if (curr->ref->type == Type::unreachable) {
if (curr->type == Type::unreachable ||
(curr->desc && curr->desc->type == Type::unreachable)) {
return;
}
if (!shouldBeTrue(
Expand Down
2 changes: 1 addition & 1 deletion test/lit/help/wasm-as.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
;; CHECK-NEXT: purposes.
;; CHECK-NEXT:
;; CHECK-NEXT: --emit-module-names Emit module names, even if not emitting
;; CHECK-NEXT: the rest of the names section
;; CHECK-NEXT: the rest of the names section.
;; CHECK-NEXT:
;; CHECK-NEXT: --enable-sign-ext Enable sign extension operations
;; CHECK-NEXT:
Expand Down
2 changes: 1 addition & 1 deletion test/lit/help/wasm-ctor-eval.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@
;; CHECK-NEXT: purposes.
;; CHECK-NEXT:
;; CHECK-NEXT: --emit-module-names Emit module names, even if not emitting
;; CHECK-NEXT: the rest of the names section
;; CHECK-NEXT: the rest of the names section.
;; CHECK-NEXT:
;; CHECK-NEXT: --enable-sign-ext Enable sign extension operations
;; CHECK-NEXT:
Expand Down
2 changes: 1 addition & 1 deletion test/lit/help/wasm-dis.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
;; CHECK-NEXT: purposes.
;; CHECK-NEXT:
;; CHECK-NEXT: --emit-module-names Emit module names, even if not emitting
;; CHECK-NEXT: the rest of the names section
;; CHECK-NEXT: the rest of the names section.
;; CHECK-NEXT:
;; CHECK-NEXT: --enable-sign-ext Enable sign extension operations
;; CHECK-NEXT:
Expand Down
2 changes: 1 addition & 1 deletion test/lit/help/wasm-emscripten-finalize.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@
;; CHECK-NEXT: purposes.
;; CHECK-NEXT:
;; CHECK-NEXT: --emit-module-names Emit module names, even if not emitting
;; CHECK-NEXT: the rest of the names section
;; CHECK-NEXT: the rest of the names section.
;; CHECK-NEXT:
;; CHECK-NEXT: --enable-sign-ext Enable sign extension operations
;; CHECK-NEXT:
Expand Down
2 changes: 1 addition & 1 deletion test/lit/help/wasm-merge.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@
;; CHECK-NEXT: purposes.
;; CHECK-NEXT:
;; CHECK-NEXT: --emit-module-names Emit module names, even if not emitting
;; CHECK-NEXT: the rest of the names section
;; CHECK-NEXT: the rest of the names section.
;; CHECK-NEXT:
;; CHECK-NEXT: --enable-sign-ext Enable sign extension operations
;; CHECK-NEXT:
Expand Down
2 changes: 1 addition & 1 deletion test/lit/help/wasm-metadce.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -703,7 +703,7 @@
;; CHECK-NEXT:
;; CHECK-NEXT: --emit-module-names Emit module names, even if not
;; CHECK-NEXT: emitting the rest of the names
;; CHECK-NEXT: section
;; CHECK-NEXT: section.
;; CHECK-NEXT:
;; CHECK-NEXT: --enable-sign-ext Enable sign extension operations
;; CHECK-NEXT:
Expand Down
2 changes: 1 addition & 1 deletion test/lit/help/wasm-opt.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -739,7 +739,7 @@
;; CHECK-NEXT:
;; CHECK-NEXT: --emit-module-names Emit module names, even if not
;; CHECK-NEXT: emitting the rest of the names
;; CHECK-NEXT: section
;; CHECK-NEXT: section.
;; CHECK-NEXT:
;; CHECK-NEXT: --enable-sign-ext Enable sign extension operations
;; CHECK-NEXT:
Expand Down
2 changes: 1 addition & 1 deletion test/lit/help/wasm-reduce.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@
;; CHECK-NEXT: purposes.
;; CHECK-NEXT:
;; CHECK-NEXT: --emit-module-names Emit module names, even if not emitting
;; CHECK-NEXT: the rest of the names section
;; CHECK-NEXT: the rest of the names section.
;; CHECK-NEXT:
;; CHECK-NEXT: --enable-sign-ext Enable sign extension operations
;; CHECK-NEXT:
Expand Down
2 changes: 1 addition & 1 deletion test/lit/help/wasm-split.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,7 @@
;; CHECK-NEXT: purposes.
;; CHECK-NEXT:
;; CHECK-NEXT: --emit-module-names Emit module names, even if not emitting
;; CHECK-NEXT: the rest of the names section
;; CHECK-NEXT: the rest of the names section.
;; CHECK-NEXT:
;; CHECK-NEXT: --enable-sign-ext Enable sign extension operations
;; CHECK-NEXT:
Expand Down
2 changes: 1 addition & 1 deletion test/lit/help/wasm2js.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -667,7 +667,7 @@
;; CHECK-NEXT:
;; CHECK-NEXT: --emit-module-names Emit module names, even if not
;; CHECK-NEXT: emitting the rest of the names
;; CHECK-NEXT: section
;; CHECK-NEXT: section.
;; CHECK-NEXT:
;; CHECK-NEXT: --enable-sign-ext Enable sign extension operations
;; CHECK-NEXT:
Expand Down
2 changes: 1 addition & 1 deletion test/lit/passes/dae2-results.wast
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -351,4 +351,4 @@
(func $main
(call $caller)
)
)
)
160 changes: 81 additions & 79 deletions test/passes/translate-to-fuzz_all-features_metrics_noprint.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,91 +1,93 @@
Metrics
total
[exports] : 170
[funcs] : 280
[exports] : 100
[funcs] : 190
[globals] : 13
[imports] : 13
[memories] : 1
[memory-data] : 31
[table-data] : 86
[table-data] : 50
[tables] : 2
[tags] : 2
[total] : 74878
[vars] : 4958
ArrayCmpxchg : 60
ArrayCopy : 33
ArrayFill : 32
ArrayGet : 367
ArrayLen : 578
ArrayNew : 1160
ArrayNewFixed : 413
ArrayRMW : 60
ArraySet : 52
AtomicCmpxchg : 49
AtomicFence : 84
AtomicNotify : 42
AtomicRMW : 47
Binary : 3896
Block : 6899
BrOn : 272
Break : 1013
Call : 1184
CallIndirect : 213
CallRef : 221
Const : 11751
ContNew : 32
[total] : 63848
[vars] : 4419
ArrayCmpxchg : 50
ArrayCopy : 22
ArrayFill : 30
ArrayGet : 302
ArrayLen : 473
ArrayNew : 920
ArrayNewFixed : 307
ArrayRMW : 43
ArraySet : 54
AtomicCmpxchg : 39
AtomicFence : 66
AtomicNotify : 36
AtomicRMW : 31
Binary : 3087
Block : 5531
BrOn : 267
Break : 784
Call : 809
CallIndirect : 169
CallRef : 203
Const : 9748
ContBind : 1
ContNew : 25
DataDrop : 13
Drop : 496
GlobalGet : 4034
GlobalSet : 2294
I31Get : 56
If : 2582
Load : 356
LocalGet : 6322
LocalSet : 4039
Loop : 865
MemoryCopy : 17
MemoryFill : 17
MemoryInit : 15
Nop : 629
Pop : 320
RefAs : 4047
RefCast : 167
RefEq : 341
RefFunc : 1204
RefGetDesc : 54
RefI31 : 661
RefIsNull : 74
RefNull : 5231
RefTest : 103
Return : 373
SIMDExtract : 163
SIMDLoad : 5
Drop : 500
GlobalGet : 3399
GlobalSet : 1747
I31Get : 54
If : 2044
Load : 274
LocalGet : 6304
LocalSet : 3289
Loop : 681
MemoryCopy : 19
MemoryFill : 15
MemoryInit : 21
Nop : 586
Pop : 265
RefAs : 3780
RefCast : 132
RefEq : 296
RefFunc : 1049
RefGetDesc : 37
RefI31 : 638
RefIsNull : 61
RefNull : 4652
RefTest : 63
Return : 314
SIMDExtract : 138
SIMDLoad : 3
SIMDReplace : 3
SIMDShift : 4
SIMDShuffle : 4
SIMDTernary : 2
Select : 312
Store : 149
StringConcat : 2
StringConst : 447
StringEncode : 63
StringEq : 66
StringMeasure : 55
StringNew : 5
StringWTF16Get : 77
StructCmpxchg : 49
StructGet : 512
StructNew : 5149
StructRMW : 61
SIMDShift : 1
SIMDShuffle : 1
SIMDTernary : 3
Select : 276
Store : 128
StringConcat : 1
StringConst : 345
StringEncode : 56
StringEq : 53
StringMeasure : 60
StringNew : 3
StringSliceWTF : 1
StringWTF16Get : 55
StructCmpxchg : 58
StructGet : 477
StructNew : 5073
StructRMW : 42
StructSet : 67
Switch : 10
TableGet : 2
TableSet : 76
Throw : 74
Switch : 8
TableGet : 1
TableSet : 64
Throw : 46
ThrowRef : 5
Try : 421
TryTable : 482
TupleExtract : 238
TupleMake : 296
Unary : 2139
Unreachable : 1172
Try : 340
TryTable : 362
TupleExtract : 160
TupleMake : 179
Unary : 1715
Unreachable : 894
Loading