diff options
Diffstat (limited to 'third_party/rust/wasm-smith/src')
| -rw-r--r-- | third_party/rust/wasm-smith/src/component.rs | 2178 | ||||
| -rw-r--r-- | third_party/rust/wasm-smith/src/component/encode.rs | 321 | ||||
| -rw-r--r-- | third_party/rust/wasm-smith/src/config.rs | 622 | ||||
| -rw-r--r-- | third_party/rust/wasm-smith/src/core.rs | 2404 | ||||
| -rw-r--r-- | third_party/rust/wasm-smith/src/core/code_builder.rs | 7058 | ||||
| -rw-r--r-- | third_party/rust/wasm-smith/src/core/code_builder/no_traps.rs | 644 | ||||
| -rw-r--r-- | third_party/rust/wasm-smith/src/core/encode.rs | 299 | ||||
| -rw-r--r-- | third_party/rust/wasm-smith/src/core/terminate.rs | 70 | ||||
| -rw-r--r-- | third_party/rust/wasm-smith/src/lib.rs | 192 |
9 files changed, 13788 insertions, 0 deletions
diff --git a/third_party/rust/wasm-smith/src/component.rs b/third_party/rust/wasm-smith/src/component.rs new file mode 100644 index 0000000000..e18373b4f4 --- /dev/null +++ b/third_party/rust/wasm-smith/src/component.rs @@ -0,0 +1,2178 @@ +//! Generation of Wasm +//! [components](https://github.com/WebAssembly/component-model). + +// FIXME(#1000): component support in `wasm-smith` is a work in progress. +#![allow(unused_variables, dead_code)] + +use crate::{arbitrary_loop, Config}; +use arbitrary::{Arbitrary, Result, Unstructured}; +use std::collections::BTreeMap; +use std::convert::TryFrom; +use std::{ + collections::{HashMap, HashSet}, + rc::Rc, +}; +use wasm_encoder::{ComponentTypeRef, ComponentValType, PrimitiveValType, TypeBounds, ValType}; + +mod encode; + +/// A pseudo-random WebAssembly [component]. +/// +/// Construct instances of this type with [the `Arbitrary` +/// trait](https://docs.rs/arbitrary/*/arbitrary/trait.Arbitrary.html). +/// +/// [component]: https://github.com/WebAssembly/component-model/blob/ast-and-binary/design/MVP/Explainer.md +/// +/// ## Configured Generated Components +/// +/// The `Arbitrary` implementation uses the [`Config::default()`][crate::Config] +/// configuration. If you want to customize the shape of generated components, +/// create your own [`Config`][crate::Config] instance and pass it to +/// [`Component::new`][crate::Component::new]. +#[derive(Debug)] +pub struct Component { + sections: Vec<Section>, +} + +/// A builder to create a component (and possibly a whole tree of nested +/// components). +/// +/// Maintains a stack of components we are currently building, as well as +/// metadata about them. The split between `Component` and `ComponentBuilder` is +/// that the builder contains metadata that is purely used when generating +/// components and is unnecessary after we are done generating the structure of +/// the components and only need to encode an already-generated component to +/// bytes. +#[derive(Debug)] +struct ComponentBuilder { + config: Config, + + // The set of core `valtype`s that we are configured to generate. + core_valtypes: Vec<ValType>, + + // Stack of types scopes that are currently available. + // + // There is an entry in this stack for each component, but there can also be + // additional entries for module/component/instance types, each of which + // have their own scope. + // + // This stack is always non-empty and the last entry is always the current + // scope. + // + // When a particular scope can alias outer types, it can alias from any + // scope that is older than it (i.e. `types_scope[i]` can alias from + // `types_scope[j]` when `j <= i`). + types: Vec<TypesScope>, + + // The set of components we are currently building and their associated + // metadata. + components: Vec<ComponentContext>, + + // Whether we are in the final bits of generating this component and we just + // need to ensure that the minimum number of entities configured have all + // been generated. This changes the behavior of various + // `arbitrary_<section>` methods to always fill in their minimums. + fill_minimums: bool, + + // Our maximums for these entities are applied across the whole component + // tree, not per-component. + total_components: usize, + total_modules: usize, + total_instances: usize, + total_values: usize, +} + +#[derive(Debug, Clone)] +enum ComponentOrCoreFuncType { + Component(Rc<FuncType>), + Core(Rc<crate::core::FuncType>), +} + +impl ComponentOrCoreFuncType { + fn as_core(&self) -> &Rc<crate::core::FuncType> { + match self { + ComponentOrCoreFuncType::Core(t) => t, + ComponentOrCoreFuncType::Component(_) => panic!("not a core func type"), + } + } + + fn as_component(&self) -> &Rc<FuncType> { + match self { + ComponentOrCoreFuncType::Core(_) => panic!("not a component func type"), + ComponentOrCoreFuncType::Component(t) => t, + } + } +} + +#[derive(Debug, Clone)] +enum ComponentOrCoreInstanceType { + Component(Rc<InstanceType>), + Core(BTreeMap<String, crate::core::EntityType>), +} + +/// Metadata (e.g. contents of various index spaces) we keep track of on a +/// per-component basis. +#[derive(Debug)] +struct ComponentContext { + // The actual component itself. + component: Component, + + // The number of imports we have generated thus far. + num_imports: usize, + + // The set of names of imports we've generated thus far. + import_names: HashSet<String>, + + // The set of URLs of imports we've generated thus far. + import_urls: HashSet<String>, + + // This component's function index space. + funcs: Vec<ComponentOrCoreFuncType>, + + // Which entries in `funcs` are component functions? + component_funcs: Vec<u32>, + + // Which entries in `component_funcs` are component functions that only use scalar + // types? + scalar_component_funcs: Vec<u32>, + + // Which entries in `funcs` are core Wasm functions? + // + // Note that a component can't import core functions, so these entries will + // never point to a `Section::Import`. + core_funcs: Vec<u32>, + + // This component's component index space. + // + // An indirect list of all directly-nested (not transitive) components + // inside this component. + // + // Each entry is of the form `(i, j)` where `component.sections[i]` is + // guaranteed to be either + // + // * a `Section::Component` and we are referencing the component defined in + // that section (in this case `j` must also be `0`, since a component + // section can only contain a single nested component), or + // + // * a `Section::Import` and we are referencing the `j`th import in that + // section, which is guaranteed to be a component import. + components: Vec<(usize, usize)>, + + // This component's module index space. + // + // An indirect list of all directly-nested (not transitive) modules + // inside this component. + // + // Each entry is of the form `(i, j)` where `component.sections[i]` is + // guaranteed to be either + // + // * a `Section::Core` and we are referencing the module defined in that + // section (in this case `j` must also be `0`, since a core section can + // only contain a single nested module), or + // + // * a `Section::Import` and we are referencing the `j`th import in that + // section, which is guaranteed to be a module import. + modules: Vec<(usize, usize)>, + + // This component's instance index space. + instances: Vec<ComponentOrCoreInstanceType>, + + // This component's value index space. + values: Vec<ComponentValType>, +} + +impl ComponentContext { + fn empty() -> Self { + ComponentContext { + component: Component::empty(), + num_imports: 0, + import_names: HashSet::default(), + import_urls: HashSet::default(), + funcs: vec![], + component_funcs: vec![], + scalar_component_funcs: vec![], + core_funcs: vec![], + components: vec![], + modules: vec![], + instances: vec![], + values: vec![], + } + } + + fn num_modules(&self) -> usize { + self.modules.len() + } + + fn num_components(&self) -> usize { + self.components.len() + } + + fn num_instances(&self) -> usize { + self.instances.len() + } + + fn num_funcs(&self) -> usize { + self.funcs.len() + } + + fn num_values(&self) -> usize { + self.values.len() + } +} + +#[derive(Debug, Default)] +struct TypesScope { + // All core types in this scope, regardless of kind. + core_types: Vec<Rc<CoreType>>, + + // The indices of all the entries in `core_types` that are core function types. + core_func_types: Vec<u32>, + + // The indices of all the entries in `core_types` that are module types. + module_types: Vec<u32>, + + // All component types in this index space, regardless of kind. + types: Vec<Rc<Type>>, + + // The indices of all the entries in `types` that are defined value types. + defined_types: Vec<u32>, + + // The indices of all the entries in `types` that are func types. + func_types: Vec<u32>, + + // A map from function types to their indices in the types space. + func_type_to_indices: HashMap<Rc<FuncType>, Vec<u32>>, + + // The indices of all the entries in `types` that are component types. + component_types: Vec<u32>, + + // The indices of all the entries in `types` that are instance types. + instance_types: Vec<u32>, +} + +impl TypesScope { + fn push(&mut self, ty: Rc<Type>) -> u32 { + let ty_idx = u32::try_from(self.types.len()).unwrap(); + + let kind_list = match &*ty { + Type::Defined(_) => &mut self.defined_types, + Type::Func(func_ty) => { + self.func_type_to_indices + .entry(func_ty.clone()) + .or_default() + .push(ty_idx); + &mut self.func_types + } + Type::Component(_) => &mut self.component_types, + Type::Instance(_) => &mut self.instance_types, + }; + kind_list.push(ty_idx); + + self.types.push(ty); + ty_idx + } + + fn push_core(&mut self, ty: Rc<CoreType>) -> u32 { + let ty_idx = u32::try_from(self.core_types.len()).unwrap(); + + let kind_list = match &*ty { + CoreType::Func(_) => &mut self.core_func_types, + CoreType::Module(_) => &mut self.module_types, + }; + kind_list.push(ty_idx); + + self.core_types.push(ty); + ty_idx + } + + fn get(&self, index: u32) -> &Rc<Type> { + &self.types[index as usize] + } + + fn get_core(&self, index: u32) -> &Rc<CoreType> { + &self.core_types[index as usize] + } + + fn get_func(&self, index: u32) -> &Rc<FuncType> { + match &**self.get(index) { + Type::Func(f) => f, + _ => panic!("get_func on non-function type"), + } + } + + fn can_ref_type(&self) -> bool { + // All component types and core module types may be referenced + !self.types.is_empty() || !self.module_types.is_empty() + } +} + +impl<'a> Arbitrary<'a> for Component { + fn arbitrary(u: &mut Unstructured<'a>) -> Result<Self> { + Component::new(Config::default(), u) + } +} + +#[derive(Default)] +struct EntityCounts { + globals: usize, + tables: usize, + memories: usize, + tags: usize, + funcs: usize, +} + +impl Component { + /// Construct a new `Component` using the given configuration. + pub fn new(config: Config, u: &mut Unstructured) -> Result<Self> { + let mut builder = ComponentBuilder::new(config); + builder.build(u) + } + + fn empty() -> Self { + Component { sections: vec![] } + } +} + +#[must_use] +enum Step { + Finished(Component), + StillBuilding, +} + +impl Step { + fn unwrap_still_building(self) { + match self { + Step::Finished(_) => panic!( + "`Step::unwrap_still_building` called on a `Step` that is not `StillBuilding`" + ), + Step::StillBuilding => {} + } + } +} + +impl ComponentBuilder { + fn new(config: Config) -> Self { + ComponentBuilder { + config, + core_valtypes: vec![], + types: vec![Default::default()], + components: vec![ComponentContext::empty()], + fill_minimums: false, + total_components: 0, + total_modules: 0, + total_instances: 0, + total_values: 0, + } + } + + fn build(&mut self, u: &mut Unstructured) -> Result<Component> { + self.core_valtypes = crate::core::configured_valtypes(&self.config); + + let mut choices: Vec<fn(&mut ComponentBuilder, &mut Unstructured) -> Result<Step>> = vec![]; + + loop { + choices.clear(); + choices.push(Self::finish_component); + + // Only add any choice other than "finish what we've generated thus + // far" when there is more arbitrary fuzzer data for us to consume. + if !u.is_empty() { + choices.push(Self::arbitrary_custom_section); + + // NB: we add each section as a choice even if we've already + // generated our maximum number of entities in that section so that + // we can exercise adding empty sections to the end of the module. + choices.push(Self::arbitrary_core_type_section); + choices.push(Self::arbitrary_type_section); + choices.push(Self::arbitrary_import_section); + choices.push(Self::arbitrary_canonical_section); + + if self.total_modules < self.config.max_modules { + choices.push(Self::arbitrary_core_module_section); + } + + if self.components.len() < self.config.max_nesting_depth + && self.total_components < self.config.max_components + { + choices.push(Self::arbitrary_component_section); + } + + // FIXME(#1000) + // + // choices.push(Self::arbitrary_instance_section); + // choices.push(Self::arbitrary_export_section); + // choices.push(Self::arbitrary_start_section); + // choices.push(Self::arbitrary_alias_section); + } + + let f = u.choose(&choices)?; + match f(self, u)? { + Step::StillBuilding => {} + Step::Finished(component) => { + if self.components.is_empty() { + // If we just finished the root component, then return it. + return Ok(component); + } else { + // Otherwise, add it as a nested component in the parent. + self.push_section(Section::Component(component)); + } + } + } + } + } + + fn finish_component(&mut self, u: &mut Unstructured) -> Result<Step> { + // Ensure we've generated all of our minimums. + self.fill_minimums = true; + { + if self.current_type_scope().types.len() < self.config.min_types { + self.arbitrary_type_section(u)?.unwrap_still_building(); + } + if self.component().num_imports < self.config.min_imports { + self.arbitrary_import_section(u)?.unwrap_still_building(); + } + if self.component().funcs.len() < self.config.min_funcs { + self.arbitrary_canonical_section(u)?.unwrap_still_building(); + } + } + self.fill_minimums = false; + + self.types + .pop() + .expect("should have a types scope for the component we are finishing"); + Ok(Step::Finished(self.components.pop().unwrap().component)) + } + + fn component(&self) -> &ComponentContext { + self.components.last().unwrap() + } + + fn component_mut(&mut self) -> &mut ComponentContext { + self.components.last_mut().unwrap() + } + + fn last_section(&self) -> Option<&Section> { + self.component().component.sections.last() + } + + fn last_section_mut(&mut self) -> Option<&mut Section> { + self.component_mut().component.sections.last_mut() + } + + fn push_section(&mut self, section: Section) { + self.component_mut().component.sections.push(section); + } + + fn ensure_section( + &mut self, + mut predicate: impl FnMut(&Section) -> bool, + mut make_section: impl FnMut() -> Section, + ) -> &mut Section { + match self.last_section() { + Some(sec) if predicate(sec) => {} + _ => self.push_section(make_section()), + } + self.last_section_mut().unwrap() + } + + fn arbitrary_custom_section(&mut self, u: &mut Unstructured) -> Result<Step> { + self.push_section(Section::Custom(u.arbitrary()?)); + Ok(Step::StillBuilding) + } + + fn push_type(&mut self, ty: Rc<Type>) -> u32 { + match self.ensure_section( + |s| matches!(s, Section::Type(_)), + || Section::Type(TypeSection { types: vec![] }), + ) { + Section::Type(TypeSection { types }) => { + types.push(ty.clone()); + self.current_type_scope_mut().push(ty) + } + _ => unreachable!(), + } + } + + fn push_core_type(&mut self, ty: Rc<CoreType>) -> u32 { + match self.ensure_section( + |s| matches!(s, Section::CoreType(_)), + || Section::CoreType(CoreTypeSection { types: vec![] }), + ) { + Section::CoreType(CoreTypeSection { types }) => { + types.push(ty.clone()); + self.current_type_scope_mut().push_core(ty) + } + _ => unreachable!(), + } + } + + fn arbitrary_core_type_section(&mut self, u: &mut Unstructured) -> Result<Step> { + self.push_section(Section::CoreType(CoreTypeSection { types: vec![] })); + + let min = if self.fill_minimums { + self.config + .min_types + .saturating_sub(self.current_type_scope().types.len()) + } else { + 0 + }; + + let max = self.config.max_types - self.current_type_scope().types.len(); + + arbitrary_loop(u, min, max, |u| { + let mut type_fuel = self.config.max_type_size; + let ty = self.arbitrary_core_type(u, &mut type_fuel)?; + self.push_core_type(ty); + Ok(true) + })?; + + Ok(Step::StillBuilding) + } + + fn arbitrary_core_type( + &self, + u: &mut Unstructured, + type_fuel: &mut u32, + ) -> Result<Rc<CoreType>> { + *type_fuel = type_fuel.saturating_sub(1); + if *type_fuel == 0 { + return Ok(Rc::new(CoreType::Module(Rc::new(ModuleType::default())))); + } + + let ty = match u.int_in_range::<u8>(0..=1)? { + 0 => CoreType::Func(crate::core::arbitrary_func_type( + u, + &self.config, + &self.core_valtypes, + if self.config.multi_value_enabled { + None + } else { + Some(1) + }, + 0, + )?), + 1 => CoreType::Module(self.arbitrary_module_type(u, type_fuel)?), + _ => unreachable!(), + }; + Ok(Rc::new(ty)) + } + + fn arbitrary_type_section(&mut self, u: &mut Unstructured) -> Result<Step> { + self.push_section(Section::Type(TypeSection { types: vec![] })); + + let min = if self.fill_minimums { + self.config + .min_types + .saturating_sub(self.current_type_scope().types.len()) + } else { + 0 + }; + + let max = self.config.max_types - self.current_type_scope().types.len(); + + arbitrary_loop(u, min, max, |u| { + let mut type_fuel = self.config.max_type_size; + let ty = self.arbitrary_type(u, &mut type_fuel)?; + self.push_type(ty); + Ok(true) + })?; + + Ok(Step::StillBuilding) + } + + fn arbitrary_type_ref<'a>( + &self, + u: &mut Unstructured<'a>, + for_import: bool, + for_type_def: bool, + ) -> Result<Option<ComponentTypeRef>> { + let mut choices: Vec<fn(&Self, &mut Unstructured) -> Result<ComponentTypeRef>> = Vec::new(); + let scope = self.current_type_scope(); + + if !scope.module_types.is_empty() + && (for_type_def || !for_import || self.total_modules < self.config.max_modules) + { + choices.push(|me, u| { + Ok(ComponentTypeRef::Module( + *u.choose(&me.current_type_scope().module_types)?, + )) + }); + } + + // Types cannot be imported currently + if !for_import + && !scope.types.is_empty() + && (for_type_def || scope.types.len() < self.config.max_types) + { + choices.push(|me, u| { + Ok(ComponentTypeRef::Type(TypeBounds::Eq(u.int_in_range( + 0..=u32::try_from(me.current_type_scope().types.len() - 1).unwrap(), + )?))) + }); + } + + // TODO: wasm-smith needs to ensure that every arbitrary value gets used exactly once. + // until that time, don't import values + // if for_type_def || !for_import || self.total_values < self.config.max_values() { + // choices.push(|me, u| Ok(ComponentTypeRef::Value(me.arbitrary_component_val_type(u)?))); + // } + + if !scope.func_types.is_empty() + && (for_type_def || !for_import || self.component().num_funcs() < self.config.max_funcs) + { + choices.push(|me, u| { + Ok(ComponentTypeRef::Func( + *u.choose(&me.current_type_scope().func_types)?, + )) + }); + } + + if !scope.component_types.is_empty() + && (for_type_def || !for_import || self.total_components < self.config.max_components) + { + choices.push(|me, u| { + Ok(ComponentTypeRef::Component( + *u.choose(&me.current_type_scope().component_types)?, + )) + }); + } + + if !scope.instance_types.is_empty() + && (for_type_def || !for_import || self.total_instances < self.config.max_instances) + { + choices.push(|me, u| { + Ok(ComponentTypeRef::Instance( + *u.choose(&me.current_type_scope().instance_types)?, + )) + }); + } + + if choices.is_empty() { + return Ok(None); + } + + let f = u.choose(&choices)?; + f(self, u).map(Option::Some) + } + + fn arbitrary_type(&mut self, u: &mut Unstructured, type_fuel: &mut u32) -> Result<Rc<Type>> { + *type_fuel = type_fuel.saturating_sub(1); + if *type_fuel == 0 { + return Ok(Rc::new(Type::Defined( + self.arbitrary_defined_type(u, type_fuel)?, + ))); + } + + let ty = match u.int_in_range::<u8>(0..=3)? { + 0 => Type::Defined(self.arbitrary_defined_type(u, type_fuel)?), + 1 => Type::Func(self.arbitrary_func_type(u, type_fuel)?), + 2 => Type::Component(self.arbitrary_component_type(u, type_fuel)?), + 3 => Type::Instance(self.arbitrary_instance_type(u, type_fuel)?), + _ => unreachable!(), + }; + Ok(Rc::new(ty)) + } + + fn arbitrary_module_type( + &self, + u: &mut Unstructured, + type_fuel: &mut u32, + ) -> Result<Rc<ModuleType>> { + let mut defs = vec![]; + let mut has_memory = false; + let mut has_canonical_abi_realloc = false; + let mut has_canonical_abi_free = false; + let mut types: Vec<Rc<crate::core::FuncType>> = vec![]; + let mut imports = HashMap::new(); + let mut exports = HashSet::new(); + let mut counts = EntityCounts::default(); + + // Special case the canonical ABI functions since certain types can only + // be passed across the component boundary if they exist and + // randomly generating them is extremely unlikely. + + // `memory` + if counts.memories < self.config.max_memories && u.ratio::<u8>(99, 100)? { + defs.push(ModuleTypeDef::Export( + "memory".into(), + crate::core::EntityType::Memory(self.arbitrary_core_memory_type(u)?), + )); + exports.insert("memory".into()); + counts.memories += 1; + has_memory = true; + } + + // `canonical_abi_realloc` + if counts.funcs < self.config.max_funcs + && types.len() < self.config.max_types + && u.ratio::<u8>(99, 100)? + { + let realloc_ty = Rc::new(crate::core::FuncType { + params: vec![ValType::I32, ValType::I32, ValType::I32, ValType::I32], + results: vec![ValType::I32], + }); + let ty_idx = u32::try_from(types.len()).unwrap(); + types.push(realloc_ty.clone()); + defs.push(ModuleTypeDef::TypeDef(crate::core::CompositeType::Func( + realloc_ty.clone(), + ))); + defs.push(ModuleTypeDef::Export( + "canonical_abi_realloc".into(), + crate::core::EntityType::Func(ty_idx, realloc_ty), + )); + exports.insert("canonical_abi_realloc".into()); + counts.funcs += 1; + has_canonical_abi_realloc = true; + } + + // `canonical_abi_free` + if counts.funcs < self.config.max_funcs + && types.len() < self.config.max_types + && u.ratio::<u8>(99, 100)? + { + let free_ty = Rc::new(crate::core::FuncType { + params: vec![ValType::I32, ValType::I32, ValType::I32], + results: vec![], + }); + let ty_idx = u32::try_from(types.len()).unwrap(); + types.push(free_ty.clone()); + defs.push(ModuleTypeDef::TypeDef(crate::core::CompositeType::Func( + free_ty.clone(), + ))); + defs.push(ModuleTypeDef::Export( + "canonical_abi_free".into(), + crate::core::EntityType::Func(ty_idx, free_ty), + )); + exports.insert("canonical_abi_free".into()); + counts.funcs += 1; + has_canonical_abi_free = true; + } + + let mut entity_choices: Vec< + fn( + &ComponentBuilder, + &mut Unstructured, + &mut EntityCounts, + &[Rc<crate::core::FuncType>], + ) -> Result<crate::core::EntityType>, + > = Vec::with_capacity(5); + + arbitrary_loop(u, 0, 100, |u| { + *type_fuel = type_fuel.saturating_sub(1); + if *type_fuel == 0 { + return Ok(false); + } + + let max_choice = if types.len() < self.config.max_types { + // Check if the parent scope has core function types to alias + if !types.is_empty() + || (!self.types.is_empty() + && !self.types.last().unwrap().core_func_types.is_empty()) + { + // Imports, exports, types, and aliases + 3 + } else { + // Imports, exports, and types + 2 + } + } else { + // Imports and exports + 1 + }; + + match u.int_in_range::<u8>(0..=max_choice)? { + // Import. + 0 => { + let module = crate::limited_string(100, u)?; + let existing_module_imports = imports.entry(module.clone()).or_default(); + let field = crate::unique_string(100, existing_module_imports, u)?; + let entity_type = match self.arbitrary_core_entity_type( + u, + &types, + &mut entity_choices, + &mut counts, + )? { + None => return Ok(false), + Some(x) => x, + }; + defs.push(ModuleTypeDef::Import(crate::core::Import { + module, + field, + entity_type, + })); + } + + // Export. + 1 => { + let name = crate::unique_string(100, &mut exports, u)?; + let entity_ty = match self.arbitrary_core_entity_type( + u, + &types, + &mut entity_choices, + &mut counts, + )? { + None => return Ok(false), + Some(x) => x, + }; + defs.push(ModuleTypeDef::Export(name, entity_ty)); + } + + // Type definition. + 2 => { + let ty = crate::core::arbitrary_func_type( + u, + &self.config, + &self.core_valtypes, + if self.config.multi_value_enabled { + None + } else { + Some(1) + }, + 0, + )?; + types.push(ty.clone()); + defs.push(ModuleTypeDef::TypeDef(crate::core::CompositeType::Func(ty))); + } + + // Alias + 3 => { + let (count, index, kind) = self.arbitrary_outer_core_type_alias(u, &types)?; + let ty = match &kind { + CoreOuterAliasKind::Type(ty) => ty.clone(), + }; + types.push(ty); + defs.push(ModuleTypeDef::OuterAlias { + count, + i: index, + kind, + }); + } + + _ => unreachable!(), + } + + Ok(true) + })?; + + Ok(Rc::new(ModuleType { + defs, + has_memory, + has_canonical_abi_realloc, + has_canonical_abi_free, + })) + } + + fn arbitrary_core_entity_type( + &self, + u: &mut Unstructured, + types: &[Rc<crate::core::FuncType>], + choices: &mut Vec< + fn( + &ComponentBuilder, + &mut Unstructured, + &mut EntityCounts, + &[Rc<crate::core::FuncType>], + ) -> Result<crate::core::EntityType>, + >, + counts: &mut EntityCounts, + ) -> Result<Option<crate::core::EntityType>> { + choices.clear(); + + if counts.globals < self.config.max_globals { + choices.push(|c, u, counts, _types| { + counts.globals += 1; + Ok(crate::core::EntityType::Global( + c.arbitrary_core_global_type(u)?, + )) + }); + } + + if counts.tables < self.config.max_tables { + choices.push(|c, u, counts, _types| { + counts.tables += 1; + Ok(crate::core::EntityType::Table( + c.arbitrary_core_table_type(u)?, + )) + }); + } + + if counts.memories < self.config.max_memories { + choices.push(|c, u, counts, _types| { + counts.memories += 1; + Ok(crate::core::EntityType::Memory( + c.arbitrary_core_memory_type(u)?, + )) + }); + } + + if types.iter().any(|ty| ty.results.is_empty()) + && self.config.exceptions_enabled + && counts.tags < self.config.max_tags + { + choices.push(|c, u, counts, types| { + counts.tags += 1; + let tag_func_types = types + .iter() + .enumerate() + .filter(|(_, ty)| ty.results.is_empty()) + .map(|(i, _)| u32::try_from(i).unwrap()) + .collect::<Vec<_>>(); + Ok(crate::core::EntityType::Tag( + crate::core::arbitrary_tag_type(u, &tag_func_types, |idx| { + types[usize::try_from(idx).unwrap()].clone() + })?, + )) + }); + } + + if !types.is_empty() && counts.funcs < self.config.max_funcs { + choices.push(|c, u, counts, types| { + counts.funcs += 1; + let ty_idx = u.int_in_range(0..=u32::try_from(types.len() - 1).unwrap())?; + let ty = types[ty_idx as usize].clone(); + Ok(crate::core::EntityType::Func(ty_idx, ty)) + }); + } + + if choices.is_empty() { + return Ok(None); + } + + let f = u.choose(choices)?; + let ty = f(self, u, counts, types)?; + Ok(Some(ty)) + } + + fn arbitrary_core_valtype(&self, u: &mut Unstructured) -> Result<ValType> { + Ok(*u.choose(&self.core_valtypes)?) + } + + fn arbitrary_core_global_type(&self, u: &mut Unstructured) -> Result<crate::core::GlobalType> { + Ok(crate::core::GlobalType { + val_type: self.arbitrary_core_valtype(u)?, + mutable: u.arbitrary()?, + }) + } + + fn arbitrary_core_table_type(&self, u: &mut Unstructured) -> Result<crate::core::TableType> { + crate::core::arbitrary_table_type(u, &self.config) + } + + fn arbitrary_core_memory_type(&self, u: &mut Unstructured) -> Result<crate::core::MemoryType> { + crate::core::arbitrary_memtype(u, &self.config) + } + + fn with_types_scope<T>(&mut self, f: impl FnOnce(&mut Self) -> Result<T>) -> Result<T> { + self.types.push(Default::default()); + let result = f(self); + self.types.pop(); + result + } + + fn current_type_scope(&self) -> &TypesScope { + self.types.last().unwrap() + } + + fn current_type_scope_mut(&mut self) -> &mut TypesScope { + self.types.last_mut().unwrap() + } + + fn outer_types_scope(&self, count: u32) -> &TypesScope { + &self.types[self.types.len() - 1 - usize::try_from(count).unwrap()] + } + + fn outer_type(&self, count: u32, i: u32) -> &Rc<Type> { + &self.outer_types_scope(count).types[usize::try_from(i).unwrap()] + } + + fn arbitrary_component_type( + &mut self, + u: &mut Unstructured, + type_fuel: &mut u32, + ) -> Result<Rc<ComponentType>> { + let mut defs = vec![]; + let mut imports = HashSet::new(); + let mut import_urls = HashSet::new(); + let mut exports = HashSet::new(); + let mut export_urls = HashSet::new(); + + self.with_types_scope(|me| { + arbitrary_loop(u, 0, 100, |u| { + *type_fuel = type_fuel.saturating_sub(1); + if *type_fuel == 0 { + return Ok(false); + } + + if me.current_type_scope().can_ref_type() && u.int_in_range::<u8>(0..=3)? == 0 { + if let Some(ty) = me.arbitrary_type_ref(u, true, true)? { + // Imports. + let name = crate::unique_kebab_string(100, &mut imports, u)?; + let url = if u.arbitrary()? { + Some(crate::unique_url(100, &mut import_urls, u)?) + } else { + None + }; + defs.push(ComponentTypeDef::Import(Import { name, url, ty })); + return Ok(true); + } + + // Can't reference an arbitrary type, fallback to another definition. + } + + // Type definitions, exports, and aliases. + let def = + me.arbitrary_instance_type_def(u, &mut exports, &mut export_urls, type_fuel)?; + defs.push(def.into()); + Ok(true) + }) + })?; + + Ok(Rc::new(ComponentType { defs })) + } + + fn arbitrary_instance_type( + &mut self, + u: &mut Unstructured, + type_fuel: &mut u32, + ) -> Result<Rc<InstanceType>> { + let mut defs = vec![]; + let mut exports = HashSet::new(); + let mut export_urls = HashSet::new(); + + self.with_types_scope(|me| { + arbitrary_loop(u, 0, 100, |u| { + *type_fuel = type_fuel.saturating_sub(1); + if *type_fuel == 0 { + return Ok(false); + } + + defs.push(me.arbitrary_instance_type_def( + u, + &mut exports, + &mut export_urls, + type_fuel, + )?); + Ok(true) + }) + })?; + + Ok(Rc::new(InstanceType { defs })) + } + + fn arbitrary_instance_type_def( + &mut self, + u: &mut Unstructured, + exports: &mut HashSet<String>, + export_urls: &mut HashSet<String>, + type_fuel: &mut u32, + ) -> Result<InstanceTypeDecl> { + let mut choices: Vec< + fn( + &mut ComponentBuilder, + &mut HashSet<String>, + &mut HashSet<String>, + &mut Unstructured, + &mut u32, + ) -> Result<InstanceTypeDecl>, + > = Vec::with_capacity(3); + + // Export. + if self.current_type_scope().can_ref_type() { + choices.push(|me, exports, export_urls, u, _type_fuel| { + let ty = me.arbitrary_type_ref(u, false, true)?.unwrap(); + if let ComponentTypeRef::Type(TypeBounds::Eq(idx)) = ty { + let ty = me.current_type_scope().get(idx).clone(); + me.current_type_scope_mut().push(ty); + } + Ok(InstanceTypeDecl::Export { + name: crate::unique_kebab_string(100, exports, u)?, + url: if u.arbitrary()? { + Some(crate::unique_url(100, export_urls, u)?) + } else { + None + }, + ty, + }) + }); + } + + // Outer type alias. + if self + .types + .iter() + .any(|scope| !scope.types.is_empty() || !scope.core_types.is_empty()) + { + choices.push(|me, _exports, _export_urls, u, _type_fuel| { + let alias = me.arbitrary_outer_type_alias(u)?; + match &alias { + Alias::Outer { + kind: OuterAliasKind::Type(ty), + .. + } => me.current_type_scope_mut().push(ty.clone()), + Alias::Outer { + kind: OuterAliasKind::CoreType(ty), + .. + } => me.current_type_scope_mut().push_core(ty.clone()), + _ => unreachable!(), + }; + Ok(InstanceTypeDecl::Alias(alias)) + }); + } + + // Core type definition. + choices.push(|me, _exports, _export_urls, u, type_fuel| { + let ty = me.arbitrary_core_type(u, type_fuel)?; + me.current_type_scope_mut().push_core(ty.clone()); + Ok(InstanceTypeDecl::CoreType(ty)) + }); + + // Type definition. + if self.types.len() < self.config.max_nesting_depth { + choices.push(|me, _exports, _export_urls, u, type_fuel| { + let ty = me.arbitrary_type(u, type_fuel)?; + me.current_type_scope_mut().push(ty.clone()); + Ok(InstanceTypeDecl::Type(ty)) + }); + } + + let f = u.choose(&choices)?; + f(self, exports, export_urls, u, type_fuel) + } + + fn arbitrary_outer_core_type_alias( + &self, + u: &mut Unstructured, + local_types: &[Rc<crate::core::FuncType>], + ) -> Result<(u32, u32, CoreOuterAliasKind)> { + let enclosing_type_len = if !self.types.is_empty() { + self.types.last().unwrap().core_func_types.len() + } else { + 0 + }; + + assert!(!local_types.is_empty() || enclosing_type_len > 0); + + let max = enclosing_type_len + local_types.len() - 1; + let i = u.int_in_range(0..=max)?; + let (count, index, ty) = if i < enclosing_type_len { + let enclosing = self.types.last().unwrap(); + let index = enclosing.core_func_types[i]; + ( + 1, + index, + match enclosing.get_core(index).as_ref() { + CoreType::Func(ty) => ty.clone(), + CoreType::Module(_) => unreachable!(), + }, + ) + } else if i - enclosing_type_len < local_types.len() { + let i = i - enclosing_type_len; + (0, u32::try_from(i).unwrap(), local_types[i].clone()) + } else { + unreachable!() + }; + + Ok((count, index, CoreOuterAliasKind::Type(ty))) + } + + fn arbitrary_outer_type_alias(&self, u: &mut Unstructured) -> Result<Alias> { + let non_empty_types_scopes: Vec<_> = self + .types + .iter() + .rev() + .enumerate() + .filter(|(_, scope)| !scope.types.is_empty() || !scope.core_types.is_empty()) + .collect(); + assert!( + !non_empty_types_scopes.is_empty(), + "precondition: there are non-empty types scopes" + ); + + let (count, scope) = u.choose(&non_empty_types_scopes)?; + let count = u32::try_from(*count).unwrap(); + assert!(!scope.types.is_empty() || !scope.core_types.is_empty()); + + let max_type_in_scope = scope.types.len() + scope.core_types.len() - 1; + let i = u.int_in_range(0..=max_type_in_scope)?; + + let (i, kind) = if i < scope.types.len() { + let i = u32::try_from(i).unwrap(); + (i, OuterAliasKind::Type(Rc::clone(scope.get(i)))) + } else if i - scope.types.len() < scope.core_types.len() { + let i = u32::try_from(i - scope.types.len()).unwrap(); + (i, OuterAliasKind::CoreType(Rc::clone(scope.get_core(i)))) + } else { + unreachable!() + }; + + Ok(Alias::Outer { count, i, kind }) + } + + fn arbitrary_func_type( + &self, + u: &mut Unstructured, + type_fuel: &mut u32, + ) -> Result<Rc<FuncType>> { + let mut params = Vec::new(); + let mut results = Vec::new(); + let mut names = HashSet::new(); + + // Note: parameters are currently limited to a maximum of 16 + // because any additional parameters will require indirect access + // via a pointer argument; when this occurs, validation of any + // lowered function will fail because it will be missing a + // memory option (not yet implemented). + // + // When options are correctly specified on canonical functions, + // we should increase this maximum to test indirect parameter + // passing. + arbitrary_loop(u, 0, 16, |u| { + *type_fuel = type_fuel.saturating_sub(1); + if *type_fuel == 0 { + return Ok(false); + } + + let name = crate::unique_kebab_string(100, &mut names, u)?; + let ty = self.arbitrary_component_val_type(u)?; + + params.push((name, ty)); + + Ok(true) + })?; + + names.clear(); + + // Likewise, the limit for results is 1 before the memory option is + // required. When the memory option is implemented, this restriction + // should be relaxed. + arbitrary_loop(u, 0, 1, |u| { + *type_fuel = type_fuel.saturating_sub(1); + if *type_fuel == 0 { + return Ok(false); + } + + // If the result list is empty (i.e. first push), then arbitrarily give + // the result a name. Otherwise, all of the subsequent items must be named. + let name = if results.is_empty() { + // Most of the time we should have a single, unnamed result. + u.ratio::<u8>(10, 100)? + .then(|| crate::unique_kebab_string(100, &mut names, u)) + .transpose()? + } else { + Some(crate::unique_kebab_string(100, &mut names, u)?) + }; + + let ty = self.arbitrary_component_val_type(u)?; + + results.push((name, ty)); + + // There can be only one unnamed result. + if results.len() == 1 && results[0].0.is_none() { + return Ok(false); + } + + Ok(true) + })?; + + Ok(Rc::new(FuncType { params, results })) + } + + fn arbitrary_component_val_type(&self, u: &mut Unstructured) -> Result<ComponentValType> { + let max_choices = if self.current_type_scope().defined_types.is_empty() { + 0 + } else { + 1 + }; + match u.int_in_range(0..=max_choices)? { + 0 => Ok(ComponentValType::Primitive( + self.arbitrary_primitive_val_type(u)?, + )), + 1 => { + let index = *u.choose(&self.current_type_scope().defined_types)?; + let ty = Rc::clone(self.current_type_scope().get(index)); + Ok(ComponentValType::Type(index)) + } + _ => unreachable!(), + } + } + + fn arbitrary_primitive_val_type(&self, u: &mut Unstructured) -> Result<PrimitiveValType> { + match u.int_in_range(0..=12)? { + 0 => Ok(PrimitiveValType::Bool), + 1 => Ok(PrimitiveValType::S8), + 2 => Ok(PrimitiveValType::U8), + 3 => Ok(PrimitiveValType::S16), + 4 => Ok(PrimitiveValType::U16), + 5 => Ok(PrimitiveValType::S32), + 6 => Ok(PrimitiveValType::U32), + 7 => Ok(PrimitiveValType::S64), + 8 => Ok(PrimitiveValType::U64), + 9 => Ok(PrimitiveValType::Float32), + 10 => Ok(PrimitiveValType::Float64), + 11 => Ok(PrimitiveValType::Char), + 12 => Ok(PrimitiveValType::String), + _ => unreachable!(), + } + } + + fn arbitrary_record_type( + &self, + u: &mut Unstructured, + type_fuel: &mut u32, + ) -> Result<RecordType> { + let mut fields = vec![]; + let mut field_names = HashSet::new(); + arbitrary_loop(u, 0, 100, |u| { + *type_fuel = type_fuel.saturating_sub(1); + if *type_fuel == 0 { + return Ok(false); + } + + let name = crate::unique_kebab_string(100, &mut field_names, u)?; + let ty = self.arbitrary_component_val_type(u)?; + + fields.push((name, ty)); + Ok(true) + })?; + Ok(RecordType { fields }) + } + + fn arbitrary_variant_type( + &self, + u: &mut Unstructured, + type_fuel: &mut u32, + ) -> Result<VariantType> { + let mut cases = vec![]; + let mut case_names = HashSet::new(); + arbitrary_loop(u, 1, 100, |u| { + *type_fuel = type_fuel.saturating_sub(1); + if *type_fuel == 0 { + return Ok(false); + } + + let name = crate::unique_kebab_string(100, &mut case_names, u)?; + + let ty = u + .arbitrary::<bool>()? + .then(|| self.arbitrary_component_val_type(u)) + .transpose()?; + + let refines = if !cases.is_empty() && u.arbitrary()? { + let max_cases = u32::try_from(cases.len() - 1).unwrap(); + Some(u.int_in_range(0..=max_cases)?) + } else { + None + }; + + cases.push((name, ty, refines)); + Ok(true) + })?; + + Ok(VariantType { cases }) + } + + fn arbitrary_list_type(&self, u: &mut Unstructured) -> Result<ListType> { + Ok(ListType { + elem_ty: self.arbitrary_component_val_type(u)?, + }) + } + + fn arbitrary_tuple_type(&self, u: &mut Unstructured, type_fuel: &mut u32) -> Result<TupleType> { + let mut fields = vec![]; + arbitrary_loop(u, 0, 100, |u| { + *type_fuel = type_fuel.saturating_sub(1); + if *type_fuel == 0 { + return Ok(false); + } + + fields.push(self.arbitrary_component_val_type(u)?); + Ok(true) + })?; + Ok(TupleType { fields }) + } + + fn arbitrary_flags_type(&self, u: &mut Unstructured, type_fuel: &mut u32) -> Result<FlagsType> { + let mut fields = vec![]; + let mut field_names = HashSet::new(); + arbitrary_loop(u, 0, 100, |u| { + *type_fuel = type_fuel.saturating_sub(1); + if *type_fuel == 0 { + return Ok(false); + } + + fields.push(crate::unique_kebab_string(100, &mut field_names, u)?); + Ok(true) + })?; + Ok(FlagsType { fields }) + } + + fn arbitrary_enum_type(&self, u: &mut Unstructured, type_fuel: &mut u32) -> Result<EnumType> { + let mut variants = vec![]; + let mut variant_names = HashSet::new(); + arbitrary_loop(u, 1, 100, |u| { + *type_fuel = type_fuel.saturating_sub(1); + if *type_fuel == 0 { + return Ok(false); + } + + variants.push(crate::unique_kebab_string(100, &mut variant_names, u)?); + Ok(true) + })?; + Ok(EnumType { variants }) + } + + fn arbitrary_option_type(&self, u: &mut Unstructured) -> Result<OptionType> { + Ok(OptionType { + inner_ty: self.arbitrary_component_val_type(u)?, + }) + } + + fn arbitrary_result_type(&self, u: &mut Unstructured) -> Result<ResultType> { + Ok(ResultType { + ok_ty: u + .arbitrary::<bool>()? + .then(|| self.arbitrary_component_val_type(u)) + .transpose()?, + err_ty: u + .arbitrary::<bool>()? + .then(|| self.arbitrary_component_val_type(u)) + .transpose()?, + }) + } + + fn arbitrary_defined_type( + &self, + u: &mut Unstructured, + type_fuel: &mut u32, + ) -> Result<DefinedType> { + match u.int_in_range(0..=8)? { + 0 => Ok(DefinedType::Primitive( + self.arbitrary_primitive_val_type(u)?, + )), + 1 => Ok(DefinedType::Record( + self.arbitrary_record_type(u, type_fuel)?, + )), + 2 => Ok(DefinedType::Variant( + self.arbitrary_variant_type(u, type_fuel)?, + )), + 3 => Ok(DefinedType::List(self.arbitrary_list_type(u)?)), + 4 => Ok(DefinedType::Tuple(self.arbitrary_tuple_type(u, type_fuel)?)), + 5 => Ok(DefinedType::Flags(self.arbitrary_flags_type(u, type_fuel)?)), + 6 => Ok(DefinedType::Enum(self.arbitrary_enum_type(u, type_fuel)?)), + 7 => Ok(DefinedType::Option(self.arbitrary_option_type(u)?)), + 8 => Ok(DefinedType::Result(self.arbitrary_result_type(u)?)), + _ => unreachable!(), + } + } + + fn push_import(&mut self, name: String, url: Option<String>, ty: ComponentTypeRef) { + let nth = match self.ensure_section( + |sec| matches!(sec, Section::Import(_)), + || Section::Import(ImportSection { imports: vec![] }), + ) { + Section::Import(sec) => { + sec.imports.push(Import { name, url, ty }); + sec.imports.len() - 1 + } + _ => unreachable!(), + }; + let section_index = self.component().component.sections.len() - 1; + + match ty { + ComponentTypeRef::Module(_) => { + self.total_modules += 1; + self.component_mut().modules.push((section_index, nth)); + } + ComponentTypeRef::Func(ty_index) => { + let func_ty = match self.current_type_scope().get(ty_index).as_ref() { + Type::Func(ty) => ty.clone(), + _ => unreachable!(), + }; + + if func_ty.is_scalar() { + let func_index = u32::try_from(self.component().component_funcs.len()).unwrap(); + self.component_mut().scalar_component_funcs.push(func_index); + } + + let func_index = u32::try_from(self.component().funcs.len()).unwrap(); + self.component_mut() + .funcs + .push(ComponentOrCoreFuncType::Component(func_ty)); + + self.component_mut().component_funcs.push(func_index); + } + ComponentTypeRef::Value(ty) => { + self.total_values += 1; + self.component_mut().values.push(ty); + } + ComponentTypeRef::Type(TypeBounds::Eq(ty_index)) => { + let ty = self.current_type_scope().get(ty_index).clone(); + self.current_type_scope_mut().push(ty); + } + ComponentTypeRef::Type(TypeBounds::SubResource) => { + unimplemented!() + } + ComponentTypeRef::Instance(ty_index) => { + let instance_ty = match self.current_type_scope().get(ty_index).as_ref() { + Type::Instance(ty) => ty.clone(), + _ => unreachable!(), + }; + + self.total_instances += 1; + self.component_mut() + .instances + .push(ComponentOrCoreInstanceType::Component(instance_ty)); + } + ComponentTypeRef::Component(_) => { + self.total_components += 1; + self.component_mut().components.push((section_index, nth)); + } + } + } + + fn core_function_type(&self, core_func_index: u32) -> &Rc<crate::core::FuncType> { + self.component().funcs[self.component().core_funcs[core_func_index as usize] as usize] + .as_core() + } + + fn component_function_type(&self, func_index: u32) -> &Rc<FuncType> { + self.component().funcs[self.component().component_funcs[func_index as usize] as usize] + .as_component() + } + + fn push_func(&mut self, func: Func) { + let nth = match self.component_mut().component.sections.last_mut() { + Some(Section::Canonical(CanonicalSection { funcs })) => funcs.len(), + _ => { + self.push_section(Section::Canonical(CanonicalSection { funcs: vec![] })); + 0 + } + }; + let section_index = self.component().component.sections.len() - 1; + + let func_index = u32::try_from(self.component().funcs.len()).unwrap(); + + let ty = match &func { + Func::CanonLift { func_ty, .. } => { + let ty = Rc::clone(self.current_type_scope().get_func(*func_ty)); + if ty.is_scalar() { + let func_index = u32::try_from(self.component().component_funcs.len()).unwrap(); + self.component_mut().scalar_component_funcs.push(func_index); + } + self.component_mut().component_funcs.push(func_index); + ComponentOrCoreFuncType::Component(ty) + } + Func::CanonLower { + func_index: comp_func_index, + .. + } => { + let comp_func_ty = self.component_function_type(*comp_func_index); + let core_func_ty = canonical_abi_for(comp_func_ty); + self.component_mut().core_funcs.push(func_index); + ComponentOrCoreFuncType::Core(core_func_ty) + } + }; + + self.component_mut().funcs.push(ty); + + match self.component_mut().component.sections.last_mut() { + Some(Section::Canonical(CanonicalSection { funcs })) => funcs.push(func), + _ => unreachable!(), + } + } + + fn arbitrary_import_section(&mut self, u: &mut Unstructured) -> Result<Step> { + self.push_section(Section::Import(ImportSection { imports: vec![] })); + + let min = if self.fill_minimums { + self.config + .min_imports + .saturating_sub(self.component().num_imports) + } else { + // Allow generating empty sections. We can always fill in the required + // minimum later. + 0 + }; + let max = self.config.max_imports - self.component().num_imports; + + crate::arbitrary_loop(u, min, max, |u| { + match self.arbitrary_type_ref(u, true, false)? { + Some(ty) => { + let name = + crate::unique_kebab_string(100, &mut self.component_mut().import_names, u)?; + let url = if u.arbitrary()? { + Some(crate::unique_url( + 100, + &mut self.component_mut().import_urls, + u, + )?) + } else { + None + }; + self.push_import(name, url, ty); + Ok(true) + } + None => Ok(false), + } + })?; + + Ok(Step::StillBuilding) + } + + fn arbitrary_canonical_section(&mut self, u: &mut Unstructured) -> Result<Step> { + self.push_section(Section::Canonical(CanonicalSection { funcs: vec![] })); + + let min = if self.fill_minimums { + self.config + .min_funcs + .saturating_sub(self.component().funcs.len()) + } else { + // Allow generating empty sections. We can always fill in the + // required minimum later. + 0 + }; + let max = self.config.max_funcs - self.component().funcs.len(); + + let mut choices: Vec<fn(&mut Unstructured, &mut ComponentBuilder) -> Result<Option<Func>>> = + Vec::with_capacity(2); + + crate::arbitrary_loop(u, min, max, |u| { + choices.clear(); + + // NB: We only lift/lower scalar component functions. + // + // If we generated lifting and lowering of compound value types, + // the probability of generating a corresponding Wasm module that + // generates valid instances of the compound value types would + // be vanishingly tiny (e.g. for `list<string>` we would have to + // generate a core Wasm module that correctly produces a pointer and + // length for a memory region that itself is a series of pointers + // and lengths of valid strings, as well as `canonical_abi_realloc` + // and `canonical_abi_free` functions that do the right thing). + // + // This is a pretty serious limitation of `wasm-smith`'s component + // types support, but it is one we are intentionally + // accepting. `wasm-smith` will focus on generating arbitrary + // component sections, structures, and import/export topologies; not + // component functions and core Wasm implementations of component + // functions. In the future, we intend to build a new, distinct test + // case generator specifically for exercising component functions + // and the canonical ABI. This new generator won't emit arbitrary + // component sections, structures, or import/export topologies, and + // will instead leave that to `wasm-smith`. + + if !self.component().scalar_component_funcs.is_empty() { + choices.push(|u, c| { + let func_index = *u.choose(&c.component().scalar_component_funcs)?; + Ok(Some(Func::CanonLower { + // Scalar component functions don't use any canonical options. + options: vec![], + func_index, + })) + }); + } + + if !self.component().core_funcs.is_empty() { + choices.push(|u, c| { + let core_func_index = u.int_in_range( + 0..=u32::try_from(c.component().core_funcs.len() - 1).unwrap(), + )?; + let core_func_ty = c.core_function_type(core_func_index); + let comp_func_ty = inverse_scalar_canonical_abi_for(u, core_func_ty)?; + + let func_ty = if let Some(indices) = c + .current_type_scope() + .func_type_to_indices + .get(&comp_func_ty) + { + // If we've already defined this component function type + // one or more times, then choose one of those + // definitions arbitrarily. + debug_assert!(!indices.is_empty()); + *u.choose(indices)? + } else if c.current_type_scope().types.len() < c.config.max_types { + // If we haven't already defined this component function + // type, and we haven't defined the configured maximum + // amount of types yet, then just define this type. + let ty = Rc::new(Type::Func(Rc::new(comp_func_ty))); + c.push_type(ty) + } else { + // Otherwise, give up on lifting this function. + return Ok(None); + }; + + Ok(Some(Func::CanonLift { + func_ty, + // Scalar functions don't use any canonical options. + options: vec![], + core_func_index, + })) + }); + } + + if choices.is_empty() { + return Ok(false); + } + + let f = u.choose(&choices)?; + if let Some(func) = f(u, self)? { + self.push_func(func); + } + + Ok(true) + })?; + + Ok(Step::StillBuilding) + } + + fn arbitrary_core_module_section(&mut self, u: &mut Unstructured) -> Result<Step> { + let module = crate::core::Module::new_internal( + self.config.clone(), + u, + crate::core::DuplicateImportsBehavior::Disallowed, + )?; + self.push_section(Section::CoreModule(module)); + self.total_modules += 1; + Ok(Step::StillBuilding) + } + + fn arbitrary_component_section(&mut self, u: &mut Unstructured) -> Result<Step> { + self.types.push(TypesScope::default()); + self.components.push(ComponentContext::empty()); + self.total_components += 1; + Ok(Step::StillBuilding) + } + + fn arbitrary_instance_section(&mut self, u: &mut Unstructured) -> Result<()> { + todo!() + } + + fn arbitrary_export_section(&mut self, u: &mut Unstructured) -> Result<()> { + todo!() + } + + fn arbitrary_start_section(&mut self, u: &mut Unstructured) -> Result<()> { + todo!() + } + + fn arbitrary_alias_section(&mut self, u: &mut Unstructured) -> Result<()> { + todo!() + } +} + +fn canonical_abi_for(func_ty: &FuncType) -> Rc<crate::core::FuncType> { + let to_core_ty = |ty| match ty { + ComponentValType::Primitive(prim_ty) => match prim_ty { + PrimitiveValType::Char + | PrimitiveValType::Bool + | PrimitiveValType::S8 + | PrimitiveValType::U8 + | PrimitiveValType::S16 + | PrimitiveValType::U16 + | PrimitiveValType::S32 + | PrimitiveValType::U32 => ValType::I32, + PrimitiveValType::S64 | PrimitiveValType::U64 => ValType::I64, + PrimitiveValType::Float32 => ValType::F32, + PrimitiveValType::Float64 => ValType::F64, + PrimitiveValType::String => { + unimplemented!("non-scalar types are not supported yet") + } + }, + ComponentValType::Type(_) => unimplemented!("non-scalar types are not supported yet"), + }; + + Rc::new(crate::core::FuncType { + params: func_ty + .params + .iter() + .map(|(_, ty)| to_core_ty(*ty)) + .collect(), + results: func_ty + .results + .iter() + .map(|(_, ty)| to_core_ty(*ty)) + .collect(), + }) +} + +fn inverse_scalar_canonical_abi_for( + u: &mut Unstructured, + core_func_ty: &crate::core::FuncType, +) -> Result<FuncType> { + let from_core_ty = |u: &mut Unstructured, core_ty| match core_ty { + ValType::I32 => u + .choose(&[ + ComponentValType::Primitive(PrimitiveValType::Char), + ComponentValType::Primitive(PrimitiveValType::Bool), + ComponentValType::Primitive(PrimitiveValType::S8), + ComponentValType::Primitive(PrimitiveValType::U8), + ComponentValType::Primitive(PrimitiveValType::S16), + ComponentValType::Primitive(PrimitiveValType::U16), + ComponentValType::Primitive(PrimitiveValType::S32), + ComponentValType::Primitive(PrimitiveValType::U32), + ]) + .cloned(), + ValType::I64 => u + .choose(&[ + ComponentValType::Primitive(PrimitiveValType::S64), + ComponentValType::Primitive(PrimitiveValType::U64), + ]) + .cloned(), + ValType::F32 => Ok(ComponentValType::Primitive(PrimitiveValType::Float32)), + ValType::F64 => Ok(ComponentValType::Primitive(PrimitiveValType::Float64)), + ValType::V128 | ValType::Ref(_) => { + unreachable!("not used in canonical ABI") + } + }; + + let mut names = HashSet::default(); + let mut params = vec![]; + + for core_ty in &core_func_ty.params { + params.push(( + crate::unique_kebab_string(100, &mut names, u)?, + from_core_ty(u, *core_ty)?, + )); + } + + names.clear(); + + let results = match core_func_ty.results.len() { + 0 => Vec::new(), + 1 => vec![( + if u.arbitrary()? { + Some(crate::unique_kebab_string(100, &mut names, u)?) + } else { + None + }, + from_core_ty(u, core_func_ty.results[0])?, + )], + _ => unimplemented!("non-scalar types are not supported yet"), + }; + + Ok(FuncType { params, results }) +} + +#[derive(Debug)] +enum Section { + Custom(CustomSection), + CoreModule(crate::Module), + CoreInstance(CoreInstanceSection), + CoreType(CoreTypeSection), + Component(Component), + Instance(InstanceSection), + Alias(AliasSection), + Type(TypeSection), + Canonical(CanonicalSection), + Start(StartSection), + Import(ImportSection), + Export(ExportSection), +} + +#[derive(Debug)] +struct CustomSection { + name: String, + data: Vec<u8>, +} + +impl<'a> Arbitrary<'a> for CustomSection { + fn arbitrary(u: &mut Unstructured<'a>) -> Result<Self> { + let name = crate::limited_string(1_000, u)?; + let data = u.arbitrary()?; + Ok(CustomSection { name, data }) + } +} + +#[derive(Debug)] +struct TypeSection { + types: Vec<Rc<Type>>, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +enum CoreType { + Func(Rc<crate::core::FuncType>), + Module(Rc<ModuleType>), +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash, Default)] +struct ModuleType { + defs: Vec<ModuleTypeDef>, + has_memory: bool, + has_canonical_abi_realloc: bool, + has_canonical_abi_free: bool, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +enum ModuleTypeDef { + TypeDef(crate::core::CompositeType), + Import(crate::core::Import), + OuterAlias { + count: u32, + i: u32, + kind: CoreOuterAliasKind, + }, + Export(String, crate::core::EntityType), +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +enum Type { + Defined(DefinedType), + Func(Rc<FuncType>), + Component(Rc<ComponentType>), + Instance(Rc<InstanceType>), +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +enum CoreInstanceExportAliasKind { + Func, + Table, + Memory, + Global, + Tag, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +enum CoreOuterAliasKind { + Type(Rc<crate::core::FuncType>), +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +enum Alias { + InstanceExport { + instance: u32, + name: String, + kind: InstanceExportAliasKind, + }, + CoreInstanceExport { + instance: u32, + name: String, + kind: CoreInstanceExportAliasKind, + }, + Outer { + count: u32, + i: u32, + kind: OuterAliasKind, + }, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +enum InstanceExportAliasKind { + Module, + Component, + Instance, + Func, + Value, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +enum OuterAliasKind { + Module, + Component, + CoreType(Rc<CoreType>), + Type(Rc<Type>), +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +struct ComponentType { + defs: Vec<ComponentTypeDef>, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +enum ComponentTypeDef { + CoreType(Rc<CoreType>), + Type(Rc<Type>), + Alias(Alias), + Import(Import), + Export { + name: String, + url: Option<String>, + ty: ComponentTypeRef, + }, +} + +impl From<InstanceTypeDecl> for ComponentTypeDef { + fn from(def: InstanceTypeDecl) -> Self { + match def { + InstanceTypeDecl::CoreType(t) => Self::CoreType(t), + InstanceTypeDecl::Type(t) => Self::Type(t), + InstanceTypeDecl::Export { name, url, ty } => Self::Export { name, url, ty }, + InstanceTypeDecl::Alias(a) => Self::Alias(a), + } + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +struct InstanceType { + defs: Vec<InstanceTypeDecl>, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +enum InstanceTypeDecl { + CoreType(Rc<CoreType>), + Type(Rc<Type>), + Alias(Alias), + Export { + name: String, + url: Option<String>, + ty: ComponentTypeRef, + }, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +struct FuncType { + params: Vec<(String, ComponentValType)>, + results: Vec<(Option<String>, ComponentValType)>, +} + +impl FuncType { + fn unnamed_result_ty(&self) -> Option<ComponentValType> { + if self.results.len() == 1 { + let (name, ty) = &self.results[0]; + if name.is_none() { + return Some(*ty); + } + } + None + } + + fn is_scalar(&self) -> bool { + self.params.iter().all(|(_, ty)| is_scalar(ty)) + && self.results.len() == 1 + && is_scalar(&self.results[0].1) + } +} + +fn is_scalar(ty: &ComponentValType) -> bool { + match ty { + ComponentValType::Primitive(prim) => match prim { + PrimitiveValType::Bool + | PrimitiveValType::S8 + | PrimitiveValType::U8 + | PrimitiveValType::S16 + | PrimitiveValType::U16 + | PrimitiveValType::S32 + | PrimitiveValType::U32 + | PrimitiveValType::S64 + | PrimitiveValType::U64 + | PrimitiveValType::Float32 + | PrimitiveValType::Float64 + | PrimitiveValType::Char => true, + PrimitiveValType::String => false, + }, + ComponentValType::Type(_) => false, + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +enum DefinedType { + Primitive(PrimitiveValType), + Record(RecordType), + Variant(VariantType), + List(ListType), + Tuple(TupleType), + Flags(FlagsType), + Enum(EnumType), + Option(OptionType), + Result(ResultType), +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +struct RecordType { + fields: Vec<(String, ComponentValType)>, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +struct VariantType { + cases: Vec<(String, Option<ComponentValType>, Option<u32>)>, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +struct ListType { + elem_ty: ComponentValType, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +struct TupleType { + fields: Vec<ComponentValType>, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +struct FlagsType { + fields: Vec<String>, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +struct EnumType { + variants: Vec<String>, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +struct OptionType { + inner_ty: ComponentValType, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +struct ResultType { + ok_ty: Option<ComponentValType>, + err_ty: Option<ComponentValType>, +} + +#[derive(Debug)] +struct ImportSection { + imports: Vec<Import>, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +struct Import { + name: String, + url: Option<String>, + ty: ComponentTypeRef, +} + +#[derive(Debug)] +struct CanonicalSection { + funcs: Vec<Func>, +} + +#[derive(Debug)] +enum Func { + CanonLift { + func_ty: u32, + options: Vec<CanonOpt>, + core_func_index: u32, + }, + CanonLower { + options: Vec<CanonOpt>, + func_index: u32, + }, +} + +#[derive(Debug)] +enum CanonOpt { + StringUtf8, + StringUtf16, + StringLatin1Utf16, + Memory(u32), + Realloc(u32), + PostReturn(u32), +} + +#[derive(Debug)] +struct InstanceSection {} + +#[derive(Debug)] +struct ExportSection {} + +#[derive(Debug)] +struct StartSection {} + +#[derive(Debug)] +struct AliasSection {} + +#[derive(Debug)] +struct CoreInstanceSection {} + +#[derive(Debug)] +struct CoreTypeSection { + types: Vec<Rc<CoreType>>, +} diff --git a/third_party/rust/wasm-smith/src/component/encode.rs b/third_party/rust/wasm-smith/src/component/encode.rs new file mode 100644 index 0000000000..7963ecfae5 --- /dev/null +++ b/third_party/rust/wasm-smith/src/component/encode.rs @@ -0,0 +1,321 @@ +use std::borrow::Cow; + +use super::*; +use wasm_encoder::{ComponentExportKind, ComponentOuterAliasKind, ExportKind}; + +impl Component { + /// Encode this Wasm component into bytes. + pub fn to_bytes(&self) -> Vec<u8> { + self.encoded().finish() + } + + fn encoded(&self) -> wasm_encoder::Component { + let mut component = wasm_encoder::Component::new(); + for section in &self.sections { + section.encode(&mut component); + } + component + } +} + +impl Section { + fn encode(&self, component: &mut wasm_encoder::Component) { + match self { + Self::Custom(sec) => sec.encode(component), + Self::CoreModule(module) => { + let bytes = module.to_bytes(); + component.section(&wasm_encoder::RawSection { + id: wasm_encoder::ComponentSectionId::CoreModule as u8, + data: &bytes, + }); + } + Self::CoreInstance(_) => todo!(), + Self::CoreType(sec) => sec.encode(component), + Self::Component(comp) => { + let bytes = comp.to_bytes(); + component.section(&wasm_encoder::RawSection { + id: wasm_encoder::ComponentSectionId::Component as u8, + data: &bytes, + }); + } + Self::Instance(_) => todo!(), + Self::Alias(_) => todo!(), + Self::Type(sec) => sec.encode(component), + Self::Canonical(sec) => sec.encode(component), + Self::Start(_) => todo!(), + Self::Import(sec) => sec.encode(component), + Self::Export(_) => todo!(), + } + } +} + +impl CustomSection { + fn encode(&self, component: &mut wasm_encoder::Component) { + component.section(&wasm_encoder::CustomSection { + name: (&self.name).into(), + data: Cow::Borrowed(&self.data), + }); + } +} + +impl TypeSection { + fn encode(&self, component: &mut wasm_encoder::Component) { + let mut sec = wasm_encoder::ComponentTypeSection::new(); + for ty in &self.types { + ty.encode(sec.ty()); + } + component.section(&sec); + } +} + +impl ImportSection { + fn encode(&self, component: &mut wasm_encoder::Component) { + let mut sec = wasm_encoder::ComponentImportSection::new(); + for imp in &self.imports { + sec.import(&imp.name, imp.ty); + } + component.section(&sec); + } +} + +impl CanonicalSection { + fn encode(&self, component: &mut wasm_encoder::Component) { + let mut sec = wasm_encoder::CanonicalFunctionSection::new(); + for func in &self.funcs { + match func { + Func::CanonLift { + func_ty, + options, + core_func_index, + } => { + let options = translate_canon_opt(options); + sec.lift(*core_func_index, *func_ty, options); + } + Func::CanonLower { + options, + func_index, + } => { + let options = translate_canon_opt(options); + sec.lower(*func_index, options); + } + } + } + component.section(&sec); + } +} + +impl CoreTypeSection { + fn encode(&self, component: &mut wasm_encoder::Component) { + let mut sec = wasm_encoder::CoreTypeSection::new(); + for ty in &self.types { + ty.encode(sec.ty()); + } + component.section(&sec); + } +} + +impl CoreType { + fn encode(&self, enc: wasm_encoder::CoreTypeEncoder<'_>) { + match self { + Self::Func(ty) => { + enc.function(ty.params.iter().copied(), ty.results.iter().copied()); + } + Self::Module(mod_ty) => { + let mut enc_mod_ty = wasm_encoder::ModuleType::new(); + for def in &mod_ty.defs { + match def { + ModuleTypeDef::TypeDef(crate::core::CompositeType::Func(func_ty)) => { + enc_mod_ty.ty().function( + func_ty.params.iter().copied(), + func_ty.results.iter().copied(), + ); + } + ModuleTypeDef::TypeDef(_) => { + unimplemented!("non-func types in a component's module type") + } + ModuleTypeDef::OuterAlias { count, i, kind } => match kind { + CoreOuterAliasKind::Type(_) => { + enc_mod_ty.alias_outer_core_type(*count, *i); + } + }, + ModuleTypeDef::Import(imp) => { + enc_mod_ty.import( + &imp.module, + &imp.field, + crate::core::encode::translate_entity_type(&imp.entity_type), + ); + } + ModuleTypeDef::Export(name, ty) => { + enc_mod_ty.export(name, crate::core::encode::translate_entity_type(ty)); + } + } + } + enc.module(&enc_mod_ty); + } + } + } +} + +impl Type { + fn encode(&self, enc: wasm_encoder::ComponentTypeEncoder<'_>) { + match self { + Self::Defined(ty) => { + ty.encode(enc.defined_type()); + } + Self::Func(func_ty) => { + let mut f = enc.function(); + + f.params(func_ty.params.iter().map(|(name, ty)| (name.as_str(), *ty))); + + if let Some(ty) = func_ty.unnamed_result_ty() { + f.result(ty); + } else { + f.results( + func_ty + .results + .iter() + .map(|(name, ty)| (name.as_deref().unwrap(), *ty)), + ); + } + } + Self::Component(comp_ty) => { + let mut enc_comp_ty = wasm_encoder::ComponentType::new(); + for def in &comp_ty.defs { + match def { + ComponentTypeDef::Import(imp) => { + enc_comp_ty.import(&imp.name, imp.ty); + } + ComponentTypeDef::CoreType(ty) => { + ty.encode(enc_comp_ty.core_type()); + } + ComponentTypeDef::Type(ty) => { + ty.encode(enc_comp_ty.ty()); + } + ComponentTypeDef::Export { name, url: _, ty } => { + enc_comp_ty.export(name, *ty); + } + ComponentTypeDef::Alias(a) => { + enc_comp_ty.alias(translate_alias(a)); + } + } + } + enc.component(&enc_comp_ty); + } + Self::Instance(inst_ty) => { + let mut enc_inst_ty = wasm_encoder::InstanceType::new(); + for def in &inst_ty.defs { + match def { + InstanceTypeDecl::CoreType(ty) => { + ty.encode(enc_inst_ty.core_type()); + } + InstanceTypeDecl::Type(ty) => { + ty.encode(enc_inst_ty.ty()); + } + InstanceTypeDecl::Export { name, url: _, ty } => { + enc_inst_ty.export(name, *ty); + } + InstanceTypeDecl::Alias(a) => { + enc_inst_ty.alias(translate_alias(a)); + } + } + } + enc.instance(&enc_inst_ty); + } + } + } +} + +impl DefinedType { + fn encode(&self, enc: wasm_encoder::ComponentDefinedTypeEncoder<'_>) { + match self { + Self::Primitive(ty) => enc.primitive(*ty), + Self::Record(ty) => { + enc.record(ty.fields.iter().map(|(name, ty)| (name.as_str(), *ty))); + } + Self::Variant(ty) => { + enc.variant( + ty.cases + .iter() + .map(|(name, ty, refines)| (name.as_str(), *ty, *refines)), + ); + } + Self::List(ty) => { + enc.list(ty.elem_ty); + } + Self::Tuple(ty) => { + enc.tuple(ty.fields.iter().copied()); + } + Self::Flags(ty) => { + enc.flags(ty.fields.iter().map(|f| f.as_str())); + } + Self::Enum(ty) => { + enc.enum_type(ty.variants.iter().map(|v| v.as_str())); + } + Self::Option(ty) => { + enc.option(ty.inner_ty); + } + Self::Result(ty) => { + enc.result(ty.ok_ty, ty.err_ty); + } + } + } +} + +fn translate_canon_opt(options: &[CanonOpt]) -> Vec<wasm_encoder::CanonicalOption> { + options + .iter() + .map(|o| match o { + CanonOpt::StringUtf8 => wasm_encoder::CanonicalOption::UTF8, + CanonOpt::StringUtf16 => wasm_encoder::CanonicalOption::UTF16, + CanonOpt::StringLatin1Utf16 => wasm_encoder::CanonicalOption::CompactUTF16, + CanonOpt::Memory(idx) => wasm_encoder::CanonicalOption::Memory(*idx), + CanonOpt::Realloc(idx) => wasm_encoder::CanonicalOption::Realloc(*idx), + CanonOpt::PostReturn(idx) => wasm_encoder::CanonicalOption::PostReturn(*idx), + }) + .collect() +} + +fn translate_alias(alias: &Alias) -> wasm_encoder::Alias<'_> { + match alias { + Alias::InstanceExport { + instance, + name, + kind, + } => wasm_encoder::Alias::InstanceExport { + instance: *instance, + name, + kind: match kind { + InstanceExportAliasKind::Module => ComponentExportKind::Module, + InstanceExportAliasKind::Component => ComponentExportKind::Component, + InstanceExportAliasKind::Instance => ComponentExportKind::Instance, + InstanceExportAliasKind::Func => ComponentExportKind::Func, + InstanceExportAliasKind::Value => ComponentExportKind::Value, + }, + }, + Alias::CoreInstanceExport { + instance, + name, + kind, + } => wasm_encoder::Alias::CoreInstanceExport { + instance: *instance, + name, + kind: match kind { + CoreInstanceExportAliasKind::Func => ExportKind::Func, + CoreInstanceExportAliasKind::Table => ExportKind::Table, + CoreInstanceExportAliasKind::Global => ExportKind::Global, + CoreInstanceExportAliasKind::Memory => ExportKind::Memory, + CoreInstanceExportAliasKind::Tag => ExportKind::Tag, + }, + }, + Alias::Outer { count, i, kind } => wasm_encoder::Alias::Outer { + count: *count, + index: *i, + kind: match kind { + OuterAliasKind::Module => ComponentOuterAliasKind::CoreModule, + OuterAliasKind::Component => ComponentOuterAliasKind::Component, + OuterAliasKind::Type(_) => ComponentOuterAliasKind::Type, + OuterAliasKind::CoreType(_) => ComponentOuterAliasKind::CoreType, + }, + }, + } +} diff --git a/third_party/rust/wasm-smith/src/config.rs b/third_party/rust/wasm-smith/src/config.rs new file mode 100644 index 0000000000..b183530e4c --- /dev/null +++ b/third_party/rust/wasm-smith/src/config.rs @@ -0,0 +1,622 @@ +//! Configuring the shape of generated Wasm modules. + +use crate::InstructionKinds; +use arbitrary::{Arbitrary, Result, Unstructured}; + +macro_rules! define_config { + ( + $(#[$attr:meta])* + pub struct Config { + $( + $(#[$field_attr:meta])* + pub $field:ident : $field_ty:ty = $default:expr, + )* + } + ) => { + $(#[$attr])* + pub struct Config { + /// The imports that may be used when generating the module. + /// + /// Defaults to `None` which means that any arbitrary import can be + /// generated. + /// + /// To only allow specific imports, override this method to return a + /// WebAssembly module which describes the imports allowed. + /// + /// Note that [`Self::min_imports`] is ignored when + /// `available_imports` are enabled. + /// + /// The returned value must be a valid binary encoding of a + /// WebAssembly module. `wasm-smith` will panic if the module cannot + /// be parsed. + /// + /// # Example + /// + /// An implementation of this method could use the `wat` crate to + /// provide a human-readable and maintainable description: + /// + /// ```rust + /// Some(wat::parse_str(r#" + /// (module + /// (import "env" "ping" (func (param i32))) + /// (import "env" "pong" (func (result i32))) + /// (import "env" "memory" (memory 1)) + /// (import "env" "table" (table 1)) + /// (import "env" "tag" (tag (param i32))) + /// ) + /// "#)) + /// # ; + /// ``` + pub available_imports: Option<Vec<u8>>, + + $( + $(#[$field_attr])* + pub $field: $field_ty, + )* + } + + impl Default for Config { + fn default() -> Config { + Config { + available_imports: None, + + $( + $field: $default, + )* + } + } + } + + #[cfg(feature = "_internal_cli")] + #[doc(hidden)] + #[derive(Clone, Debug, Default, clap::Parser, serde_derive::Deserialize)] + #[serde(rename_all = "kebab-case")] + pub struct InternalOptionalConfig { + /// The imports that may be used when generating the module. + /// + /// When unspecified, any arbitrary import can be generated. + /// + /// To only allow specific imports, provide a file path of a + /// WebAssembly module which describes the imports allowed. + /// + /// Note that [`Self::min_imports`] is ignored when + /// `available_imports` are enabled. + /// + /// The returned value must be a valid binary encoding of a + /// WebAssembly module. `wasm-smith` will panic if the module cannot + /// be parsed. + #[cfg_attr(feature = "clap", clap(long))] + available_imports: Option<std::path::PathBuf>, + + $( + $(#[$field_attr])* + #[cfg_attr(feature = "clap", clap(long))] + pub $field: Option<$field_ty>, + )* + } + + #[cfg(feature = "_internal_cli")] + impl InternalOptionalConfig { + pub fn or(self, other: Self) -> Self { + Self { + available_imports: self.available_imports.or(other.available_imports), + + $( + $field: self.$field.or(other.$field), + )* + } + } + } + + #[cfg(feature = "_internal_cli")] + impl TryFrom<InternalOptionalConfig> for Config { + type Error = anyhow::Error; + fn try_from(config: InternalOptionalConfig) -> anyhow::Result<Config> { + let default = Config::default(); + Ok(Config { + available_imports: if let Some(file) = config + .available_imports + .as_ref() { + Some(wat::parse_file(file)?) + } else { + None + }, + + $( + $field: config.$field.unwrap_or(default.$field), + )* + }) + } + } + } +} + +define_config! { + /// Configuration for a generated module. + /// + /// Don't care to configure your generated modules? Just use + /// [`Module::arbitrary`][crate::Module], which internally uses the default + /// configuration. + /// + /// Want control over the shape of the module that gets generated? Create a + /// `Config` and then pass it to [`Module::new`][crate::Module::new]. + /// + /// # Swarm Testing + /// + /// You can use the `Arbitrary for Config` implementation for [swarm + /// testing]. This will dynamically -- but still deterministically -- choose + /// configuration options for you. + /// + /// [swarm testing]: https://www.cs.utah.edu/~regehr/papers/swarm12.pdf + /// + /// Note that we pick only *maximums*, not minimums, here because it is more + /// complex to describe the domain of valid configs when minima are involved + /// (`min <= max` for each variable) and minima are mostly used to ensure + /// certain elements are present, but do not widen the range of generated + /// Wasm modules. + #[derive(Clone, Debug)] + pub struct Config { + /// Determines whether a `start` export may be included. Defaults to `true`. + pub allow_start_export: bool = true, + + /// The kinds of instructions allowed in the generated wasm + /// programs. Defaults to all. + /// + /// The categories of instructions match the categories used by the + /// [WebAssembly + /// specification](https://webassembly.github.io/spec/core/syntax/instructions.html); + /// e.g., numeric, vector, control, memory, etc. + /// + /// Note that modifying this setting is separate from the proposal + /// flags; that is, if `simd_enabled() == true` but + /// `allowed_instruction()` does not include vector instructions, the + /// generated programs will not include these instructions but could + /// contain vector types. + pub allowed_instructions: InstructionKinds = InstructionKinds::all(), + + /// Determines whether the bulk memory proposal is enabled for + /// generating instructions. + /// + /// Defaults to `false`. + pub bulk_memory_enabled: bool = false, + + /// Returns whether NaN values are canonicalized after all f32/f64 + /// operation. Defaults to false. + /// + /// This can be useful when a generated wasm module is executed in + /// multiple runtimes which may produce different NaN values. This + /// ensures that the generated module will always use the same NaN + /// representation for all instructions which have visible side effects, + /// for example writing floats to memory or float-to-int bitcast + /// instructions. + pub canonicalize_nans: bool = false, + + /// Returns whether we should avoid generating code that will possibly + /// trap. + /// + /// For some trapping instructions, this will emit extra instructions to + /// ensure they don't trap, while some instructions will simply be + /// excluded. In cases where we would run into a trap, we instead + /// choose some arbitrary non-trapping behavior. For example, if we + /// detect that a Load instruction would attempt to access out-of-bounds + /// memory, we instead pretend the load succeeded and push 0 onto the + /// stack. + /// + /// One type of trap that we can't currently avoid is + /// StackOverflow. Even when `disallow_traps` is set to true, wasm-smith + /// will eventually generate a program that infinitely recurses, causing + /// the call stack to be exhausted. + /// + /// Defaults to `false`. + pub disallow_traps: bool = false, + + /// Determines whether the exception-handling proposal is enabled for + /// generating instructions. + /// + /// Defaults to `false`. + pub exceptions_enabled: bool = false, + + /// Export all WebAssembly objects in the module. Defaults to false. + /// + /// This overrides [`Config::min_exports`] and [`Config::max_exports`]. + pub export_everything: bool = false, + + /// Determines whether the GC proposal is enabled when generating a Wasm + /// module. + /// + /// Defaults to `false`. + pub gc_enabled: bool = false, + + /// Returns whether we should generate custom sections or not. Defaults + /// to false. + pub generate_custom_sections: bool = false, + + /// Returns the maximal size of the `alias` section. Defaults to 1000. + pub max_aliases: usize = 1000, + + /// The maximum number of components to use. Defaults to 10. + /// + /// This includes imported components. + /// + /// Note that this is only relevant for components. + pub max_components: usize = 10, + + /// The maximum number of data segments to generate. Defaults to 100. + pub max_data_segments: usize = 100, + + /// The maximum number of element segments to generate. Defaults to 100. + pub max_element_segments: usize = 100, + + /// The maximum number of elements within a segment to + /// generate. Defaults to 100. + pub max_elements: usize = 100, + + /// The maximum number of exports to generate. Defaults to 100. + pub max_exports: usize = 100, + + /// The maximum number of functions to generate. Defaults to 100. This + /// includes imported functions. + pub max_funcs: usize = 100, + + /// The maximum number of globals to generate. Defaults to 100. This + /// includes imported globals. + pub max_globals: usize = 100, + + /// The maximum number of imports to generate. Defaults to 100. + pub max_imports: usize = 100, + + /// The maximum number of instances to use. Defaults to 10. + /// + /// This includes imported instances. + /// + /// Note that this is only relevant for components. + pub max_instances: usize = 10, + + /// The maximum number of instructions to generate in a function + /// body. Defaults to 100. + /// + /// Note that some additional `end`s, `else`s, and `unreachable`s may be + /// appended to the function body to finish block scopes. + pub max_instructions: usize = 100, + + /// The maximum number of memories to use. Defaults to 1. + /// + /// This includes imported memories. + /// + /// Note that more than one memory is in the realm of the multi-memory + /// wasm proposal. + pub max_memories: usize = 1, + + /// The maximum, in 64k Wasm pages, of any 32-bit memory's initial or + /// maximum size. + /// + /// Defaults to 2^16. + pub max_memory32_pages: u64 = 1 << 16, + + /// The maximum, in 64k Wasm pages, of any 64-bit memory's initial or + /// maximum size. + /// + /// Defaults to 2^48. + pub max_memory64_pages: u64 = 1 << 48, + + /// The maximum number of modules to use. Defaults to 10. + /// + /// This includes imported modules. + /// + /// Note that this is only relevant for components. + pub max_modules: usize = 10, + + /// Returns the maximal nesting depth of modules with the component + /// model proposal. Defaults to 10. + pub max_nesting_depth: usize = 10, + + /// The maximum, elements, of any table's initial or maximum + /// size. Defaults to 1 million. + pub max_table_elements: u32 = 1_000_000, + + /// The maximum number of tables to use. Defaults to 1. + /// + /// This includes imported tables. + /// + /// Note that more than one table is in the realm of the reference types + /// proposal. + pub max_tables: usize = 1, + + /// The maximum number of tags to generate. Defaults to 100. + pub max_tags: usize = 100, + + /// Returns the maximal effective size of any type generated by + /// wasm-smith. + /// + /// Note that this number is roughly in units of "how many types would + /// be needed to represent the recursive type". A function with 8 + /// parameters and 2 results would take 11 types (one for the type, 10 + /// for params/results). A module type with 2 imports and 3 exports + /// would take 6 (module + imports + exports) plus the size of each + /// import/export type. This is a somewhat rough measurement that is not + /// intended to be very precise. + /// + /// Defaults to 1000. + pub max_type_size: u32 = 1000, + + /// The maximum number of types to generate. Defaults to 100. + pub max_types: usize = 100, + + /// The maximum number of values to use. Defaults to 10. + /// + /// This includes imported values. + /// + /// Note that this is irrelevant unless value model support is enabled. + pub max_values: usize = 10, + + /// Returns whether 64-bit memories are allowed. Defaults to false. + /// + /// Note that this is the gate for the memory64 proposal to WebAssembly. + pub memory64_enabled: bool = false, + + /// Whether every Wasm memory must have a maximum size + /// specified. Defaults to `false`. + pub memory_max_size_required: bool = false, + + /// Control the probability of generating memory offsets that are in + /// bounds vs. potentially out of bounds. + /// + /// See the `MemoryOffsetChoices` struct for details. + pub memory_offset_choices: MemoryOffsetChoices = MemoryOffsetChoices::default(), + + /// The minimum number of data segments to generate. Defaults to 0. + pub min_data_segments: usize = 0, + + /// The minimum number of element segments to generate. Defaults to 0. + pub min_element_segments: usize = 0, + + /// The minimum number of elements within a segment to + /// generate. Defaults to 0. + pub min_elements: usize = 0, + + /// The minimum number of exports to generate. Defaults to 0. + pub min_exports: usize = 0, + + /// The minimum number of functions to generate. Defaults to 0. + /// + /// This includes imported functions. + pub min_funcs: usize = 0, + + /// The minimum number of globals to generate. Defaults to 0. + /// + /// This includes imported globals. + pub min_globals: usize = 0, + + /// The minimum number of imports to generate. Defaults to 0. + /// + /// Note that if the sum of the maximum function[^1], table, global and + /// memory counts is less than the minimum number of imports, then it + /// will not be possible to satisfy all constraints (because imports + /// count against the limits for those element kinds). In that case, we + /// strictly follow the max-constraints, and can fail to satisfy this + /// minimum number. + /// + /// [^1]: the maximum number of functions is also limited by the number + /// of function types arbitrarily chosen; strictly speaking, then, the + /// maximum number of imports that can be created due to max-constraints + /// is `sum(min(num_func_types, max_funcs), max_tables, max_globals, + /// max_memories)`. + pub min_imports: usize = 0, + + /// The minimum number of memories to use. Defaults to 0. + /// + /// This includes imported memories. + pub min_memories: u32 = 0, + + /// The minimum number of tables to use. Defaults to 0. + /// + /// This includes imported tables. + pub min_tables: u32 = 0, + + /// The minimum number of tags to generate. Defaults to 0. + pub min_tags: usize = 0, + + /// The minimum number of types to generate. Defaults to 0. + pub min_types: usize = 0, + + /// The minimum size, in bytes, of all leb-encoded integers. Defaults to + /// 1. + /// + /// This is useful for ensuring that all leb-encoded integers are + /// decoded as such rather than as simply one byte. This will forcibly + /// extend leb integers with an over-long encoding in some locations if + /// the size would otherwise be smaller than number returned here. + pub min_uleb_size: u8 = 1, + + /// Determines whether the multi-value results are enabled. + /// + /// Defaults to `true`. + pub multi_value_enabled: bool = true, + + /// Determines whether the reference types proposal is enabled for + /// generating instructions. + /// + /// Defaults to `false`. + pub reference_types_enabled: bool = false, + + /// Determines whether the Relaxed SIMD proposal is enabled for + /// generating instructions. + /// + /// Defaults to `false`. + pub relaxed_simd_enabled: bool = false, + + /// Determines whether the nontrapping-float-to-int-conversions propsal + /// is enabled. + /// + /// Defaults to `true`. + pub saturating_float_to_int_enabled: bool = true, + + /// Determines whether the sign-extension-ops propsal is enabled. + /// + /// Defaults to `true`. + pub sign_extension_ops_enabled: bool = true, + + /// Determines whether the SIMD proposal is enabled for generating + /// instructions. + /// + /// Defaults to `false`. + pub simd_enabled: bool = false, + + /// Determines whether the tail calls proposal is enabled for generating + /// instructions. + /// + /// Defaults to `false`. + pub tail_call_enabled: bool = false, + + /// Whether every Wasm table must have a maximum size + /// specified. Defaults to `false`. + pub table_max_size_required: bool = false, + + /// Determines whether the threads proposal is enabled. + /// + /// The [threads proposal] involves shared linear memory, new atomic + /// instructions, and new `wait` and `notify` instructions. + /// + /// [threads proposal]: https://github.com/WebAssembly/threads/blob/master/proposals/threads/Overview.md + /// + /// Defaults to `false`. + pub threads_enabled: bool = false, + } +} + +/// This is a tuple `(a, b, c)` where +/// +/// * `a / (a+b+c)` is the probability of generating a memory offset within +/// `0..memory.min_size`, i.e. an offset that is definitely in bounds of a +/// non-empty memory. (Note that if a memory is zero-sized, however, no offset +/// will ever be in bounds.) +/// +/// * `b / (a+b+c)` is the probability of generating a memory offset within +/// `memory.min_size..memory.max_size`, i.e. an offset that is possibly in +/// bounds if the memory has been grown. +/// +/// * `c / (a+b+c)` is the probability of generating a memory offset within the +/// range `memory.max_size..`, i.e. an offset that is definitely out of +/// bounds. +/// +/// At least one of `a`, `b`, and `c` must be non-zero. +/// +/// If you want to always generate memory offsets that are definitely in bounds +/// of a non-zero-sized memory, for example, you could return `(1, 0, 0)`. +/// +/// The default is `(90, 9, 1)`. +#[derive(Clone, Debug)] +#[cfg_attr(feature = "serde_derive", derive(serde_derive::Deserialize))] +pub struct MemoryOffsetChoices(pub u32, pub u32, pub u32); + +impl Default for MemoryOffsetChoices { + fn default() -> Self { + MemoryOffsetChoices(90, 9, 1) + } +} + +#[cfg(feature = "_internal_cli")] +impl std::str::FromStr for MemoryOffsetChoices { + type Err = String; + fn from_str(s: &str) -> Result<Self, Self::Err> { + use std::str::FromStr; + let mut parts = s.split(","); + let a = parts + .next() + .ok_or_else(|| "need 3 comma separated values".to_string())?; + let a = <u32 as FromStr>::from_str(a).map_err(|e| e.to_string())?; + let b = parts + .next() + .ok_or_else(|| "need 3 comma separated values".to_string())?; + let b = <u32 as FromStr>::from_str(b).map_err(|e| e.to_string())?; + let c = parts + .next() + .ok_or_else(|| "need 3 comma separated values".to_string())?; + let c = <u32 as FromStr>::from_str(c).map_err(|e| e.to_string())?; + if parts.next().is_some() { + return Err("found more than 3 comma separated values".to_string()); + } + Ok(MemoryOffsetChoices(a, b, c)) + } +} + +impl<'a> Arbitrary<'a> for Config { + fn arbitrary(u: &mut Unstructured<'a>) -> Result<Self> { + const MAX_MAXIMUM: usize = 1000; + + let reference_types_enabled: bool = u.arbitrary()?; + let max_tables = if reference_types_enabled { 100 } else { 1 }; + + Ok(Config { + max_types: u.int_in_range(0..=MAX_MAXIMUM)?, + max_imports: u.int_in_range(0..=MAX_MAXIMUM)?, + max_tags: u.int_in_range(0..=MAX_MAXIMUM)?, + max_funcs: u.int_in_range(0..=MAX_MAXIMUM)?, + max_globals: u.int_in_range(0..=MAX_MAXIMUM)?, + max_exports: u.int_in_range(0..=MAX_MAXIMUM)?, + max_element_segments: u.int_in_range(0..=MAX_MAXIMUM)?, + max_elements: u.int_in_range(0..=MAX_MAXIMUM)?, + max_data_segments: u.int_in_range(0..=MAX_MAXIMUM)?, + max_instructions: u.int_in_range(0..=MAX_MAXIMUM)?, + max_memories: u.int_in_range(0..=100)?, + max_tables, + max_memory32_pages: u.int_in_range(0..=1 << 16)?, + max_memory64_pages: u.int_in_range(0..=1 << 48)?, + min_uleb_size: u.int_in_range(0..=5)?, + bulk_memory_enabled: u.arbitrary()?, + reference_types_enabled, + simd_enabled: u.arbitrary()?, + multi_value_enabled: u.arbitrary()?, + max_aliases: u.int_in_range(0..=MAX_MAXIMUM)?, + max_nesting_depth: u.int_in_range(0..=10)?, + saturating_float_to_int_enabled: u.arbitrary()?, + sign_extension_ops_enabled: u.arbitrary()?, + allowed_instructions: { + use flagset::Flags; + let mut allowed = Vec::new(); + for kind in crate::core::InstructionKind::LIST { + if u.arbitrary()? { + allowed.push(*kind); + } + } + InstructionKinds::new(&allowed) + }, + table_max_size_required: u.arbitrary()?, + max_table_elements: u.int_in_range(0..=1_000_000)?, + + // These fields, unlike the ones above, are less useful to set. + // They either make weird inputs or are for features not widely + // implemented yet so they're turned off by default. + min_types: 0, + min_imports: 0, + min_tags: 0, + min_funcs: 0, + min_globals: 0, + min_exports: 0, + min_element_segments: 0, + min_elements: 0, + min_data_segments: 0, + min_memories: 0, + min_tables: 0, + memory_max_size_required: false, + max_instances: 0, + max_modules: 0, + max_components: 0, + max_values: 0, + memory_offset_choices: MemoryOffsetChoices::default(), + allow_start_export: true, + relaxed_simd_enabled: false, + exceptions_enabled: false, + memory64_enabled: false, + max_type_size: 1000, + canonicalize_nans: false, + available_imports: None, + threads_enabled: false, + export_everything: false, + disallow_traps: false, + tail_call_enabled: false, + gc_enabled: false, + generate_custom_sections: false, + }) + } +} diff --git a/third_party/rust/wasm-smith/src/core.rs b/third_party/rust/wasm-smith/src/core.rs new file mode 100644 index 0000000000..6a2836ae0e --- /dev/null +++ b/third_party/rust/wasm-smith/src/core.rs @@ -0,0 +1,2404 @@ +//! Generating arbitary core Wasm modules. + +mod code_builder; +pub(crate) mod encode; +mod terminate; + +use crate::{arbitrary_loop, limited_string, unique_string, Config}; +use arbitrary::{Arbitrary, Result, Unstructured}; +use code_builder::CodeBuilderAllocations; +use flagset::{flags, FlagSet}; +use std::collections::{HashMap, HashSet}; +use std::convert::TryFrom; +use std::ops::Range; +use std::rc::Rc; +use std::str::{self, FromStr}; +use wasm_encoder::{ + ArrayType, BlockType, ConstExpr, ExportKind, FieldType, HeapType, RefType, StorageType, + StructType, ValType, +}; +pub(crate) use wasm_encoder::{GlobalType, MemoryType, TableType}; + +// NB: these constants are used to control the rate at which various events +// occur. For more information see where these constants are used. Their values +// are somewhat random in the sense that they're not scientifically determined +// or anything like that, I just threw a bunch of random data at wasm-smith and +// measured various rates of ooms/traps/etc and adjusted these so abnormal +// events were ~1% of the time. +const CHANCE_OFFSET_INBOUNDS: usize = 10; // bigger = less traps +const CHANCE_SEGMENT_ON_EMPTY: usize = 10; // bigger = less traps +const PCT_INBOUNDS: f64 = 0.995; // bigger = less traps + +type Instruction = wasm_encoder::Instruction<'static>; + +/// A pseudo-random WebAssembly module. +/// +/// Construct instances of this type (with default configuration) with [the +/// `Arbitrary` +/// trait](https://docs.rs/arbitrary/*/arbitrary/trait.Arbitrary.html). +/// +/// ## Configuring Generated Modules +/// +/// To configure the shape of generated module, create a +/// [`Config`][crate::Config] and then call [`Module::new`][crate::Module::new] +/// with it. +#[derive(Debug)] +pub struct Module { + config: Config, + duplicate_imports_behavior: DuplicateImportsBehavior, + valtypes: Vec<ValType>, + + /// All types locally defined in this module (available in the type index + /// space). + types: Vec<SubType>, + + /// Non-overlapping ranges within `types` that belong to the same rec + /// group. All of `types` is covered by these ranges. When GC is not + /// enabled, these are all single-element ranges. + rec_groups: Vec<Range<usize>>, + + /// A map from a super type to all of its sub types. + super_to_sub_types: HashMap<u32, Vec<u32>>, + + /// Indices within `types` that are not final types. + can_subtype: Vec<u32>, + + /// Whether we should encode a types section, even if `self.types` is empty. + should_encode_types: bool, + + /// All of this module's imports. These don't have their own index space, + /// but instead introduce entries to each imported entity's associated index + /// space. + imports: Vec<Import>, + + /// Whether we should encode an imports section, even if `self.imports` is + /// empty. + should_encode_imports: bool, + + /// Indices within `types` that are array types. + array_types: Vec<u32>, + + /// Indices within `types` that are function types. + func_types: Vec<u32>, + + /// Indices within `types that are struct types. + struct_types: Vec<u32>, + + /// Number of imported items into this module. + num_imports: usize, + + /// The number of tags defined in this module (not imported or + /// aliased). + num_defined_tags: usize, + + /// The number of functions defined in this module (not imported or + /// aliased). + num_defined_funcs: usize, + + /// The number of tables defined in this module (not imported or + /// aliased). + num_defined_tables: usize, + + /// The number of memories defined in this module (not imported or + /// aliased). + num_defined_memories: usize, + + /// The indexes and initialization expressions of globals defined in this + /// module. + defined_globals: Vec<(u32, GlobalInitExpr)>, + + /// All tags available to this module, sorted by their index. The list + /// entry is the type of each tag. + tags: Vec<TagType>, + + /// All functions available to this module, sorted by their index. The list + /// entry points to the index in this module where the function type is + /// defined (if available) and provides the type of the function. + funcs: Vec<(u32, Rc<FuncType>)>, + + /// All tables available to this module, sorted by their index. The list + /// entry is the type of each table. + tables: Vec<TableType>, + + /// All globals available to this module, sorted by their index. The list + /// entry is the type of each global. + globals: Vec<GlobalType>, + + /// All memories available to this module, sorted by their index. The list + /// entry is the type of each memory. + memories: Vec<MemoryType>, + + exports: Vec<(String, ExportKind, u32)>, + start: Option<u32>, + elems: Vec<ElementSegment>, + code: Vec<Code>, + data: Vec<DataSegment>, + + /// The predicted size of the effective type of this module, based on this + /// module's size of the types of imports/exports. + type_size: u32, + + /// Names currently exported from this module. + export_names: HashSet<String>, +} + +impl<'a> Arbitrary<'a> for Module { + fn arbitrary(u: &mut Unstructured<'a>) -> Result<Self> { + Module::new(Config::default(), u) + } +} + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub(crate) enum DuplicateImportsBehavior { + Allowed, + Disallowed, +} + +impl Module { + /// Returns a reference to the internal configuration. + pub fn config(&self) -> &Config { + &self.config + } + + /// Creates a new `Module` with the specified `config` for + /// configuration and `Unstructured` for the DNA of this module. + pub fn new(config: Config, u: &mut Unstructured<'_>) -> Result<Self> { + Self::new_internal(config, u, DuplicateImportsBehavior::Allowed) + } + + pub(crate) fn new_internal( + config: Config, + u: &mut Unstructured<'_>, + duplicate_imports_behavior: DuplicateImportsBehavior, + ) -> Result<Self> { + let mut module = Module::empty(config, duplicate_imports_behavior); + module.build(u, false)?; + Ok(module) + } + + fn empty(config: Config, duplicate_imports_behavior: DuplicateImportsBehavior) -> Self { + Module { + config, + duplicate_imports_behavior, + valtypes: Vec::new(), + types: Vec::new(), + rec_groups: Vec::new(), + can_subtype: Vec::new(), + super_to_sub_types: HashMap::new(), + should_encode_types: false, + imports: Vec::new(), + should_encode_imports: false, + array_types: Vec::new(), + func_types: Vec::new(), + struct_types: Vec::new(), + num_imports: 0, + num_defined_tags: 0, + num_defined_funcs: 0, + num_defined_tables: 0, + num_defined_memories: 0, + defined_globals: Vec::new(), + tags: Vec::new(), + funcs: Vec::new(), + tables: Vec::new(), + globals: Vec::new(), + memories: Vec::new(), + exports: Vec::new(), + start: None, + elems: Vec::new(), + code: Vec::new(), + data: Vec::new(), + type_size: 0, + export_names: HashSet::new(), + } + } +} + +/// Same as [`Module`], but may be invalid. +/// +/// This module generates function bodies differnetly than `Module` to try to +/// better explore wasm decoders and such. +#[derive(Debug)] +pub struct MaybeInvalidModule { + module: Module, +} + +impl MaybeInvalidModule { + /// Encode this Wasm module into bytes. + pub fn to_bytes(&self) -> Vec<u8> { + self.module.to_bytes() + } +} + +impl<'a> Arbitrary<'a> for MaybeInvalidModule { + fn arbitrary(u: &mut Unstructured<'a>) -> Result<Self> { + let mut module = Module::empty(Config::default(), DuplicateImportsBehavior::Allowed); + module.build(u, true)?; + Ok(MaybeInvalidModule { module }) + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +pub(crate) struct RecGroup { + pub(crate) types: Vec<SubType>, +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +pub(crate) struct SubType { + pub(crate) is_final: bool, + pub(crate) supertype: Option<u32>, + pub(crate) composite_type: CompositeType, +} + +impl SubType { + fn unwrap_struct(&self) -> &StructType { + self.composite_type.unwrap_struct() + } + + fn unwrap_func(&self) -> &Rc<FuncType> { + self.composite_type.unwrap_func() + } + + fn unwrap_array(&self) -> &ArrayType { + self.composite_type.unwrap_array() + } +} + +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +pub(crate) enum CompositeType { + Array(ArrayType), + Func(Rc<FuncType>), + Struct(StructType), +} + +impl CompositeType { + fn unwrap_struct(&self) -> &StructType { + match self { + CompositeType::Struct(s) => s, + _ => panic!("not a struct"), + } + } + + fn unwrap_func(&self) -> &Rc<FuncType> { + match self { + CompositeType::Func(f) => f, + _ => panic!("not a func"), + } + } + + fn unwrap_array(&self) -> &ArrayType { + match self { + CompositeType::Array(a) => a, + _ => panic!("not an array"), + } + } +} + +/// A function signature. +#[derive(Clone, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)] +pub(crate) struct FuncType { + /// Types of the parameter values. + pub(crate) params: Vec<ValType>, + /// Types of the result values. + pub(crate) results: Vec<ValType>, +} + +/// An import of an entity provided externally or by a component. +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +pub(crate) struct Import { + /// The name of the module providing this entity. + pub(crate) module: String, + /// The name of the entity. + pub(crate) field: String, + /// The type of this entity. + pub(crate) entity_type: EntityType, +} + +/// Type of an entity. +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +pub(crate) enum EntityType { + /// A global entity. + Global(GlobalType), + /// A table entity. + Table(TableType), + /// A memory entity. + Memory(MemoryType), + /// A tag entity. + Tag(TagType), + /// A function entity. + Func(u32, Rc<FuncType>), +} + +/// Type of a tag. +#[derive(Clone, Debug, PartialEq, Eq, Hash)] +pub(crate) struct TagType { + /// Index of the function type. + func_type_idx: u32, + /// Type of the function. + func_type: Rc<FuncType>, +} + +#[derive(Debug)] +struct ElementSegment { + kind: ElementKind, + ty: RefType, + items: Elements, +} + +#[derive(Debug)] +enum ElementKind { + Passive, + Declared, + Active { + table: Option<u32>, // None == table 0 implicitly + offset: Offset, + }, +} + +#[derive(Debug)] +enum Elements { + Functions(Vec<u32>), + Expressions(Vec<Option<u32>>), +} + +#[derive(Debug)] +struct Code { + locals: Vec<ValType>, + instructions: Instructions, +} + +#[derive(Debug)] +enum Instructions { + Generated(Vec<Instruction>), + Arbitrary(Vec<u8>), +} + +#[derive(Debug)] +struct DataSegment { + kind: DataSegmentKind, + init: Vec<u8>, +} + +#[derive(Debug)] +enum DataSegmentKind { + Passive, + Active { memory_index: u32, offset: Offset }, +} + +#[derive(Debug)] +pub(crate) enum Offset { + Const32(i32), + Const64(i64), + Global(u32), +} + +#[derive(Debug)] +pub(crate) enum GlobalInitExpr { + FuncRef(u32), + ConstExpr(ConstExpr), +} + +impl Module { + fn build(&mut self, u: &mut Unstructured, allow_invalid: bool) -> Result<()> { + self.valtypes = configured_valtypes(&self.config); + + // We attempt to figure out our available imports *before* creating the types section here, + // because the types for the imports are already well-known (specified by the user) and we + // must have those populated for all function/etc. imports, no matter what. + // + // This can affect the available capacity for types and such. + if self.arbitrary_imports_from_available(u)? { + self.arbitrary_types(u)?; + } else { + self.arbitrary_types(u)?; + self.arbitrary_imports(u)?; + } + + self.should_encode_types = !self.types.is_empty() || u.arbitrary()?; + self.should_encode_imports = !self.imports.is_empty() || u.arbitrary()?; + + self.arbitrary_tags(u)?; + self.arbitrary_funcs(u)?; + self.arbitrary_tables(u)?; + self.arbitrary_memories(u)?; + self.arbitrary_globals(u)?; + self.arbitrary_exports(u)?; + self.arbitrary_start(u)?; + self.arbitrary_elems(u)?; + self.arbitrary_data(u)?; + self.arbitrary_code(u, allow_invalid)?; + Ok(()) + } + + #[inline] + fn val_type_is_sub_type(&self, a: ValType, b: ValType) -> bool { + match (a, b) { + (a, b) if a == b => true, + (ValType::Ref(a), ValType::Ref(b)) => self.ref_type_is_sub_type(a, b), + _ => false, + } + } + + /// Is `a` a subtype of `b`? + fn ref_type_is_sub_type(&self, a: RefType, b: RefType) -> bool { + if a == b { + return true; + } + + if a.nullable && !b.nullable { + return false; + } + + self.heap_type_is_sub_type(a.heap_type, b.heap_type) + } + + fn heap_type_is_sub_type(&self, a: HeapType, b: HeapType) -> bool { + use HeapType as HT; + match (a, b) { + (a, b) if a == b => true, + + (HT::Eq | HT::I31 | HT::Struct | HT::Array | HT::None, HT::Any) => true, + (HT::I31 | HT::Struct | HT::Array | HT::None, HT::Eq) => true, + (HT::NoExtern, HT::Extern) => true, + (HT::NoFunc, HT::Func) => true, + (HT::None, HT::I31 | HT::Array | HT::Struct) => true, + + (HT::Concrete(a), HT::Eq | HT::Any) => matches!( + self.ty(a).composite_type, + CompositeType::Array(_) | CompositeType::Struct(_) + ), + + (HT::Concrete(a), HT::Struct) => { + matches!(self.ty(a).composite_type, CompositeType::Struct(_)) + } + + (HT::Concrete(a), HT::Array) => { + matches!(self.ty(a).composite_type, CompositeType::Array(_)) + } + + (HT::Concrete(a), HT::Func) => { + matches!(self.ty(a).composite_type, CompositeType::Func(_)) + } + + (HT::Concrete(mut a), HT::Concrete(b)) => loop { + if a == b { + return true; + } + if let Some(supertype) = self.ty(a).supertype { + a = supertype; + } else { + return false; + } + }, + + (HT::None, HT::Concrete(b)) => matches!( + self.ty(b).composite_type, + CompositeType::Array(_) | CompositeType::Struct(_) + ), + + (HT::NoFunc, HT::Concrete(b)) => { + matches!(self.ty(b).composite_type, CompositeType::Func(_)) + } + + // Nothing else matches. (Avoid full wildcard matches so that + // adding/modifying variants is easier in the future.) + (HT::Concrete(_), _) + | (HT::Func, _) + | (HT::Extern, _) + | (HT::Any, _) + | (HT::None, _) + | (HT::NoExtern, _) + | (HT::NoFunc, _) + | (HT::Eq, _) + | (HT::Struct, _) + | (HT::Array, _) + | (HT::I31, _) => false, + + // TODO: `exn` probably will be its own type hierarchy and will + // probably get `noexn` as well. + (HT::Exn, _) => false, + } + } + + fn arbitrary_types(&mut self, u: &mut Unstructured) -> Result<()> { + assert!(self.config.min_types <= self.config.max_types); + while self.types.len() < self.config.min_types { + self.arbitrary_rec_group(u)?; + } + while self.types.len() < self.config.max_types { + let keep_going = u.arbitrary().unwrap_or(false); + if !keep_going { + break; + } + self.arbitrary_rec_group(u)?; + } + Ok(()) + } + + fn add_type(&mut self, ty: SubType) -> u32 { + let index = u32::try_from(self.types.len()).unwrap(); + + if let Some(supertype) = ty.supertype { + self.super_to_sub_types + .entry(supertype) + .or_default() + .push(index); + } + + let list = match &ty.composite_type { + CompositeType::Array(_) => &mut self.array_types, + CompositeType::Func(_) => &mut self.func_types, + CompositeType::Struct(_) => &mut self.struct_types, + }; + list.push(index); + + if !ty.is_final { + self.can_subtype.push(index); + } + + self.types.push(ty); + index + } + + fn arbitrary_rec_group(&mut self, u: &mut Unstructured) -> Result<()> { + let rec_group_start = self.types.len(); + + if self.config.gc_enabled { + // With small probability, clone an existing rec group. + if self.clonable_rec_groups().next().is_some() && u.ratio(1, u8::MAX)? { + return self.clone_rec_group(u); + } + + // Otherwise, create a new rec group with multiple types inside. + let max_rec_group_size = self.config.max_types - self.types.len(); + let rec_group_size = u.int_in_range(0..=max_rec_group_size)?; + let type_ref_limit = u32::try_from(self.types.len() + rec_group_size).unwrap(); + for _ in 0..rec_group_size { + let ty = self.arbitrary_sub_type(u, type_ref_limit)?; + self.add_type(ty); + } + } else { + let type_ref_limit = u32::try_from(self.types.len()).unwrap(); + let ty = self.arbitrary_sub_type(u, type_ref_limit)?; + self.add_type(ty); + } + + self.rec_groups.push(rec_group_start..self.types.len()); + Ok(()) + } + + /// Returns an iterator of rec groups that we could currently clone while + /// still staying within the max types limit. + fn clonable_rec_groups(&self) -> impl Iterator<Item = Range<usize>> + '_ { + self.rec_groups + .iter() + .filter(|r| r.end - r.start <= self.config.max_types.saturating_sub(self.types.len())) + .cloned() + } + + fn clone_rec_group(&mut self, u: &mut Unstructured) -> Result<()> { + // NB: this does *not* guarantee that the cloned rec group will + // canonicalize the same as the original rec group and be + // deduplicated. That would reqiure a second pass over the cloned types + // to rewrite references within the original rec group to be references + // into the new rec group. That might make sense to do one day, but for + // now we don't do it. That also means that we can't mark the new types + // as "subtypes" of the old types and vice versa. + let candidates: Vec<_> = self.clonable_rec_groups().collect(); + let group = u.choose(&candidates)?.clone(); + let new_rec_group_start = self.types.len(); + for index in group { + let orig_ty_index = u32::try_from(index).unwrap(); + let ty = self.ty(orig_ty_index).clone(); + self.add_type(ty); + } + self.rec_groups.push(new_rec_group_start..self.types.len()); + Ok(()) + } + + fn arbitrary_sub_type( + &mut self, + u: &mut Unstructured, + // NB: Types can be referenced up to (but not including) + // `type_ref_limit`. It is an exclusive bound to avoid an option: to + // disallow any reference to a concrete type (e.g. `(ref $type)`) you + // can simply pass `0` here. + type_ref_limit: u32, + ) -> Result<SubType> { + if !self.config.gc_enabled { + debug_assert_eq!(type_ref_limit, u32::try_from(self.types.len()).unwrap()); + return Ok(SubType { + is_final: true, + supertype: None, + composite_type: CompositeType::Func(self.arbitrary_func_type(u, type_ref_limit)?), + }); + } + + if !self.can_subtype.is_empty() && u.ratio(1, 32_u8)? { + self.arbitrary_sub_type_of_super_type(u, type_ref_limit) + } else { + Ok(SubType { + is_final: u.arbitrary()?, + supertype: None, + composite_type: self.arbitrary_composite_type(u, type_ref_limit)?, + }) + } + } + + fn arbitrary_sub_type_of_super_type( + &mut self, + u: &mut Unstructured, + type_ref_limit: u32, + ) -> Result<SubType> { + let supertype = *u.choose(&self.can_subtype)?; + let mut composite_type = self.types[usize::try_from(supertype).unwrap()] + .composite_type + .clone(); + match &mut composite_type { + CompositeType::Array(a) => { + a.0 = self.arbitrary_matching_field_type(u, a.0)?; + } + CompositeType::Func(f) => { + *f = self.arbitrary_matching_func_type(u, f)?; + } + CompositeType::Struct(s) => { + *s = self.arbitrary_matching_struct_type(u, s, type_ref_limit)?; + } + } + Ok(SubType { + is_final: u.arbitrary()?, + supertype: Some(supertype), + composite_type, + }) + } + + fn arbitrary_matching_struct_type( + &mut self, + u: &mut Unstructured, + ty: &StructType, + type_ref_limit: u32, + ) -> Result<StructType> { + let len_extra_fields = u.int_in_range(0..=5)?; + let mut fields = Vec::with_capacity(ty.fields.len() + len_extra_fields); + for field in ty.fields.iter() { + fields.push(self.arbitrary_matching_field_type(u, *field)?); + } + for _ in 0..len_extra_fields { + fields.push(self.arbitrary_field_type(u, type_ref_limit)?); + } + Ok(StructType { + fields: fields.into_boxed_slice(), + }) + } + + fn arbitrary_matching_field_type( + &mut self, + u: &mut Unstructured, + ty: FieldType, + ) -> Result<FieldType> { + Ok(FieldType { + element_type: self.arbitrary_matching_storage_type(u, ty.element_type)?, + mutable: if ty.mutable { u.arbitrary()? } else { false }, + }) + } + + fn arbitrary_matching_storage_type( + &mut self, + u: &mut Unstructured, + ty: StorageType, + ) -> Result<StorageType> { + match ty { + StorageType::I8 => Ok(StorageType::I8), + StorageType::I16 => Ok(StorageType::I16), + StorageType::Val(ty) => Ok(StorageType::Val(self.arbitrary_matching_val_type(u, ty)?)), + } + } + + fn arbitrary_matching_val_type( + &mut self, + u: &mut Unstructured, + ty: ValType, + ) -> Result<ValType> { + match ty { + ValType::I32 => Ok(ValType::I32), + ValType::I64 => Ok(ValType::I64), + ValType::F32 => Ok(ValType::F32), + ValType::F64 => Ok(ValType::F64), + ValType::V128 => Ok(ValType::V128), + ValType::Ref(ty) => Ok(ValType::Ref(self.arbitrary_matching_ref_type(u, ty)?)), + } + } + + fn arbitrary_matching_ref_type(&self, u: &mut Unstructured, ty: RefType) -> Result<RefType> { + Ok(RefType { + nullable: ty.nullable, + heap_type: self.arbitrary_matching_heap_type(u, ty.heap_type)?, + }) + } + + fn arbitrary_matching_heap_type(&self, u: &mut Unstructured, ty: HeapType) -> Result<HeapType> { + if !self.config.gc_enabled { + return Ok(ty); + } + use HeapType as HT; + let mut choices = vec![ty]; + match ty { + HT::Any => { + choices.extend([HT::Eq, HT::Struct, HT::Array, HT::I31, HT::None]); + choices.extend(self.array_types.iter().copied().map(HT::Concrete)); + choices.extend(self.struct_types.iter().copied().map(HT::Concrete)); + } + HT::Eq => { + choices.extend([HT::Struct, HT::Array, HT::I31, HT::None]); + choices.extend(self.array_types.iter().copied().map(HT::Concrete)); + choices.extend(self.struct_types.iter().copied().map(HT::Concrete)); + } + HT::Struct => { + choices.extend([HT::Struct, HT::None]); + choices.extend(self.struct_types.iter().copied().map(HT::Concrete)); + } + HT::Array => { + choices.extend([HT::Array, HT::None]); + choices.extend(self.array_types.iter().copied().map(HT::Concrete)); + } + HT::I31 => { + choices.push(HT::None); + } + HT::Concrete(idx) => { + if let Some(subs) = self.super_to_sub_types.get(&idx) { + choices.extend(subs.iter().copied().map(HT::Concrete)); + } + match self + .types + .get(usize::try_from(idx).unwrap()) + .map(|ty| &ty.composite_type) + { + Some(CompositeType::Array(_)) | Some(CompositeType::Struct(_)) => { + choices.push(HT::None) + } + Some(CompositeType::Func(_)) => choices.push(HT::NoFunc), + None => { + // The referenced type might be part of this same rec + // group we are currently generating, but not generated + // yet. In this case, leave `choices` as it is, and we + // will just end up choosing the original type again + // down below, which is fine. + } + } + } + HT::Func => { + choices.extend(self.func_types.iter().copied().map(HT::Concrete)); + choices.push(HT::NoFunc); + } + HT::Extern => { + choices.push(HT::NoExtern); + } + HT::Exn | HT::None | HT::NoExtern | HT::NoFunc => {} + } + Ok(*u.choose(&choices)?) + } + + fn arbitrary_matching_func_type( + &mut self, + u: &mut Unstructured, + ty: &FuncType, + ) -> Result<Rc<FuncType>> { + // Note: parameters are contravariant, results are covariant. See + // https://github.com/bytecodealliance/wasm-tools/blob/0616ef196a183cf137ee06b4a5993b7d590088bf/crates/wasmparser/src/readers/core/types/matches.rs#L137-L174 + // for details. + let mut params = Vec::with_capacity(ty.params.len()); + for param in &ty.params { + params.push(self.arbitrary_super_type_of_val_type(u, *param)?); + } + let mut results = Vec::with_capacity(ty.results.len()); + for result in &ty.results { + results.push(self.arbitrary_matching_val_type(u, *result)?); + } + Ok(Rc::new(FuncType { params, results })) + } + + fn arbitrary_super_type_of_val_type( + &mut self, + u: &mut Unstructured, + ty: ValType, + ) -> Result<ValType> { + match ty { + ValType::I32 => Ok(ValType::I32), + ValType::I64 => Ok(ValType::I64), + ValType::F32 => Ok(ValType::F32), + ValType::F64 => Ok(ValType::F64), + ValType::V128 => Ok(ValType::V128), + ValType::Ref(ty) => Ok(ValType::Ref(self.arbitrary_super_type_of_ref_type(u, ty)?)), + } + } + + fn arbitrary_super_type_of_ref_type( + &self, + u: &mut Unstructured, + ty: RefType, + ) -> Result<RefType> { + Ok(RefType { + // TODO: For now, only create allow nullable reference + // types. Eventually we should support non-nullable reference types, + // but this means that we will also need to recognize when it is + // impossible to create an instance of the reference (eg `(ref + // nofunc)` has no instances, and self-referential types that + // contain a non-null self-reference are also impossible to create). + nullable: true, + heap_type: self.arbitrary_super_type_of_heap_type(u, ty.heap_type)?, + }) + } + + fn arbitrary_super_type_of_heap_type( + &self, + u: &mut Unstructured, + ty: HeapType, + ) -> Result<HeapType> { + if !self.config.gc_enabled { + return Ok(ty); + } + use HeapType as HT; + let mut choices = vec![ty]; + match ty { + HT::None => { + choices.extend([HT::Any, HT::Eq, HT::Struct, HT::Array, HT::I31]); + choices.extend(self.array_types.iter().copied().map(HT::Concrete)); + choices.extend(self.struct_types.iter().copied().map(HT::Concrete)); + } + HT::NoExtern => { + choices.push(HT::Extern); + } + HT::NoFunc => { + choices.extend(self.func_types.iter().copied().map(HT::Concrete)); + choices.push(HT::Func); + } + HT::Concrete(mut idx) => { + match &self + .types + .get(usize::try_from(idx).unwrap()) + .map(|ty| &ty.composite_type) + { + Some(CompositeType::Array(_)) => { + choices.extend([HT::Any, HT::Eq, HT::Array]); + } + Some(CompositeType::Func(_)) => { + choices.push(HT::Func); + } + Some(CompositeType::Struct(_)) => { + choices.extend([HT::Any, HT::Eq, HT::Struct]); + } + None => { + // Same as in `arbitrary_matching_heap_type`: this was a + // forward reference to a concrete type that is part of + // this same rec group we are generating right now, and + // therefore we haven't generated that type yet. Just + // leave `choices` as it is and we will choose the + // original type again down below. + } + } + while let Some(supertype) = self + .types + .get(usize::try_from(idx).unwrap()) + .and_then(|ty| ty.supertype) + { + choices.push(HT::Concrete(supertype)); + idx = supertype; + } + } + HT::Struct | HT::Array | HT::I31 => { + choices.extend([HT::Any, HT::Eq]); + } + HT::Eq => { + choices.push(HT::Any); + } + HT::Exn | HT::Any | HT::Func | HT::Extern => {} + } + Ok(*u.choose(&choices)?) + } + + fn arbitrary_composite_type( + &mut self, + u: &mut Unstructured, + type_ref_limit: u32, + ) -> Result<CompositeType> { + if !self.config.gc_enabled { + return Ok(CompositeType::Func( + self.arbitrary_func_type(u, type_ref_limit)?, + )); + } + + match u.int_in_range(0..=2)? { + 0 => Ok(CompositeType::Array(ArrayType( + self.arbitrary_field_type(u, type_ref_limit)?, + ))), + 1 => Ok(CompositeType::Func( + self.arbitrary_func_type(u, type_ref_limit)?, + )), + 2 => Ok(CompositeType::Struct( + self.arbitrary_struct_type(u, type_ref_limit)?, + )), + _ => unreachable!(), + } + } + + fn arbitrary_struct_type( + &mut self, + u: &mut Unstructured, + type_ref_limit: u32, + ) -> Result<StructType> { + let len = u.int_in_range(0..=20)?; + let mut fields = Vec::with_capacity(len); + for _ in 0..len { + fields.push(self.arbitrary_field_type(u, type_ref_limit)?); + } + Ok(StructType { + fields: fields.into_boxed_slice(), + }) + } + + fn arbitrary_field_type( + &mut self, + u: &mut Unstructured, + type_ref_limit: u32, + ) -> Result<FieldType> { + Ok(FieldType { + element_type: self.arbitrary_storage_type(u, type_ref_limit)?, + mutable: u.arbitrary()?, + }) + } + + fn arbitrary_storage_type( + &mut self, + u: &mut Unstructured, + type_ref_limit: u32, + ) -> Result<StorageType> { + match u.int_in_range(0..=2)? { + 0 => Ok(StorageType::I8), + 1 => Ok(StorageType::I16), + 2 => Ok(StorageType::Val(self.arbitrary_valtype(u, type_ref_limit)?)), + _ => unreachable!(), + } + } + + fn arbitrary_ref_type(&self, u: &mut Unstructured) -> Result<RefType> { + Ok(RefType { + nullable: true, + heap_type: self.arbitrary_heap_type(u)?, + }) + } + + fn arbitrary_heap_type(&self, u: &mut Unstructured) -> Result<HeapType> { + assert!(self.config.reference_types_enabled); + + if self.config.gc_enabled && !self.types.is_empty() && u.arbitrary()? { + let type_ref_limit = u32::try_from(self.types.len()).unwrap(); + let idx = u.int_in_range(0..=type_ref_limit)?; + return Ok(HeapType::Concrete(idx)); + } + + let mut choices = vec![HeapType::Func, HeapType::Extern]; + if self.config.exceptions_enabled { + choices.push(HeapType::Exn); + } + if self.config.gc_enabled { + choices.extend( + [ + HeapType::Any, + HeapType::None, + HeapType::NoExtern, + HeapType::NoFunc, + HeapType::Eq, + HeapType::Struct, + HeapType::Array, + HeapType::I31, + ] + .iter() + .copied(), + ); + } + u.choose(&choices).copied() + } + + fn arbitrary_func_type( + &mut self, + u: &mut Unstructured, + type_ref_limit: u32, + ) -> Result<Rc<FuncType>> { + arbitrary_func_type( + u, + &self.config, + &self.valtypes, + if !self.config.multi_value_enabled { + Some(1) + } else { + None + }, + type_ref_limit, + ) + } + + fn can_add_local_or_import_tag(&self) -> bool { + self.config.exceptions_enabled + && self.has_tag_func_types() + && self.tags.len() < self.config.max_tags + } + + fn can_add_local_or_import_func(&self) -> bool { + !self.func_types.is_empty() && self.funcs.len() < self.config.max_funcs + } + + fn can_add_local_or_import_table(&self) -> bool { + self.tables.len() < self.config.max_tables + } + + fn can_add_local_or_import_global(&self) -> bool { + self.globals.len() < self.config.max_globals + } + + fn can_add_local_or_import_memory(&self) -> bool { + self.memories.len() < self.config.max_memories + } + + fn arbitrary_imports(&mut self, u: &mut Unstructured) -> Result<()> { + if self.config.max_type_size < self.type_size { + return Ok(()); + } + + let mut import_strings = HashSet::new(); + let mut choices: Vec<fn(&mut Unstructured, &mut Module) -> Result<EntityType>> = + Vec::with_capacity(5); + let min = self.config.min_imports.saturating_sub(self.num_imports); + let max = self.config.max_imports.saturating_sub(self.num_imports); + arbitrary_loop(u, min, max, |u| { + choices.clear(); + if self.can_add_local_or_import_tag() { + choices.push(|u, m| { + let ty = m.arbitrary_tag_type(u)?; + Ok(EntityType::Tag(ty)) + }); + } + if self.can_add_local_or_import_func() { + choices.push(|u, m| { + let idx = *u.choose(&m.func_types)?; + let ty = m.func_type(idx).clone(); + Ok(EntityType::Func(idx, ty)) + }); + } + if self.can_add_local_or_import_global() { + choices.push(|u, m| { + let ty = m.arbitrary_global_type(u)?; + Ok(EntityType::Global(ty)) + }); + } + if self.can_add_local_or_import_memory() { + choices.push(|u, m| { + let ty = arbitrary_memtype(u, m.config())?; + Ok(EntityType::Memory(ty)) + }); + } + if self.can_add_local_or_import_table() { + choices.push(|u, m| { + let ty = arbitrary_table_type(u, m.config())?; + Ok(EntityType::Table(ty)) + }); + } + + if choices.is_empty() { + // We are out of choices. If we have not have reached the + // minimum yet, then we have no way to satisfy the constraint, + // but we follow max-constraints before the min-import + // constraint. + return Ok(false); + } + + // Generate a type to import, but only actually add the item if the + // type size budget allows us to. + let f = u.choose(&choices)?; + let entity_type = f(u, self)?; + let budget = self.config.max_type_size - self.type_size; + if entity_type.size() + 1 > budget { + return Ok(false); + } + self.type_size += entity_type.size() + 1; + + // Generate an arbitrary module/name pair to name this import. + let mut import_pair = unique_import_strings(1_000, u)?; + if self.duplicate_imports_behavior == DuplicateImportsBehavior::Disallowed { + while import_strings.contains(&import_pair) { + use std::fmt::Write; + write!(&mut import_pair.1, "{}", import_strings.len()).unwrap(); + } + import_strings.insert(import_pair.clone()); + } + let (module, field) = import_pair; + + // Once our name is determined, then we push the typed item into the + // appropriate namespace. + match &entity_type { + EntityType::Tag(ty) => self.tags.push(ty.clone()), + EntityType::Func(idx, ty) => self.funcs.push((*idx, ty.clone())), + EntityType::Global(ty) => self.globals.push(*ty), + EntityType::Table(ty) => self.tables.push(*ty), + EntityType::Memory(ty) => self.memories.push(*ty), + } + + self.num_imports += 1; + self.imports.push(Import { + module, + field, + entity_type, + }); + Ok(true) + })?; + + Ok(()) + } + + /// Generate some arbitrary imports from the list of available imports. + /// + /// Returns `true` if there was a list of available imports + /// configured. Otherwise `false` and the caller should generate arbitrary + /// imports. + fn arbitrary_imports_from_available(&mut self, u: &mut Unstructured) -> Result<bool> { + let example_module = if let Some(wasm) = self.config.available_imports.take() { + wasm + } else { + return Ok(false); + }; + + #[cfg(feature = "wasmparser")] + { + self._arbitrary_imports_from_available(u, &example_module)?; + Ok(true) + } + #[cfg(not(feature = "wasmparser"))] + { + let _ = (example_module, u); + panic!("support for `available_imports` was disabled at compile time"); + } + } + + #[cfg(feature = "wasmparser")] + fn _arbitrary_imports_from_available( + &mut self, + u: &mut Unstructured, + example_module: &[u8], + ) -> Result<()> { + // First, parse the module-by-example to collect the types and imports. + // + // `available_types` will map from a signature index (which is the same as the index into + // this vector) as it appears in the parsed code, to the type itself as well as to the + // index in our newly generated module. Initially the option is `None` and will become a + // `Some` when we encounter an import that uses this signature in the next portion of this + // function. See also the `make_func_type` closure below. + let mut available_types = Vec::new(); + let mut available_imports = Vec::<wasmparser::Import>::new(); + for payload in wasmparser::Parser::new(0).parse_all(&example_module) { + match payload.expect("could not parse the available import payload") { + wasmparser::Payload::TypeSection(type_reader) => { + for ty in type_reader.into_iter_err_on_gc_types() { + let ty = ty.expect("could not parse type section"); + available_types.push((ty, None)); + } + } + wasmparser::Payload::ImportSection(import_reader) => { + for im in import_reader { + let im = im.expect("could not read import"); + // We can immediately filter whether this is an import we want to + // use. + let use_import = u.arbitrary().unwrap_or(false); + if !use_import { + continue; + } + available_imports.push(im); + } + } + _ => {} + } + } + + // In this function we need to place imported function/tag types in the types section and + // generate import entries (which refer to said types) at the same time. + let max_types = self.config.max_types; + let multi_value_enabled = self.config.multi_value_enabled; + let mut new_imports = Vec::with_capacity(available_imports.len()); + let first_type_index = self.types.len(); + let mut new_types = Vec::<SubType>::new(); + + // Returns the index to the translated type in the to-be type section, and the reference to + // the type itself. + let mut make_func_type = |parsed_sig_idx: u32| { + let serialized_sig_idx = match available_types.get_mut(parsed_sig_idx as usize) { + None => panic!("signature index refers to a type out of bounds"), + Some((_, Some(idx))) => *idx as usize, + Some((func_type, index_store)) => { + let multi_value_required = func_type.results().len() > 1; + let new_index = first_type_index + new_types.len(); + if new_index >= max_types || (multi_value_required && !multi_value_enabled) { + return None; + } + let func_type = Rc::new(FuncType { + params: func_type + .params() + .iter() + .map(|t| (*t).try_into().unwrap()) + .collect(), + results: func_type + .results() + .iter() + .map(|t| (*t).try_into().unwrap()) + .collect(), + }); + index_store.replace(new_index as u32); + new_types.push(SubType { + is_final: true, + supertype: None, + composite_type: CompositeType::Func(Rc::clone(&func_type)), + }); + new_index + } + }; + match &new_types[serialized_sig_idx - first_type_index].composite_type { + CompositeType::Func(f) => Some((serialized_sig_idx as u32, Rc::clone(f))), + _ => unimplemented!(), + } + }; + + for import in available_imports { + let type_size_budget = self.config.max_type_size - self.type_size; + let entity_type = match &import.ty { + wasmparser::TypeRef::Func(sig_idx) => { + if self.funcs.len() >= self.config.max_funcs { + continue; + } else if let Some((sig_idx, func_type)) = make_func_type(*sig_idx) { + let entity = EntityType::Func(sig_idx as u32, Rc::clone(&func_type)); + if type_size_budget < entity.size() { + continue; + } + self.funcs.push((sig_idx, func_type)); + entity + } else { + continue; + } + } + + wasmparser::TypeRef::Tag(wasmparser::TagType { func_type_idx, .. }) => { + let can_add_tag = self.tags.len() < self.config.max_tags; + if !self.config.exceptions_enabled || !can_add_tag { + continue; + } else if let Some((sig_idx, func_type)) = make_func_type(*func_type_idx) { + let tag_type = TagType { + func_type_idx: sig_idx, + func_type, + }; + let entity = EntityType::Tag(tag_type.clone()); + if type_size_budget < entity.size() { + continue; + } + self.tags.push(tag_type); + entity + } else { + continue; + } + } + + wasmparser::TypeRef::Table(table_ty) => { + let table_ty = TableType::try_from(*table_ty).unwrap(); + let entity = EntityType::Table(table_ty); + let type_size = entity.size(); + if type_size_budget < type_size || !self.can_add_local_or_import_table() { + continue; + } + self.type_size += type_size; + self.tables.push(table_ty); + entity + } + + wasmparser::TypeRef::Memory(memory_ty) => { + let memory_ty = MemoryType::try_from(*memory_ty).unwrap(); + let entity = EntityType::Memory(memory_ty); + let type_size = entity.size(); + if type_size_budget < type_size || !self.can_add_local_or_import_memory() { + continue; + } + self.type_size += type_size; + self.memories.push(memory_ty); + entity + } + + wasmparser::TypeRef::Global(global_ty) => { + let global_ty = (*global_ty).try_into().unwrap(); + let entity = EntityType::Global(global_ty); + let type_size = entity.size(); + if type_size_budget < type_size || !self.can_add_local_or_import_global() { + continue; + } + self.type_size += type_size; + self.globals.push(global_ty); + entity + } + }; + new_imports.push(Import { + module: import.module.to_string(), + field: import.name.to_string(), + entity_type, + }); + self.num_imports += 1; + } + + // Finally, add the entities we just generated. + for ty in new_types { + self.rec_groups.push(self.types.len()..self.types.len() + 1); + self.add_type(ty); + } + self.imports.extend(new_imports); + + Ok(()) + } + + fn type_of(&self, kind: ExportKind, index: u32) -> EntityType { + match kind { + ExportKind::Global => EntityType::Global(self.globals[index as usize]), + ExportKind::Memory => EntityType::Memory(self.memories[index as usize]), + ExportKind::Table => EntityType::Table(self.tables[index as usize]), + ExportKind::Func => { + let (_idx, ty) = &self.funcs[index as usize]; + EntityType::Func(u32::max_value(), ty.clone()) + } + ExportKind::Tag => EntityType::Tag(self.tags[index as usize].clone()), + } + } + + fn ty(&self, idx: u32) -> &SubType { + &self.types[idx as usize] + } + + fn func_types(&self) -> impl Iterator<Item = (u32, &FuncType)> + '_ { + self.func_types + .iter() + .copied() + .map(move |type_i| (type_i, &**self.func_type(type_i))) + } + + fn func_type(&self, idx: u32) -> &Rc<FuncType> { + match &self.ty(idx).composite_type { + CompositeType::Func(f) => f, + _ => panic!("types[{idx}] is not a func type"), + } + } + + fn tags(&self) -> impl Iterator<Item = (u32, &TagType)> + '_ { + self.tags + .iter() + .enumerate() + .map(move |(i, ty)| (i as u32, ty)) + } + + fn funcs(&self) -> impl Iterator<Item = (u32, &Rc<FuncType>)> + '_ { + self.funcs + .iter() + .enumerate() + .map(move |(i, (_, ty))| (i as u32, ty)) + } + + fn has_tag_func_types(&self) -> bool { + self.tag_func_types().next().is_some() + } + + fn tag_func_types(&self) -> impl Iterator<Item = u32> + '_ { + self.func_types + .iter() + .copied() + .filter(move |i| self.func_type(*i).results.is_empty()) + } + + fn arbitrary_valtype(&self, u: &mut Unstructured, type_ref_limit: u32) -> Result<ValType> { + arbitrary_valtype(u, &self.config, &self.valtypes, type_ref_limit) + } + + fn arbitrary_global_type(&self, u: &mut Unstructured) -> Result<GlobalType> { + Ok(GlobalType { + val_type: self.arbitrary_valtype(u, u32::try_from(self.types.len()).unwrap())?, + mutable: u.arbitrary()?, + }) + } + + fn arbitrary_tag_type(&self, u: &mut Unstructured) -> Result<TagType> { + let candidate_func_types: Vec<_> = self.tag_func_types().collect(); + arbitrary_tag_type(u, &candidate_func_types, |ty_idx| { + self.func_type(ty_idx).clone() + }) + } + + fn arbitrary_tags(&mut self, u: &mut Unstructured) -> Result<()> { + if !self.config.exceptions_enabled || !self.has_tag_func_types() { + return Ok(()); + } + + arbitrary_loop(u, self.config.min_tags, self.config.max_tags, |u| { + if !self.can_add_local_or_import_tag() { + return Ok(false); + } + self.tags.push(self.arbitrary_tag_type(u)?); + self.num_defined_tags += 1; + Ok(true) + }) + } + + fn arbitrary_funcs(&mut self, u: &mut Unstructured) -> Result<()> { + if self.func_types.is_empty() { + return Ok(()); + } + + arbitrary_loop(u, self.config.min_funcs, self.config.max_funcs, |u| { + if !self.can_add_local_or_import_func() { + return Ok(false); + } + let max = self.func_types.len() - 1; + let ty = self.func_types[u.int_in_range(0..=max)?]; + self.funcs.push((ty, self.func_type(ty).clone())); + self.num_defined_funcs += 1; + Ok(true) + }) + } + + fn arbitrary_tables(&mut self, u: &mut Unstructured) -> Result<()> { + arbitrary_loop( + u, + self.config.min_tables as usize, + self.config.max_tables as usize, + |u| { + if !self.can_add_local_or_import_table() { + return Ok(false); + } + self.num_defined_tables += 1; + let ty = arbitrary_table_type(u, self.config())?; + self.tables.push(ty); + Ok(true) + }, + ) + } + + fn arbitrary_memories(&mut self, u: &mut Unstructured) -> Result<()> { + arbitrary_loop( + u, + self.config.min_memories as usize, + self.config.max_memories as usize, + |u| { + if !self.can_add_local_or_import_memory() { + return Ok(false); + } + self.num_defined_memories += 1; + self.memories.push(arbitrary_memtype(u, self.config())?); + Ok(true) + }, + ) + } + + fn arbitrary_globals(&mut self, u: &mut Unstructured) -> Result<()> { + let mut choices: Vec<Box<dyn Fn(&mut Unstructured, ValType) -> Result<GlobalInitExpr>>> = + vec![]; + let num_imported_globals = self.globals.len(); + + arbitrary_loop(u, self.config.min_globals, self.config.max_globals, |u| { + if !self.can_add_local_or_import_global() { + return Ok(false); + } + + let ty = self.arbitrary_global_type(u)?; + + choices.clear(); + let num_funcs = self.funcs.len() as u32; + choices.push(Box::new(move |u, ty| { + Ok(GlobalInitExpr::ConstExpr(match ty { + ValType::I32 => ConstExpr::i32_const(u.arbitrary()?), + ValType::I64 => ConstExpr::i64_const(u.arbitrary()?), + ValType::F32 => ConstExpr::f32_const(u.arbitrary()?), + ValType::F64 => ConstExpr::f64_const(u.arbitrary()?), + ValType::V128 => ConstExpr::v128_const(u.arbitrary()?), + ValType::Ref(ty) => { + assert!(ty.nullable); + if ty.heap_type == HeapType::Func && num_funcs > 0 && u.arbitrary()? { + let func = u.int_in_range(0..=num_funcs - 1)?; + return Ok(GlobalInitExpr::FuncRef(func)); + } + ConstExpr::ref_null(ty.heap_type) + } + })) + })); + + for (i, g) in self.globals[..num_imported_globals].iter().enumerate() { + if !g.mutable && g.val_type == ty.val_type { + choices.push(Box::new(move |_, _| { + Ok(GlobalInitExpr::ConstExpr(ConstExpr::global_get(i as u32))) + })); + } + } + + let f = u.choose(&choices)?; + let expr = f(u, ty.val_type)?; + let global_idx = self.globals.len() as u32; + self.globals.push(ty); + self.defined_globals.push((global_idx, expr)); + Ok(true) + }) + } + + fn arbitrary_exports(&mut self, u: &mut Unstructured) -> Result<()> { + if self.config.max_type_size < self.type_size && !self.config.export_everything { + return Ok(()); + } + + // Build up a list of candidates for each class of import + let mut choices: Vec<Vec<(ExportKind, u32)>> = Vec::with_capacity(6); + choices.push( + (0..self.funcs.len()) + .map(|i| (ExportKind::Func, i as u32)) + .collect(), + ); + choices.push( + (0..self.tables.len()) + .map(|i| (ExportKind::Table, i as u32)) + .collect(), + ); + choices.push( + (0..self.memories.len()) + .map(|i| (ExportKind::Memory, i as u32)) + .collect(), + ); + choices.push( + (0..self.globals.len()) + .map(|i| (ExportKind::Global, i as u32)) + .collect(), + ); + + // If the configuration demands exporting everything, we do so here and + // early-return. + if self.config.export_everything { + for choices_by_kind in choices { + for (kind, idx) in choices_by_kind { + let name = unique_string(1_000, &mut self.export_names, u)?; + self.add_arbitrary_export(name, kind, idx)?; + } + } + return Ok(()); + } + + arbitrary_loop(u, self.config.min_exports, self.config.max_exports, |u| { + // Remove all candidates for export whose type size exceeds our + // remaining budget for type size. Then also remove any classes + // of exports which no longer have any candidates. + // + // If there's nothing remaining after this, then we're done. + let max_size = self.config.max_type_size - self.type_size; + for list in choices.iter_mut() { + list.retain(|(kind, idx)| self.type_of(*kind, *idx).size() + 1 < max_size); + } + choices.retain(|list| !list.is_empty()); + if choices.is_empty() { + return Ok(false); + } + + // Pick a name, then pick the export, and then we can record + // information about the chosen export. + let name = unique_string(1_000, &mut self.export_names, u)?; + let list = u.choose(&choices)?; + let (kind, idx) = *u.choose(list)?; + self.add_arbitrary_export(name, kind, idx)?; + Ok(true) + }) + } + + fn add_arbitrary_export(&mut self, name: String, kind: ExportKind, idx: u32) -> Result<()> { + let ty = self.type_of(kind, idx); + self.type_size += 1 + ty.size(); + if self.type_size <= self.config.max_type_size { + self.exports.push((name, kind, idx)); + Ok(()) + } else { + // If our addition of exports takes us above the allowed number of + // types, we fail; this error code is not the most illustrative of + // the cause but is the best available from `arbitrary`. + Err(arbitrary::Error::IncorrectFormat) + } + } + + fn arbitrary_start(&mut self, u: &mut Unstructured) -> Result<()> { + if !self.config.allow_start_export { + return Ok(()); + } + + let mut choices = Vec::with_capacity(self.funcs.len() as usize); + + for (func_idx, ty) in self.funcs() { + if ty.params.is_empty() && ty.results.is_empty() { + choices.push(func_idx); + } + } + + if !choices.is_empty() && u.arbitrary().unwrap_or(false) { + let f = *u.choose(&choices)?; + self.start = Some(f); + } + + Ok(()) + } + + fn arbitrary_elems(&mut self, u: &mut Unstructured) -> Result<()> { + let func_max = self.funcs.len() as u32; + + // Create a helper closure to choose an arbitrary offset. + let mut offset_global_choices = vec![]; + if !self.config.disallow_traps { + for (i, g) in self.globals[..self.globals.len() - self.defined_globals.len()] + .iter() + .enumerate() + { + if !g.mutable && g.val_type == ValType::I32 { + offset_global_choices.push(i as u32); + } + } + } + let arbitrary_active_elem = |u: &mut Unstructured, + min_mem_size: u32, + table: Option<u32>, + disallow_traps: bool, + table_ty: &TableType| { + let (offset, max_size_hint) = if !offset_global_choices.is_empty() && u.arbitrary()? { + let g = u.choose(&offset_global_choices)?; + (Offset::Global(*g), None) + } else { + let max_mem_size = if disallow_traps { + table_ty.minimum + } else { + u32::MAX + }; + let offset = + arbitrary_offset(u, min_mem_size.into(), max_mem_size.into(), 0)? as u32; + let max_size_hint = if disallow_traps + || (offset <= min_mem_size && u.int_in_range(0..=CHANCE_OFFSET_INBOUNDS)? != 0) + { + Some(min_mem_size - offset) + } else { + None + }; + (Offset::Const32(offset as i32), max_size_hint) + }; + Ok((ElementKind::Active { table, offset }, max_size_hint)) + }; + + type GenElemSegment<'a> = + dyn Fn(&mut Unstructured) -> Result<(ElementKind, Option<u32>)> + 'a; + let mut funcrefs: Vec<Box<GenElemSegment>> = Vec::new(); + let mut externrefs: Vec<Box<GenElemSegment>> = Vec::new(); + let disallow_traps = self.config.disallow_traps; + for (i, ty) in self.tables.iter().enumerate() { + // If this table starts with no capacity then any non-empty element + // segment placed onto it will immediately trap, which isn't too + // too interesting. If that's the case give it an unlikely chance + // of proceeding. + if ty.minimum == 0 && u.int_in_range(0..=CHANCE_SEGMENT_ON_EMPTY)? != 0 { + continue; + } + + let dst = if ty.element_type == RefType::FUNCREF { + &mut funcrefs + } else { + &mut externrefs + }; + let minimum = ty.minimum; + // If the first table is a funcref table then it's a candidate for + // the MVP encoding of element segments. + if i == 0 && ty.element_type == RefType::FUNCREF { + dst.push(Box::new(move |u| { + arbitrary_active_elem(u, minimum, None, disallow_traps, ty) + })); + } + if self.config.bulk_memory_enabled { + let idx = Some(i as u32); + dst.push(Box::new(move |u| { + arbitrary_active_elem(u, minimum, idx, disallow_traps, ty) + })); + } + } + + // Bulk memory enables passive/declared segments for funcrefs, and + // reference types additionally enables the segments for externrefs. + if self.config.bulk_memory_enabled { + funcrefs.push(Box::new(|_| Ok((ElementKind::Passive, None)))); + funcrefs.push(Box::new(|_| Ok((ElementKind::Declared, None)))); + if self.config.reference_types_enabled { + externrefs.push(Box::new(|_| Ok((ElementKind::Passive, None)))); + externrefs.push(Box::new(|_| Ok((ElementKind::Declared, None)))); + } + } + + let mut choices = Vec::new(); + if !funcrefs.is_empty() { + choices.push((&funcrefs, RefType::FUNCREF)); + } + if !externrefs.is_empty() { + choices.push((&externrefs, RefType::EXTERNREF)); + } + + if choices.is_empty() { + return Ok(()); + } + arbitrary_loop( + u, + self.config.min_element_segments, + self.config.max_element_segments, + |u| { + // Choose whether to generate a segment whose elements are initialized via + // expressions, or one whose elements are initialized via function indices. + let (kind_candidates, ty) = *u.choose(&choices)?; + + // Select a kind for this segment now that we know the number of + // items the segment will hold. + let (kind, max_size_hint) = u.choose(kind_candidates)?(u)?; + let max = max_size_hint + .map(|i| usize::try_from(i).unwrap()) + .unwrap_or_else(|| self.config.max_elements); + + // Pick whether we're going to use expression elements or + // indices. Note that externrefs must use expressions, + // and functions without reference types must use indices. + let items = if ty == RefType::EXTERNREF + || (self.config.reference_types_enabled && u.arbitrary()?) + { + let mut init = vec![]; + arbitrary_loop(u, self.config.min_elements, max, |u| { + init.push( + if ty == RefType::EXTERNREF || func_max == 0 || u.arbitrary()? { + None + } else { + Some(u.int_in_range(0..=func_max - 1)?) + }, + ); + Ok(true) + })?; + Elements::Expressions(init) + } else { + let mut init = vec![]; + if func_max > 0 { + arbitrary_loop(u, self.config.min_elements, max, |u| { + let func_idx = u.int_in_range(0..=func_max - 1)?; + init.push(func_idx); + Ok(true) + })?; + } + Elements::Functions(init) + }; + + self.elems.push(ElementSegment { kind, ty, items }); + Ok(true) + }, + ) + } + + fn arbitrary_code(&mut self, u: &mut Unstructured, allow_invalid: bool) -> Result<()> { + self.code.reserve(self.num_defined_funcs); + let mut allocs = CodeBuilderAllocations::new(self); + for (_, ty) in self.funcs[self.funcs.len() - self.num_defined_funcs..].iter() { + let body = self.arbitrary_func_body(u, ty, &mut allocs, allow_invalid)?; + self.code.push(body); + } + allocs.finish(u, self)?; + Ok(()) + } + + fn arbitrary_func_body( + &self, + u: &mut Unstructured, + ty: &FuncType, + allocs: &mut CodeBuilderAllocations, + allow_invalid: bool, + ) -> Result<Code> { + let mut locals = self.arbitrary_locals(u)?; + let builder = allocs.builder(ty, &mut locals); + let instructions = if allow_invalid && u.arbitrary().unwrap_or(false) { + Instructions::Arbitrary(arbitrary_vec_u8(u)?) + } else { + Instructions::Generated(builder.arbitrary(u, self)?) + }; + + Ok(Code { + locals, + instructions, + }) + } + + fn arbitrary_locals(&self, u: &mut Unstructured) -> Result<Vec<ValType>> { + let mut ret = Vec::new(); + arbitrary_loop(u, 0, 100, |u| { + ret.push(self.arbitrary_valtype(u, u32::try_from(self.types.len()).unwrap())?); + Ok(true) + })?; + Ok(ret) + } + + fn arbitrary_data(&mut self, u: &mut Unstructured) -> Result<()> { + // With bulk-memory we can generate passive data, otherwise if there are + // no memories we can't generate any data. + let memories = self.memories.len() as u32; + if memories == 0 && !self.config.bulk_memory_enabled { + return Ok(()); + } + let disallow_traps = self.config.disallow_traps; + let mut choices32: Vec<Box<dyn Fn(&mut Unstructured, u64, usize) -> Result<Offset>>> = + vec![]; + choices32.push(Box::new(|u, min_size, data_len| { + let min = u32::try_from(min_size.saturating_mul(64 * 1024)) + .unwrap_or(u32::MAX) + .into(); + let max = if disallow_traps { min } else { u32::MAX.into() }; + Ok(Offset::Const32( + arbitrary_offset(u, min, max, data_len)? as i32 + )) + })); + let mut choices64: Vec<Box<dyn Fn(&mut Unstructured, u64, usize) -> Result<Offset>>> = + vec![]; + choices64.push(Box::new(|u, min_size, data_len| { + let min = min_size.saturating_mul(64 * 1024); + let max = if disallow_traps { min } else { u64::MAX }; + Ok(Offset::Const64( + arbitrary_offset(u, min, max, data_len)? as i64 + )) + })); + if !self.config.disallow_traps { + for (i, g) in self.globals[..self.globals.len() - self.defined_globals.len()] + .iter() + .enumerate() + { + if g.mutable { + continue; + } + if g.val_type == ValType::I32 { + choices32.push(Box::new(move |_, _, _| Ok(Offset::Global(i as u32)))); + } else if g.val_type == ValType::I64 { + choices64.push(Box::new(move |_, _, _| Ok(Offset::Global(i as u32)))); + } + } + } + + // Build a list of candidate memories that we'll add data initializers + // for. If a memory doesn't have an initial size then any initializers + // for that memory will trap instantiation, which isn't too + // interesting. Try to make this happen less often by making it less + // likely that a memory with 0 size will have a data segment. + let mut memories = Vec::new(); + for (i, mem) in self.memories.iter().enumerate() { + if mem.minimum > 0 || u.int_in_range(0..=CHANCE_SEGMENT_ON_EMPTY)? == 0 { + memories.push(i as u32); + } + } + + // With memories we can generate data segments, and with bulk memory we + // can generate passive segments. Without these though we can't create + // a valid module with data segments. + if memories.is_empty() && !self.config.bulk_memory_enabled { + return Ok(()); + } + + arbitrary_loop( + u, + self.config.min_data_segments, + self.config.max_data_segments, + |u| { + let mut init: Vec<u8> = u.arbitrary()?; + + // Passive data can only be generated if bulk memory is enabled. + // Otherwise if there are no memories we *only* generate passive + // data. Finally if all conditions are met we use an input byte to + // determine if it should be passive or active. + let kind = + if self.config.bulk_memory_enabled && (memories.is_empty() || u.arbitrary()?) { + DataSegmentKind::Passive + } else { + let memory_index = *u.choose(&memories)?; + let mem = &self.memories[memory_index as usize]; + let f = if mem.memory64 { + u.choose(&choices64)? + } else { + u.choose(&choices32)? + }; + let mut offset = f(u, mem.minimum, init.len())?; + + // If traps are disallowed then truncate the size of the + // data segment to the minimum size of memory to guarantee + // it will fit. Afterwards ensure that the offset of the + // data segment is in-bounds by clamping it to the + if self.config.disallow_traps { + let max_size = (u64::MAX / 64 / 1024).min(mem.minimum) * 64 * 1024; + init.truncate(max_size as usize); + let max_offset = max_size - init.len() as u64; + match &mut offset { + Offset::Const32(x) => { + *x = (*x as u64).min(max_offset) as i32; + } + Offset::Const64(x) => { + *x = (*x as u64).min(max_offset) as i64; + } + Offset::Global(_) => unreachable!(), + } + } + DataSegmentKind::Active { + offset, + memory_index, + } + }; + self.data.push(DataSegment { kind, init }); + Ok(true) + }, + ) + } + + fn params_results(&self, ty: &BlockType) -> (Vec<ValType>, Vec<ValType>) { + match ty { + BlockType::Empty => (vec![], vec![]), + BlockType::Result(t) => (vec![], vec![*t]), + BlockType::FunctionType(ty) => { + let ty = self.func_type(*ty); + (ty.params.to_vec(), ty.results.to_vec()) + } + } + } +} + +pub(crate) fn arbitrary_limits32( + u: &mut Unstructured, + min_minimum: Option<u32>, + max_minimum: u32, + max_required: bool, + max_inbounds: u32, +) -> Result<(u32, Option<u32>)> { + let (min, max) = arbitrary_limits64( + u, + min_minimum.map(Into::into), + max_minimum.into(), + max_required, + max_inbounds.into(), + )?; + Ok(( + u32::try_from(min).unwrap(), + max.map(|i| u32::try_from(i).unwrap()), + )) +} + +pub(crate) fn arbitrary_limits64( + u: &mut Unstructured, + min_minimum: Option<u64>, + max_minimum: u64, + max_required: bool, + max_inbounds: u64, +) -> Result<(u64, Option<u64>)> { + let min = gradually_grow(u, min_minimum.unwrap_or(0), max_inbounds, max_minimum)?; + let max = if max_required || u.arbitrary().unwrap_or(false) { + Some(u.int_in_range(min..=max_minimum)?) + } else { + None + }; + Ok((min, max)) +} + +pub(crate) fn configured_valtypes(config: &Config) -> Vec<ValType> { + let mut valtypes = Vec::with_capacity(25); + valtypes.push(ValType::I32); + valtypes.push(ValType::I64); + valtypes.push(ValType::F32); + valtypes.push(ValType::F64); + if config.simd_enabled { + valtypes.push(ValType::V128); + } + if config.gc_enabled { + for nullable in [ + // TODO: For now, only create allow nullable reference + // types. Eventually we should support non-nullable reference types, + // but this means that we will also need to recognize when it is + // impossible to create an instance of the reference (eg `(ref + // nofunc)` has no instances, and self-referential types that + // contain a non-null self-reference are also impossible to create). + true, + ] { + for heap_type in [ + HeapType::Any, + HeapType::Eq, + HeapType::I31, + HeapType::Array, + HeapType::Struct, + HeapType::None, + HeapType::Func, + HeapType::NoFunc, + HeapType::Extern, + HeapType::NoExtern, + ] { + valtypes.push(ValType::Ref(RefType { + nullable, + heap_type, + })); + } + } + } else if config.reference_types_enabled { + valtypes.push(ValType::EXTERNREF); + valtypes.push(ValType::FUNCREF); + } + valtypes +} + +pub(crate) fn arbitrary_func_type( + u: &mut Unstructured, + config: &Config, + valtypes: &[ValType], + max_results: Option<usize>, + type_ref_limit: u32, +) -> Result<Rc<FuncType>> { + let mut params = vec![]; + let mut results = vec![]; + arbitrary_loop(u, 0, 20, |u| { + params.push(arbitrary_valtype(u, config, valtypes, type_ref_limit)?); + Ok(true) + })?; + arbitrary_loop(u, 0, max_results.unwrap_or(20), |u| { + results.push(arbitrary_valtype(u, config, valtypes, type_ref_limit)?); + Ok(true) + })?; + Ok(Rc::new(FuncType { params, results })) +} + +fn arbitrary_valtype( + u: &mut Unstructured, + config: &Config, + valtypes: &[ValType], + type_ref_limit: u32, +) -> Result<ValType> { + if config.gc_enabled && type_ref_limit > 0 && u.ratio(1, 20)? { + Ok(ValType::Ref(RefType { + // TODO: For now, only create allow nullable reference + // types. Eventually we should support non-nullable reference types, + // but this means that we will also need to recognize when it is + // impossible to create an instance of the reference (eg `(ref + // nofunc)` has no instances, and self-referential types that + // contain a non-null self-reference are also impossible to create). + nullable: true, + heap_type: HeapType::Concrete(u.int_in_range(0..=type_ref_limit - 1)?), + })) + } else { + Ok(*u.choose(valtypes)?) + } +} + +pub(crate) fn arbitrary_table_type(u: &mut Unstructured, config: &Config) -> Result<TableType> { + // We don't want to generate tables that are too large on average, so + // keep the "inbounds" limit here a bit smaller. + let max_inbounds = 10_000; + let min_elements = if config.disallow_traps { Some(1) } else { None }; + let max_elements = min_elements.unwrap_or(0).max(config.max_table_elements); + let (minimum, maximum) = arbitrary_limits32( + u, + min_elements, + max_elements, + config.table_max_size_required, + max_inbounds.min(max_elements), + )?; + if config.disallow_traps { + assert!(minimum > 0); + } + Ok(TableType { + element_type: if config.reference_types_enabled { + *u.choose(&[RefType::FUNCREF, RefType::EXTERNREF])? + } else { + RefType::FUNCREF + }, + minimum, + maximum, + }) +} + +pub(crate) fn arbitrary_memtype(u: &mut Unstructured, config: &Config) -> Result<MemoryType> { + // When threads are enabled, we only want to generate shared memories about + // 25% of the time. + let shared = config.threads_enabled && u.ratio(1, 4)?; + // We want to favor memories <= 1gb in size, allocate at most 16k pages, + // depending on the maximum number of memories. + let memory64 = config.memory64_enabled && u.arbitrary()?; + let max_inbounds = 16 * 1024 / u64::try_from(config.max_memories).unwrap(); + let min_pages = if config.disallow_traps { Some(1) } else { None }; + let max_pages = min_pages.unwrap_or(0).max(if memory64 { + config.max_memory64_pages + } else { + config.max_memory32_pages + }); + let (minimum, maximum) = arbitrary_limits64( + u, + min_pages, + max_pages, + config.memory_max_size_required || shared, + max_inbounds.min(max_pages), + )?; + Ok(MemoryType { + minimum, + maximum, + memory64, + shared, + }) +} + +pub(crate) fn arbitrary_tag_type( + u: &mut Unstructured, + candidate_func_types: &[u32], + get_func_type: impl FnOnce(u32) -> Rc<FuncType>, +) -> Result<TagType> { + let max = candidate_func_types.len() - 1; + let ty = candidate_func_types[u.int_in_range(0..=max)?]; + Ok(TagType { + func_type_idx: ty, + func_type: get_func_type(ty), + }) +} + +/// This function generates a number between `min` and `max`, favoring values +/// between `min` and `max_inbounds`. +/// +/// The thinking behind this function is that it's used for things like offsets +/// and minimum sizes which, when very large, can trivially make the wasm oom or +/// abort with a trap. This isn't the most interesting thing to do so it tries +/// to favor numbers in the `min..max_inbounds` range to avoid immediate ooms. +fn gradually_grow(u: &mut Unstructured, min: u64, max_inbounds: u64, max: u64) -> Result<u64> { + if min == max { + return Ok(min); + } + let min = min as f64; + let max = max as f64; + let max_inbounds = max_inbounds as f64; + let x = u.arbitrary::<u32>()?; + let x = f64::from(x); + let x = map_custom( + x, + f64::from(u32::MIN)..f64::from(u32::MAX), + min..max_inbounds, + min..max, + ); + return Ok(x.round() as u64); + + /// Map a value from within the input range to the output range(s). + /// + /// This will first map the input range into the `0..1` input range, and + /// then depending on the value it will either map it exponentially + /// (favoring small values) into the `output_inbounds` range or it will map + /// it into the `output` range. + fn map_custom( + value: f64, + input: Range<f64>, + output_inbounds: Range<f64>, + output: Range<f64>, + ) -> f64 { + assert!(!value.is_nan(), "{}", value); + assert!(value.is_finite(), "{}", value); + assert!(input.start < input.end, "{} < {}", input.start, input.end); + assert!( + output.start < output.end, + "{} < {}", + output.start, + output.end + ); + assert!(value >= input.start, "{} >= {}", value, input.start); + assert!(value <= input.end, "{} <= {}", value, input.end); + assert!( + output.start <= output_inbounds.start, + "{} <= {}", + output.start, + output_inbounds.start + ); + assert!( + output_inbounds.end <= output.end, + "{} <= {}", + output_inbounds.end, + output.end + ); + + let x = map_linear(value, input, 0.0..1.0); + let result = if x < PCT_INBOUNDS { + if output_inbounds.start == output_inbounds.end { + output_inbounds.start + } else { + let unscaled = x * x * x * x * x * x; + map_linear(unscaled, 0.0..1.0, output_inbounds) + } + } else { + map_linear(x, 0.0..1.0, output.clone()) + }; + + assert!(result >= output.start, "{} >= {}", result, output.start); + assert!(result <= output.end, "{} <= {}", result, output.end); + result + } + + /// Map a value from within the input range linearly to the output range. + /// + /// For example, mapping `0.5` from the input range `0.0..1.0` to the output + /// range `1.0..3.0` produces `2.0`. + fn map_linear( + value: f64, + Range { + start: in_low, + end: in_high, + }: Range<f64>, + Range { + start: out_low, + end: out_high, + }: Range<f64>, + ) -> f64 { + assert!(!value.is_nan(), "{}", value); + assert!(value.is_finite(), "{}", value); + assert!(in_low < in_high, "{} < {}", in_low, in_high); + assert!(out_low < out_high, "{} < {}", out_low, out_high); + assert!(value >= in_low, "{} >= {}", value, in_low); + assert!(value <= in_high, "{} <= {}", value, in_high); + + let dividend = out_high - out_low; + let divisor = in_high - in_low; + let slope = dividend / divisor; + let result = out_low + (slope * (value - in_low)); + + assert!(result >= out_low, "{} >= {}", result, out_low); + assert!(result <= out_high, "{} <= {}", result, out_high); + result + } +} + +/// Selects a reasonable offset for an element or data segment. This favors +/// having the segment being in-bounds, but it may still generate +/// any offset. +fn arbitrary_offset( + u: &mut Unstructured, + limit_min: u64, + limit_max: u64, + segment_size: usize, +) -> Result<u64> { + let size = u64::try_from(segment_size).unwrap(); + + // If the segment is too big for the whole memory, just give it any + // offset. + if size > limit_min { + u.int_in_range(0..=limit_max) + } else { + gradually_grow(u, 0, limit_min - size, limit_max) + } +} + +fn unique_import_strings(max_size: usize, u: &mut Unstructured) -> Result<(String, String)> { + let module = limited_string(max_size, u)?; + let field = limited_string(max_size, u)?; + Ok((module, field)) +} + +fn arbitrary_vec_u8(u: &mut Unstructured) -> Result<Vec<u8>> { + let size = u.arbitrary_len::<u8>()?; + Ok(u.bytes(size)?.to_vec()) +} + +impl EntityType { + fn size(&self) -> u32 { + match self { + EntityType::Tag(_) + | EntityType::Global(_) + | EntityType::Table(_) + | EntityType::Memory(_) => 1, + EntityType::Func(_, ty) => 1 + (ty.params.len() + ty.results.len()) as u32, + } + } +} + +// A helper structure used when generating module/instance types to limit the +// amount of each kind of import created. +#[derive(Default, Clone, Copy, PartialEq)] +struct Entities { + globals: usize, + memories: usize, + tables: usize, + funcs: usize, + tags: usize, +} + +/// A container for the kinds of instructions that wasm-smith is allowed to +/// emit. +/// +/// # Example +/// +/// ``` +/// # use wasm_smith::{InstructionKinds, InstructionKind}; +/// let kinds = InstructionKinds::new(&[InstructionKind::Numeric, InstructionKind::Memory]); +/// assert!(kinds.contains(InstructionKind::Memory)); +/// ``` +#[derive(Clone, Copy, Debug, Default)] +#[cfg_attr(feature = "serde_derive", derive(serde_derive::Deserialize))] +pub struct InstructionKinds(pub(crate) FlagSet<InstructionKind>); + +impl InstructionKinds { + /// Create a new container. + pub fn new(kinds: &[InstructionKind]) -> Self { + Self(kinds.iter().fold(FlagSet::default(), |ks, k| ks | *k)) + } + + /// Include all [InstructionKind]s. + pub fn all() -> Self { + Self(FlagSet::full()) + } + + /// Include no [InstructionKind]s. + pub fn none() -> Self { + Self(FlagSet::default()) + } + + /// Check if the [InstructionKind] is contained in this set. + #[inline] + pub fn contains(&self, kind: InstructionKind) -> bool { + self.0.contains(kind) + } +} + +flags! { + /// Enumerate the categories of instructions defined in the [WebAssembly + /// specification](https://webassembly.github.io/spec/core/syntax/instructions.html). + #[allow(missing_docs)] + #[cfg_attr(feature = "_internal_cli", derive(serde_derive::Deserialize))] + pub enum InstructionKind: u16 { + Numeric, + Vector, + Reference, + Parametric, + Variable, + Table, + Memory, + Control, + Aggregate, + } +} + +impl FromStr for InstructionKinds { + type Err = String; + fn from_str(s: &str) -> std::prelude::v1::Result<Self, Self::Err> { + let mut kinds = vec![]; + for part in s.split(",") { + let kind = InstructionKind::from_str(part)?; + kinds.push(kind); + } + Ok(InstructionKinds::new(&kinds)) + } +} + +impl FromStr for InstructionKind { + type Err = String; + fn from_str(s: &str) -> std::result::Result<Self, Self::Err> { + match s.to_lowercase().as_str() { + "numeric" => Ok(InstructionKind::Numeric), + "vector" => Ok(InstructionKind::Vector), + "reference" => Ok(InstructionKind::Reference), + "parametric" => Ok(InstructionKind::Parametric), + "variable" => Ok(InstructionKind::Variable), + "table" => Ok(InstructionKind::Table), + "memory" => Ok(InstructionKind::Memory), + "control" => Ok(InstructionKind::Control), + _ => Err(format!("unknown instruction kind: {}", s)), + } + } +} diff --git a/third_party/rust/wasm-smith/src/core/code_builder.rs b/third_party/rust/wasm-smith/src/core/code_builder.rs new file mode 100644 index 0000000000..1bc09008ad --- /dev/null +++ b/third_party/rust/wasm-smith/src/core/code_builder.rs @@ -0,0 +1,7058 @@ +use super::{ + CompositeType, Elements, FuncType, GlobalInitExpr, Instruction, InstructionKind::*, + InstructionKinds, Module, ValType, +}; +use crate::{unique_string, MemoryOffsetChoices}; +use arbitrary::{Result, Unstructured}; +use std::collections::{BTreeMap, BTreeSet}; +use std::convert::TryFrom; +use std::rc::Rc; +use wasm_encoder::{ + ArrayType, BlockType, Catch, ConstExpr, ExportKind, FieldType, GlobalType, HeapType, MemArg, + RefType, StorageType, StructType, +}; +mod no_traps; + +macro_rules! instructions { + ( + $( + ($predicate:expr, $generator_fn:ident, $instruction_kind:ident $(, $cost:tt)?), + )* + ) => { + static NUM_OPTIONS: usize = instructions!( + @count; + $( $generator_fn )* + ); + + fn choose_instruction( + u: &mut Unstructured<'_>, + module: &Module, + allowed_instructions: InstructionKinds, + builder: &mut CodeBuilder, + ) -> Option< + fn(&mut Unstructured<'_>, &Module, &mut CodeBuilder, &mut Vec<Instruction>) -> Result<()> + > { + builder.allocs.options.clear(); + let mut cost = 0; + // Unroll the loop that checks whether each instruction is valid in + // the current context and, if it is valid, pushes it onto our + // options. Unrolling this loops lets us avoid dynamic calls through + // function pointers and, furthermore, each call site can be branch + // predicted and even inlined. This saved us about 30% of time in + // the `corpus` benchmark. + $( + let predicate: Option<fn(&Module, &mut CodeBuilder) -> bool> = $predicate; + if predicate.map_or(true, |f| f(module, builder)) + && allowed_instructions.contains($instruction_kind) { + builder.allocs.options.push(($generator_fn, cost)); + cost += 1000 $(- $cost)?; + } + )* + + // If there aren't actually any candidate instructions due to + // various filters in place then return `None` to indicate the + // situation. + if cost == 0 { + return None; + } + + let i = u.int_in_range(0..=cost).ok()?; + let idx = builder + .allocs + .options + .binary_search_by_key(&i,|p| p.1) + .unwrap_or_else(|i| i - 1); + Some(builder.allocs.options[idx].0) + } + }; + + ( @count; ) => { + 0 + }; + ( @count; $x:ident $( $xs:ident )* ) => { + 1 + instructions!( @count; $( $xs )* ) + }; +} + +// The static set of options of instruction to generate that could be valid at +// some given time. One entry per Wasm instruction. +// +// Each entry is made up of up to three parts: +// +// 1. A predicate for whether this is a valid choice, if any. `None` means that +// the choice is always applicable. +// +// 2. The function to generate the instruction, given that we've made this +// choice. +// +// 3. The `InstructionKind` the instruction belongs to; this allows filtering +// out instructions by category. +// +// 4. An optional number used to weight how often this instruction is chosen. +// Higher numbers are less likely to be chosen, and number specified must be +// less than 1000. +instructions! { + // Control instructions. + (Some(unreachable_valid), unreachable, Control, 990), + (None, nop, Control, 800), + (None, block, Control), + (None, r#loop, Control), + (Some(try_table_valid), try_table, Control), + (Some(if_valid), r#if, Control), + (Some(else_valid), r#else, Control), + (Some(end_valid), end, Control), + (Some(br_valid), br, Control), + (Some(br_if_valid), br_if, Control), + (Some(br_table_valid), br_table, Control), + (Some(return_valid), r#return, Control, 900), + (Some(call_valid), call, Control), + (Some(call_ref_valid), call_ref, Control), + (Some(call_indirect_valid), call_indirect, Control), + (Some(return_call_valid), return_call, Control), + (Some(return_call_ref_valid), return_call_ref, Control), + (Some(return_call_indirect_valid), return_call_indirect, Control), + (Some(throw_valid), throw, Control, 850), + (Some(throw_ref_valid), throw_ref, Control, 850), + (Some(br_on_null_valid), br_on_null, Control), + (Some(br_on_non_null_valid), br_on_non_null, Control), + (Some(br_on_cast_valid), br_on_cast, Control), + (Some(br_on_cast_fail_valid), br_on_cast_fail, Control), + // Parametric instructions. + (Some(drop_valid), drop, Parametric, 990), + (Some(select_valid), select, Parametric), + // Variable instructions. + (Some(local_get_valid), local_get, Variable), + (Some(local_set_valid), local_set, Variable), + (Some(local_set_valid), local_tee, Variable), + (Some(global_get_valid), global_get, Variable), + (Some(global_set_valid), global_set, Variable), + // Memory instructions. + (Some(have_memory_and_offset), i32_load, Memory), + (Some(have_memory_and_offset), i64_load, Memory), + (Some(have_memory_and_offset), f32_load, Memory), + (Some(have_memory_and_offset), f64_load, Memory), + (Some(have_memory_and_offset), i32_load_8_s, Memory), + (Some(have_memory_and_offset), i32_load_8_u, Memory), + (Some(have_memory_and_offset), i32_load_16_s, Memory), + (Some(have_memory_and_offset), i32_load_16_u, Memory), + (Some(have_memory_and_offset), i64_load_8_s, Memory), + (Some(have_memory_and_offset), i64_load_16_s, Memory), + (Some(have_memory_and_offset), i64_load_32_s, Memory), + (Some(have_memory_and_offset), i64_load_8_u, Memory), + (Some(have_memory_and_offset), i64_load_16_u, Memory), + (Some(have_memory_and_offset), i64_load_32_u, Memory), + (Some(i32_store_valid), i32_store, Memory), + (Some(i64_store_valid), i64_store, Memory), + (Some(f32_store_valid), f32_store, Memory), + (Some(f64_store_valid), f64_store, Memory), + (Some(i32_store_valid), i32_store_8, Memory), + (Some(i32_store_valid), i32_store_16, Memory), + (Some(i64_store_valid), i64_store_8, Memory), + (Some(i64_store_valid), i64_store_16, Memory), + (Some(i64_store_valid), i64_store_32, Memory), + (Some(have_memory), memory_size, Memory), + (Some(memory_grow_valid), memory_grow, Memory), + (Some(memory_init_valid), memory_init, Memory), + (Some(data_drop_valid), data_drop, Memory), + (Some(memory_copy_valid), memory_copy, Memory), + (Some(memory_fill_valid), memory_fill, Memory), + // Numeric instructions. + (None, i32_const, Numeric), + (None, i64_const, Numeric), + (None, f32_const, Numeric), + (None, f64_const, Numeric), + (Some(i32_on_stack), i32_eqz, Numeric), + (Some(i32_i32_on_stack), i32_eq, Numeric), + (Some(i32_i32_on_stack), i32_ne, Numeric), + (Some(i32_i32_on_stack), i32_lt_s, Numeric), + (Some(i32_i32_on_stack), i32_lt_u, Numeric), + (Some(i32_i32_on_stack), i32_gt_s, Numeric), + (Some(i32_i32_on_stack), i32_gt_u, Numeric), + (Some(i32_i32_on_stack), i32_le_s, Numeric), + (Some(i32_i32_on_stack), i32_le_u, Numeric), + (Some(i32_i32_on_stack), i32_ge_s, Numeric), + (Some(i32_i32_on_stack), i32_ge_u, Numeric), + (Some(i64_on_stack), i64_eqz, Numeric), + (Some(i64_i64_on_stack), i64_eq, Numeric), + (Some(i64_i64_on_stack), i64_ne, Numeric), + (Some(i64_i64_on_stack), i64_lt_s, Numeric), + (Some(i64_i64_on_stack), i64_lt_u, Numeric), + (Some(i64_i64_on_stack), i64_gt_s, Numeric), + (Some(i64_i64_on_stack), i64_gt_u, Numeric), + (Some(i64_i64_on_stack), i64_le_s, Numeric), + (Some(i64_i64_on_stack), i64_le_u, Numeric), + (Some(i64_i64_on_stack), i64_ge_s, Numeric), + (Some(i64_i64_on_stack), i64_ge_u, Numeric), + (Some(f32_f32_on_stack), f32_eq, Numeric), + (Some(f32_f32_on_stack), f32_ne, Numeric), + (Some(f32_f32_on_stack), f32_lt, Numeric), + (Some(f32_f32_on_stack), f32_gt, Numeric), + (Some(f32_f32_on_stack), f32_le, Numeric), + (Some(f32_f32_on_stack), f32_ge, Numeric), + (Some(f64_f64_on_stack), f64_eq, Numeric), + (Some(f64_f64_on_stack), f64_ne, Numeric), + (Some(f64_f64_on_stack), f64_lt, Numeric), + (Some(f64_f64_on_stack), f64_gt, Numeric), + (Some(f64_f64_on_stack), f64_le, Numeric), + (Some(f64_f64_on_stack), f64_ge, Numeric), + (Some(i32_on_stack), i32_clz, Numeric), + (Some(i32_on_stack), i32_ctz, Numeric), + (Some(i32_on_stack), i32_popcnt, Numeric), + (Some(i32_i32_on_stack), i32_add, Numeric), + (Some(i32_i32_on_stack), i32_sub, Numeric), + (Some(i32_i32_on_stack), i32_mul, Numeric), + (Some(i32_i32_on_stack), i32_div_s, Numeric), + (Some(i32_i32_on_stack), i32_div_u, Numeric), + (Some(i32_i32_on_stack), i32_rem_s, Numeric), + (Some(i32_i32_on_stack), i32_rem_u, Numeric), + (Some(i32_i32_on_stack), i32_and, Numeric), + (Some(i32_i32_on_stack), i32_or, Numeric), + (Some(i32_i32_on_stack), i32_xor, Numeric), + (Some(i32_i32_on_stack), i32_shl, Numeric), + (Some(i32_i32_on_stack), i32_shr_s, Numeric), + (Some(i32_i32_on_stack), i32_shr_u, Numeric), + (Some(i32_i32_on_stack), i32_rotl, Numeric), + (Some(i32_i32_on_stack), i32_rotr, Numeric), + (Some(i64_on_stack), i64_clz, Numeric), + (Some(i64_on_stack), i64_ctz, Numeric), + (Some(i64_on_stack), i64_popcnt, Numeric), + (Some(i64_i64_on_stack), i64_add, Numeric), + (Some(i64_i64_on_stack), i64_sub, Numeric), + (Some(i64_i64_on_stack), i64_mul, Numeric), + (Some(i64_i64_on_stack), i64_div_s, Numeric), + (Some(i64_i64_on_stack), i64_div_u, Numeric), + (Some(i64_i64_on_stack), i64_rem_s, Numeric), + (Some(i64_i64_on_stack), i64_rem_u, Numeric), + (Some(i64_i64_on_stack), i64_and, Numeric), + (Some(i64_i64_on_stack), i64_or, Numeric), + (Some(i64_i64_on_stack), i64_xor, Numeric), + (Some(i64_i64_on_stack), i64_shl, Numeric), + (Some(i64_i64_on_stack), i64_shr_s, Numeric), + (Some(i64_i64_on_stack), i64_shr_u, Numeric), + (Some(i64_i64_on_stack), i64_rotl, Numeric), + (Some(i64_i64_on_stack), i64_rotr, Numeric), + (Some(f32_on_stack), f32_abs, Numeric), + (Some(f32_on_stack), f32_neg, Numeric), + (Some(f32_on_stack), f32_ceil, Numeric), + (Some(f32_on_stack), f32_floor, Numeric), + (Some(f32_on_stack), f32_trunc, Numeric), + (Some(f32_on_stack), f32_nearest, Numeric), + (Some(f32_on_stack), f32_sqrt, Numeric), + (Some(f32_f32_on_stack), f32_add, Numeric), + (Some(f32_f32_on_stack), f32_sub, Numeric), + (Some(f32_f32_on_stack), f32_mul, Numeric), + (Some(f32_f32_on_stack), f32_div, Numeric), + (Some(f32_f32_on_stack), f32_min, Numeric), + (Some(f32_f32_on_stack), f32_max, Numeric), + (Some(f32_f32_on_stack), f32_copysign, Numeric), + (Some(f64_on_stack), f64_abs, Numeric), + (Some(f64_on_stack), f64_neg, Numeric), + (Some(f64_on_stack), f64_ceil, Numeric), + (Some(f64_on_stack), f64_floor, Numeric), + (Some(f64_on_stack), f64_trunc, Numeric), + (Some(f64_on_stack), f64_nearest, Numeric), + (Some(f64_on_stack), f64_sqrt, Numeric), + (Some(f64_f64_on_stack), f64_add, Numeric), + (Some(f64_f64_on_stack), f64_sub, Numeric), + (Some(f64_f64_on_stack), f64_mul, Numeric), + (Some(f64_f64_on_stack), f64_div, Numeric), + (Some(f64_f64_on_stack), f64_min, Numeric), + (Some(f64_f64_on_stack), f64_max, Numeric), + (Some(f64_f64_on_stack), f64_copysign, Numeric), + (Some(i64_on_stack), i32_wrap_i64, Numeric), + (Some(f32_on_stack), i32_trunc_f32_s, Numeric), + (Some(f32_on_stack), i32_trunc_f32_u, Numeric), + (Some(f64_on_stack), i32_trunc_f64_s, Numeric), + (Some(f64_on_stack), i32_trunc_f64_u, Numeric), + (Some(i32_on_stack), i64_extend_i32_s, Numeric), + (Some(i32_on_stack), i64_extend_i32_u, Numeric), + (Some(f32_on_stack), i64_trunc_f32_s, Numeric), + (Some(f32_on_stack), i64_trunc_f32_u, Numeric), + (Some(f64_on_stack), i64_trunc_f64_s, Numeric), + (Some(f64_on_stack), i64_trunc_f64_u, Numeric), + (Some(i32_on_stack), f32_convert_i32_s, Numeric), + (Some(i32_on_stack), f32_convert_i32_u, Numeric), + (Some(i64_on_stack), f32_convert_i64_s, Numeric), + (Some(i64_on_stack), f32_convert_i64_u, Numeric), + (Some(f64_on_stack), f32_demote_f64, Numeric), + (Some(i32_on_stack), f64_convert_i32_s, Numeric), + (Some(i32_on_stack), f64_convert_i32_u, Numeric), + (Some(i64_on_stack), f64_convert_i64_s, Numeric), + (Some(i64_on_stack), f64_convert_i64_u, Numeric), + (Some(f32_on_stack), f64_promote_f32, Numeric), + (Some(f32_on_stack), i32_reinterpret_f32, Numeric), + (Some(f64_on_stack), i64_reinterpret_f64, Numeric), + (Some(i32_on_stack), f32_reinterpret_i32, Numeric), + (Some(i64_on_stack), f64_reinterpret_i64, Numeric), + (Some(extendable_i32_on_stack), i32_extend_8_s, Numeric), + (Some(extendable_i32_on_stack), i32_extend_16_s, Numeric), + (Some(extendable_i64_on_stack), i64_extend_8_s, Numeric), + (Some(extendable_i64_on_stack), i64_extend_16_s, Numeric), + (Some(extendable_i64_on_stack), i64_extend_32_s, Numeric), + (Some(nontrapping_f32_on_stack), i32_trunc_sat_f32_s, Numeric), + (Some(nontrapping_f32_on_stack), i32_trunc_sat_f32_u, Numeric), + (Some(nontrapping_f64_on_stack), i32_trunc_sat_f64_s, Numeric), + (Some(nontrapping_f64_on_stack), i32_trunc_sat_f64_u, Numeric), + (Some(nontrapping_f32_on_stack), i64_trunc_sat_f32_s, Numeric), + (Some(nontrapping_f32_on_stack), i64_trunc_sat_f32_u, Numeric), + (Some(nontrapping_f64_on_stack), i64_trunc_sat_f64_s, Numeric), + (Some(nontrapping_f64_on_stack), i64_trunc_sat_f64_u, Numeric), + // Reference instructions. + (Some(ref_null_valid), ref_null, Reference), + (Some(ref_func_valid), ref_func, Reference), + (Some(ref_as_non_null_valid), ref_as_non_null, Reference), + (Some(ref_eq_valid), ref_eq, Reference), + (Some(ref_test_valid), ref_test, Reference), + (Some(ref_cast_valid), ref_cast, Reference), + (Some(ref_is_null_valid), ref_is_null, Reference), + (Some(table_fill_valid), table_fill, Reference), + (Some(table_set_valid), table_set, Reference), + (Some(table_get_valid), table_get, Reference), + (Some(table_size_valid), table_size, Reference), + (Some(table_grow_valid), table_grow, Reference), + (Some(table_copy_valid), table_copy, Reference), + (Some(table_init_valid), table_init, Reference), + (Some(elem_drop_valid), elem_drop, Reference), + // Aggregate instructions. + (Some(struct_new_valid), struct_new, Aggregate), + (Some(struct_new_default_valid), struct_new_default, Aggregate), + (Some(struct_get_valid), struct_get, Aggregate), + (Some(struct_set_valid), struct_set, Aggregate), + (Some(array_new_valid), array_new, Aggregate), + (Some(array_new_fixed_valid), array_new_fixed, Aggregate), + (Some(array_new_default_valid), array_new_default, Aggregate), + (Some(array_new_data_valid), array_new_data, Aggregate), + (Some(array_new_elem_valid), array_new_elem, Aggregate), + (Some(array_get_valid), array_get, Aggregate), + (Some(array_set_valid), array_set, Aggregate), + (Some(array_len_valid), array_len, Aggregate), + (Some(array_fill_valid), array_fill, Aggregate), + (Some(array_copy_valid), array_copy, Aggregate), + (Some(array_init_data_valid), array_init_data, Aggregate), + (Some(array_init_elem_valid), array_init_elem, Aggregate), + (Some(ref_i31_valid), ref_i31, Aggregate), + (Some(i31_get_valid), i31_get, Aggregate), + (Some(any_convert_extern_valid), any_convert_extern, Aggregate), + (Some(extern_convert_any_valid), extern_convert_any, Aggregate), + // SIMD instructions. + (Some(simd_have_memory_and_offset), v128_load, Vector), + (Some(simd_have_memory_and_offset), v128_load8x8s, Vector), + (Some(simd_have_memory_and_offset), v128_load8x8u, Vector), + (Some(simd_have_memory_and_offset), v128_load16x4s, Vector), + (Some(simd_have_memory_and_offset), v128_load16x4u, Vector), + (Some(simd_have_memory_and_offset), v128_load32x2s, Vector), + (Some(simd_have_memory_and_offset), v128_load32x2u, Vector), + (Some(simd_have_memory_and_offset), v128_load8_splat, Vector), + (Some(simd_have_memory_and_offset), v128_load16_splat, Vector), + (Some(simd_have_memory_and_offset), v128_load32_splat, Vector), + (Some(simd_have_memory_and_offset), v128_load64_splat, Vector), + (Some(simd_have_memory_and_offset), v128_load32_zero, Vector), + (Some(simd_have_memory_and_offset), v128_load64_zero, Vector), + (Some(simd_v128_store_valid), v128_store, Vector), + (Some(simd_load_lane_valid), v128_load8_lane, Vector), + (Some(simd_load_lane_valid), v128_load16_lane, Vector), + (Some(simd_load_lane_valid), v128_load32_lane, Vector), + (Some(simd_load_lane_valid), v128_load64_lane, Vector), + (Some(simd_store_lane_valid), v128_store8_lane, Vector), + (Some(simd_store_lane_valid), v128_store16_lane, Vector), + (Some(simd_store_lane_valid), v128_store32_lane, Vector), + (Some(simd_store_lane_valid), v128_store64_lane, Vector), + (Some(simd_enabled), v128_const, Vector), + (Some(simd_v128_v128_on_stack), i8x16_shuffle, Vector), + (Some(simd_v128_on_stack), i8x16_extract_lane_s, Vector), + (Some(simd_v128_on_stack), i8x16_extract_lane_u, Vector), + (Some(simd_v128_i32_on_stack), i8x16_replace_lane, Vector), + (Some(simd_v128_on_stack), i16x8_extract_lane_s, Vector), + (Some(simd_v128_on_stack), i16x8_extract_lane_u, Vector), + (Some(simd_v128_i32_on_stack), i16x8_replace_lane, Vector), + (Some(simd_v128_on_stack), i32x4_extract_lane, Vector), + (Some(simd_v128_i32_on_stack), i32x4_replace_lane, Vector), + (Some(simd_v128_on_stack), i64x2_extract_lane, Vector), + (Some(simd_v128_i64_on_stack), i64x2_replace_lane, Vector), + (Some(simd_v128_on_stack), f32x4_extract_lane, Vector), + (Some(simd_v128_f32_on_stack), f32x4_replace_lane, Vector), + (Some(simd_v128_on_stack), f64x2_extract_lane, Vector), + (Some(simd_v128_f64_on_stack), f64x2_replace_lane, Vector), + (Some(simd_i32_on_stack), i8x16_splat, Vector), + (Some(simd_i32_on_stack), i16x8_splat, Vector), + (Some(simd_i32_on_stack), i32x4_splat, Vector), + (Some(simd_i64_on_stack), i64x2_splat, Vector), + (Some(simd_f32_on_stack), f32x4_splat, Vector), + (Some(simd_f64_on_stack), f64x2_splat, Vector), + (Some(simd_v128_v128_on_stack), i8x16_swizzle, Vector), + (Some(simd_v128_v128_on_stack_relaxed), i8x16_relaxed_swizzle, Vector), + (Some(simd_v128_v128_v128_on_stack), v128_bitselect, Vector), + (Some(simd_v128_v128_v128_on_stack_relaxed), i8x16_relaxed_laneselect, Vector), + (Some(simd_v128_v128_v128_on_stack_relaxed), i16x8_relaxed_laneselect, Vector), + (Some(simd_v128_v128_v128_on_stack_relaxed), i32x4_relaxed_laneselect, Vector), + (Some(simd_v128_v128_v128_on_stack_relaxed), i64x2_relaxed_laneselect, Vector), + (Some(simd_v128_v128_on_stack), i8x16_eq, Vector), + (Some(simd_v128_v128_on_stack), i8x16_ne, Vector), + (Some(simd_v128_v128_on_stack), i8x16_lt_s, Vector), + (Some(simd_v128_v128_on_stack), i8x16_lt_u, Vector), + (Some(simd_v128_v128_on_stack), i8x16_gt_s, Vector), + (Some(simd_v128_v128_on_stack), i8x16_gt_u, Vector), + (Some(simd_v128_v128_on_stack), i8x16_le_s, Vector), + (Some(simd_v128_v128_on_stack), i8x16_le_u, Vector), + (Some(simd_v128_v128_on_stack), i8x16_ge_s, Vector), + (Some(simd_v128_v128_on_stack), i8x16_ge_u, Vector), + (Some(simd_v128_v128_on_stack), i16x8_eq, Vector), + (Some(simd_v128_v128_on_stack), i16x8_ne, Vector), + (Some(simd_v128_v128_on_stack), i16x8_lt_s, Vector), + (Some(simd_v128_v128_on_stack), i16x8_lt_u, Vector), + (Some(simd_v128_v128_on_stack), i16x8_gt_s, Vector), + (Some(simd_v128_v128_on_stack), i16x8_gt_u, Vector), + (Some(simd_v128_v128_on_stack), i16x8_le_s, Vector), + (Some(simd_v128_v128_on_stack), i16x8_le_u, Vector), + (Some(simd_v128_v128_on_stack), i16x8_ge_s, Vector), + (Some(simd_v128_v128_on_stack), i16x8_ge_u, Vector), + (Some(simd_v128_v128_on_stack), i32x4_eq, Vector), + (Some(simd_v128_v128_on_stack), i32x4_ne, Vector), + (Some(simd_v128_v128_on_stack), i32x4_lt_s, Vector), + (Some(simd_v128_v128_on_stack), i32x4_lt_u, Vector), + (Some(simd_v128_v128_on_stack), i32x4_gt_s, Vector), + (Some(simd_v128_v128_on_stack), i32x4_gt_u, Vector), + (Some(simd_v128_v128_on_stack), i32x4_le_s, Vector), + (Some(simd_v128_v128_on_stack), i32x4_le_u, Vector), + (Some(simd_v128_v128_on_stack), i32x4_ge_s, Vector), + (Some(simd_v128_v128_on_stack), i32x4_ge_u, Vector), + (Some(simd_v128_v128_on_stack), i64x2_eq, Vector), + (Some(simd_v128_v128_on_stack), i64x2_ne, Vector), + (Some(simd_v128_v128_on_stack), i64x2_lt_s, Vector), + (Some(simd_v128_v128_on_stack), i64x2_gt_s, Vector), + (Some(simd_v128_v128_on_stack), i64x2_le_s, Vector), + (Some(simd_v128_v128_on_stack), i64x2_ge_s, Vector), + (Some(simd_v128_v128_on_stack), f32x4_eq, Vector), + (Some(simd_v128_v128_on_stack), f32x4_ne, Vector), + (Some(simd_v128_v128_on_stack), f32x4_lt, Vector), + (Some(simd_v128_v128_on_stack), f32x4_gt, Vector), + (Some(simd_v128_v128_on_stack), f32x4_le, Vector), + (Some(simd_v128_v128_on_stack), f32x4_ge, Vector), + (Some(simd_v128_v128_on_stack), f64x2_eq, Vector), + (Some(simd_v128_v128_on_stack), f64x2_ne, Vector), + (Some(simd_v128_v128_on_stack), f64x2_lt, Vector), + (Some(simd_v128_v128_on_stack), f64x2_gt, Vector), + (Some(simd_v128_v128_on_stack), f64x2_le, Vector), + (Some(simd_v128_v128_on_stack), f64x2_ge, Vector), + (Some(simd_v128_on_stack), v128_not, Vector), + (Some(simd_v128_v128_on_stack), v128_and, Vector), + (Some(simd_v128_v128_on_stack), v128_and_not, Vector), + (Some(simd_v128_v128_on_stack), v128_or, Vector), + (Some(simd_v128_v128_on_stack), v128_xor, Vector), + (Some(simd_v128_v128_on_stack), v128_any_true, Vector), + (Some(simd_v128_on_stack), i8x16_abs, Vector), + (Some(simd_v128_on_stack), i8x16_neg, Vector), + (Some(simd_v128_on_stack), i8x16_popcnt, Vector), + (Some(simd_v128_on_stack), i8x16_all_true, Vector), + (Some(simd_v128_on_stack), i8x16_bitmask, Vector), + (Some(simd_v128_v128_on_stack), i8x16_narrow_i16x8s, Vector), + (Some(simd_v128_v128_on_stack), i8x16_narrow_i16x8u, Vector), + (Some(simd_v128_i32_on_stack), i8x16_shl, Vector), + (Some(simd_v128_i32_on_stack), i8x16_shr_s, Vector), + (Some(simd_v128_i32_on_stack), i8x16_shr_u, Vector), + (Some(simd_v128_v128_on_stack), i8x16_add, Vector), + (Some(simd_v128_v128_on_stack), i8x16_add_sat_s, Vector), + (Some(simd_v128_v128_on_stack), i8x16_add_sat_u, Vector), + (Some(simd_v128_v128_on_stack), i8x16_sub, Vector), + (Some(simd_v128_v128_on_stack), i8x16_sub_sat_s, Vector), + (Some(simd_v128_v128_on_stack), i8x16_sub_sat_u, Vector), + (Some(simd_v128_v128_on_stack), i8x16_min_s, Vector), + (Some(simd_v128_v128_on_stack), i8x16_min_u, Vector), + (Some(simd_v128_v128_on_stack), i8x16_max_s, Vector), + (Some(simd_v128_v128_on_stack), i8x16_max_u, Vector), + (Some(simd_v128_v128_on_stack), i8x16_avgr_u, Vector), + (Some(simd_v128_on_stack), i16x8_extadd_pairwise_i8x16s, Vector), + (Some(simd_v128_on_stack), i16x8_extadd_pairwise_i8x16u, Vector), + (Some(simd_v128_on_stack), i16x8_abs, Vector), + (Some(simd_v128_on_stack), i16x8_neg, Vector), + (Some(simd_v128_v128_on_stack), i16x8q15_mulr_sat_s, Vector), + (Some(simd_v128_on_stack), i16x8_all_true, Vector), + (Some(simd_v128_on_stack), i16x8_bitmask, Vector), + (Some(simd_v128_v128_on_stack), i16x8_narrow_i32x4s, Vector), + (Some(simd_v128_v128_on_stack), i16x8_narrow_i32x4u, Vector), + (Some(simd_v128_on_stack), i16x8_extend_low_i8x16s, Vector), + (Some(simd_v128_on_stack), i16x8_extend_high_i8x16s, Vector), + (Some(simd_v128_on_stack), i16x8_extend_low_i8x16u, Vector), + (Some(simd_v128_on_stack), i16x8_extend_high_i8x16u, Vector), + (Some(simd_v128_i32_on_stack), i16x8_shl, Vector), + (Some(simd_v128_i32_on_stack), i16x8_shr_s, Vector), + (Some(simd_v128_i32_on_stack), i16x8_shr_u, Vector), + (Some(simd_v128_v128_on_stack), i16x8_add, Vector), + (Some(simd_v128_v128_on_stack), i16x8_add_sat_s, Vector), + (Some(simd_v128_v128_on_stack), i16x8_add_sat_u, Vector), + (Some(simd_v128_v128_on_stack), i16x8_sub, Vector), + (Some(simd_v128_v128_on_stack), i16x8_sub_sat_s, Vector), + (Some(simd_v128_v128_on_stack), i16x8_sub_sat_u, Vector), + (Some(simd_v128_v128_on_stack), i16x8_mul, Vector), + (Some(simd_v128_v128_on_stack), i16x8_min_s, Vector), + (Some(simd_v128_v128_on_stack), i16x8_min_u, Vector), + (Some(simd_v128_v128_on_stack), i16x8_max_s, Vector), + (Some(simd_v128_v128_on_stack), i16x8_max_u, Vector), + (Some(simd_v128_v128_on_stack), i16x8_avgr_u, Vector), + (Some(simd_v128_v128_on_stack), i16x8_extmul_low_i8x16s, Vector), + (Some(simd_v128_v128_on_stack), i16x8_extmul_high_i8x16s, Vector), + (Some(simd_v128_v128_on_stack), i16x8_extmul_low_i8x16u, Vector), + (Some(simd_v128_v128_on_stack), i16x8_extmul_high_i8x16u, Vector), + (Some(simd_v128_on_stack), i32x4_extadd_pairwise_i16x8s, Vector), + (Some(simd_v128_on_stack), i32x4_extadd_pairwise_i16x8u, Vector), + (Some(simd_v128_on_stack), i32x4_abs, Vector), + (Some(simd_v128_on_stack), i32x4_neg, Vector), + (Some(simd_v128_on_stack), i32x4_all_true, Vector), + (Some(simd_v128_on_stack), i32x4_bitmask, Vector), + (Some(simd_v128_on_stack), i32x4_extend_low_i16x8s, Vector), + (Some(simd_v128_on_stack), i32x4_extend_high_i16x8s, Vector), + (Some(simd_v128_on_stack), i32x4_extend_low_i16x8u, Vector), + (Some(simd_v128_on_stack), i32x4_extend_high_i16x8u, Vector), + (Some(simd_v128_i32_on_stack), i32x4_shl, Vector), + (Some(simd_v128_i32_on_stack), i32x4_shr_s, Vector), + (Some(simd_v128_i32_on_stack), i32x4_shr_u, Vector), + (Some(simd_v128_v128_on_stack), i32x4_add, Vector), + (Some(simd_v128_v128_on_stack), i32x4_sub, Vector), + (Some(simd_v128_v128_on_stack), i32x4_mul, Vector), + (Some(simd_v128_v128_on_stack), i32x4_min_s, Vector), + (Some(simd_v128_v128_on_stack), i32x4_min_u, Vector), + (Some(simd_v128_v128_on_stack), i32x4_max_s, Vector), + (Some(simd_v128_v128_on_stack), i32x4_max_u, Vector), + (Some(simd_v128_v128_on_stack), i32x4_dot_i16x8s, Vector), + (Some(simd_v128_v128_on_stack), i32x4_extmul_low_i16x8s, Vector), + (Some(simd_v128_v128_on_stack), i32x4_extmul_high_i16x8s, Vector), + (Some(simd_v128_v128_on_stack), i32x4_extmul_low_i16x8u, Vector), + (Some(simd_v128_v128_on_stack), i32x4_extmul_high_i16x8u, Vector), + (Some(simd_v128_on_stack), i64x2_abs, Vector), + (Some(simd_v128_on_stack), i64x2_neg, Vector), + (Some(simd_v128_on_stack), i64x2_all_true, Vector), + (Some(simd_v128_on_stack), i64x2_bitmask, Vector), + (Some(simd_v128_on_stack), i64x2_extend_low_i32x4s, Vector), + (Some(simd_v128_on_stack), i64x2_extend_high_i32x4s, Vector), + (Some(simd_v128_on_stack), i64x2_extend_low_i32x4u, Vector), + (Some(simd_v128_on_stack), i64x2_extend_high_i32x4u, Vector), + (Some(simd_v128_i32_on_stack), i64x2_shl, Vector), + (Some(simd_v128_i32_on_stack), i64x2_shr_s, Vector), + (Some(simd_v128_i32_on_stack), i64x2_shr_u, Vector), + (Some(simd_v128_v128_on_stack), i64x2_add, Vector), + (Some(simd_v128_v128_on_stack), i64x2_sub, Vector), + (Some(simd_v128_v128_on_stack), i64x2_mul, Vector), + (Some(simd_v128_v128_on_stack), i64x2_extmul_low_i32x4s, Vector), + (Some(simd_v128_v128_on_stack), i64x2_extmul_high_i32x4s, Vector), + (Some(simd_v128_v128_on_stack), i64x2_extmul_low_i32x4u, Vector), + (Some(simd_v128_v128_on_stack), i64x2_extmul_high_i32x4u, Vector), + (Some(simd_v128_on_stack), f32x4_ceil, Vector), + (Some(simd_v128_on_stack), f32x4_floor, Vector), + (Some(simd_v128_on_stack), f32x4_trunc, Vector), + (Some(simd_v128_on_stack), f32x4_nearest, Vector), + (Some(simd_v128_on_stack), f32x4_abs, Vector), + (Some(simd_v128_on_stack), f32x4_neg, Vector), + (Some(simd_v128_on_stack), f32x4_sqrt, Vector), + (Some(simd_v128_v128_on_stack), f32x4_add, Vector), + (Some(simd_v128_v128_on_stack), f32x4_sub, Vector), + (Some(simd_v128_v128_on_stack), f32x4_mul, Vector), + (Some(simd_v128_v128_on_stack), f32x4_div, Vector), + (Some(simd_v128_v128_on_stack), f32x4_min, Vector), + (Some(simd_v128_v128_on_stack), f32x4_max, Vector), + (Some(simd_v128_v128_on_stack), f32x4p_min, Vector), + (Some(simd_v128_v128_on_stack), f32x4p_max, Vector), + (Some(simd_v128_on_stack), f64x2_ceil, Vector), + (Some(simd_v128_on_stack), f64x2_floor, Vector), + (Some(simd_v128_on_stack), f64x2_trunc, Vector), + (Some(simd_v128_on_stack), f64x2_nearest, Vector), + (Some(simd_v128_on_stack), f64x2_abs, Vector), + (Some(simd_v128_on_stack), f64x2_neg, Vector), + (Some(simd_v128_on_stack), f64x2_sqrt, Vector), + (Some(simd_v128_v128_on_stack), f64x2_add, Vector), + (Some(simd_v128_v128_on_stack), f64x2_sub, Vector), + (Some(simd_v128_v128_on_stack), f64x2_mul, Vector), + (Some(simd_v128_v128_on_stack), f64x2_div, Vector), + (Some(simd_v128_v128_on_stack), f64x2_min, Vector), + (Some(simd_v128_v128_on_stack), f64x2_max, Vector), + (Some(simd_v128_v128_on_stack), f64x2p_min, Vector), + (Some(simd_v128_v128_on_stack), f64x2p_max, Vector), + (Some(simd_v128_on_stack), i32x4_trunc_sat_f32x4s, Vector), + (Some(simd_v128_on_stack), i32x4_trunc_sat_f32x4u, Vector), + (Some(simd_v128_on_stack), f32x4_convert_i32x4s, Vector), + (Some(simd_v128_on_stack), f32x4_convert_i32x4u, Vector), + (Some(simd_v128_on_stack), i32x4_trunc_sat_f64x2s_zero, Vector), + (Some(simd_v128_on_stack), i32x4_trunc_sat_f64x2u_zero, Vector), + (Some(simd_v128_on_stack), f64x2_convert_low_i32x4s, Vector), + (Some(simd_v128_on_stack), f64x2_convert_low_i32x4u, Vector), + (Some(simd_v128_on_stack), f32x4_demote_f64x2_zero, Vector), + (Some(simd_v128_on_stack), f64x2_promote_low_f32x4, Vector), + (Some(simd_v128_on_stack_relaxed), i32x4_relaxed_trunc_f32x4s, Vector), + (Some(simd_v128_on_stack_relaxed), i32x4_relaxed_trunc_f32x4u, Vector), + (Some(simd_v128_on_stack_relaxed), i32x4_relaxed_trunc_f64x2s_zero, Vector), + (Some(simd_v128_on_stack_relaxed), i32x4_relaxed_trunc_f64x2u_zero, Vector), + (Some(simd_v128_v128_v128_on_stack_relaxed), f32x4_relaxed_madd, Vector), + (Some(simd_v128_v128_v128_on_stack_relaxed), f32x4_relaxed_nmadd, Vector), + (Some(simd_v128_v128_v128_on_stack_relaxed), f64x2_relaxed_madd, Vector), + (Some(simd_v128_v128_v128_on_stack_relaxed), f64x2_relaxed_nmadd, Vector), + (Some(simd_v128_v128_on_stack_relaxed), f32x4_relaxed_min, Vector), + (Some(simd_v128_v128_on_stack_relaxed), f32x4_relaxed_max, Vector), + (Some(simd_v128_v128_on_stack_relaxed), f64x2_relaxed_min, Vector), + (Some(simd_v128_v128_on_stack_relaxed), f64x2_relaxed_max, Vector), + (Some(simd_v128_v128_on_stack_relaxed), i16x8_relaxed_q15mulr_s, Vector), + (Some(simd_v128_v128_on_stack_relaxed), i16x8_relaxed_dot_i8x16_i7x16_s, Vector), + (Some(simd_v128_v128_v128_on_stack_relaxed), i32x4_relaxed_dot_i8x16_i7x16_add_s, Vector), +} + +pub(crate) struct CodeBuilderAllocations { + // The control labels in scope right now. + controls: Vec<Control>, + + // The types on the operand stack right now. + operands: Vec<Option<ValType>>, + + // Dynamic set of options of instruction we can generate that are known to + // be valid right now. + options: Vec<( + fn(&mut Unstructured, &Module, &mut CodeBuilder, &mut Vec<Instruction>) -> Result<()>, + u32, + )>, + + // Cached information about the module that we're generating functions for, + // used to speed up validity checks. The mutable globals map is a map of the + // type of global to the global indices which have that type (and they're + // all mutable). + mutable_globals: BTreeMap<ValType, Vec<u32>>, + + // Like mutable globals above this is a map from function types to the list + // of functions that have that function type. + functions: BTreeMap<Rc<FuncType>, Vec<u32>>, + + // Like functions above this is a map from tag types to the list of tags + // have that tag type. + tags: BTreeMap<Vec<ValType>, Vec<u32>>, + + // Tables in this module which have a funcref element type. + funcref_tables: Vec<u32>, + + // Functions that are referenced in the module through globals and segments. + referenced_functions: Vec<u32>, + + // Flag that indicates if any element segments have the same type as any + // table + table_init_possible: bool, + + // Lists of memory indices which are either 32-bit or 64-bit. This is used + // for faster lookup in validating instructions to know which memories have + // which types. For example if there are no 64-bit memories then we + // shouldn't ever look for i64 on the stack for `i32.load`. + memory32: Vec<u32>, + memory64: Vec<u32>, + + // State used when dropping operands to avoid dropping them into the ether + // but instead folding their final values into module state, at this time + // chosen to be exported globals. + globals_cnt: u32, + new_globals: Vec<(ValType, ConstExpr)>, + global_dropped_i32: Option<u32>, + global_dropped_i64: Option<u32>, + global_dropped_f32: Option<u32>, + global_dropped_f64: Option<u32>, + global_dropped_v128: Option<u32>, +} + +pub(crate) struct CodeBuilder<'a> { + func_ty: &'a FuncType, + locals: &'a mut Vec<ValType>, + allocs: &'a mut CodeBuilderAllocations, + + // Temporary locals injected and used by nan canonicalization. Note that + // this list of extra locals is appended to `self.locals` at the end of code + // generation, and it's kept separate here to avoid using these locals in + // `local.get` and similar instructions. + extra_locals: Vec<ValType>, + f32_scratch: Option<usize>, + f64_scratch: Option<usize>, + v128_scratch: Option<usize>, +} + +/// A control frame. +#[derive(Debug, Clone)] +struct Control { + kind: ControlKind, + /// Value types that must be on the stack when entering this control frame. + params: Vec<ValType>, + /// Value types that are left on the stack when exiting this control frame. + results: Vec<ValType>, + /// How far down the operand stack instructions inside this control frame + /// can reach. + height: usize, +} + +impl Control { + fn label_types(&self) -> &[ValType] { + if self.kind == ControlKind::Loop { + &self.params + } else { + &self.results + } + } +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq)] +enum ControlKind { + Block, + If, + Loop, + TryTable, +} + +enum Float { + F32, + F64, + F32x4, + F64x2, +} + +impl CodeBuilderAllocations { + pub(crate) fn new(module: &Module) -> Self { + let mut mutable_globals = BTreeMap::new(); + for (i, global) in module.globals.iter().enumerate() { + if global.mutable { + mutable_globals + .entry(global.val_type) + .or_insert(Vec::new()) + .push(i as u32); + } + } + + let mut tags = BTreeMap::new(); + for (idx, tag_type) in module.tags() { + tags.entry(tag_type.func_type.params.to_vec()) + .or_insert(Vec::new()) + .push(idx); + } + + let mut functions = BTreeMap::new(); + for (idx, func) in module.funcs() { + functions + .entry(func.clone()) + .or_insert(Vec::new()) + .push(idx); + } + + let mut funcref_tables = Vec::new(); + let mut table_tys = Vec::new(); + for (i, table) in module.tables.iter().enumerate() { + table_tys.push(table.element_type); + if table.element_type == RefType::FUNCREF { + funcref_tables.push(i as u32); + } + } + + let mut referenced_functions = BTreeSet::new(); + for (_, expr) in module.defined_globals.iter() { + if let GlobalInitExpr::FuncRef(i) = *expr { + referenced_functions.insert(i); + } + } + for g in module.elems.iter() { + match &g.items { + Elements::Expressions(e) => { + let iter = e.iter().filter_map(|i| *i); + referenced_functions.extend(iter); + } + Elements::Functions(e) => { + referenced_functions.extend(e.iter().cloned()); + } + } + } + + let table_init_possible = module.elems.iter().any(|e| table_tys.contains(&e.ty)); + + let mut memory32 = Vec::new(); + let mut memory64 = Vec::new(); + for (i, mem) in module.memories.iter().enumerate() { + if mem.memory64 { + memory64.push(i as u32); + } else { + memory32.push(i as u32); + } + } + + CodeBuilderAllocations { + controls: Vec::with_capacity(4), + operands: Vec::with_capacity(16), + options: Vec::with_capacity(NUM_OPTIONS), + functions, + tags, + mutable_globals, + funcref_tables, + referenced_functions: referenced_functions.into_iter().collect(), + table_init_possible, + memory32, + memory64, + + global_dropped_i32: None, + global_dropped_i64: None, + global_dropped_f32: None, + global_dropped_f64: None, + global_dropped_v128: None, + globals_cnt: module.globals.len() as u32, + new_globals: Vec::new(), + } + } + + pub(crate) fn builder<'a>( + &'a mut self, + func_ty: &'a FuncType, + locals: &'a mut Vec<ValType>, + ) -> CodeBuilder<'a> { + self.controls.clear(); + self.controls.push(Control { + kind: ControlKind::Block, + params: vec![], + results: func_ty.results.to_vec(), + height: 0, + }); + + self.operands.clear(); + self.options.clear(); + + CodeBuilder { + func_ty, + locals, + allocs: self, + extra_locals: Vec::new(), + f32_scratch: None, + f64_scratch: None, + v128_scratch: None, + } + } + + pub fn finish(self, u: &mut Unstructured<'_>, module: &mut Module) -> arbitrary::Result<()> { + // Any globals injected as part of dropping operands on the stack get + // injected into the module here. Each global is then exported, most of + // the time, to ensure it's part of the "image" of this module available + // for differential execution for example. + for (ty, init) in self.new_globals { + let global_idx = module.globals.len() as u32; + module.globals.push(GlobalType { + val_type: ty, + mutable: true, + }); + let init = GlobalInitExpr::ConstExpr(init); + module.defined_globals.push((global_idx, init)); + + if u.ratio(1, 100).unwrap_or(false) { + continue; + } + + let name = unique_string(1_000, &mut module.export_names, u)?; + module.add_arbitrary_export(name, ExportKind::Global, global_idx)?; + } + Ok(()) + } +} + +impl CodeBuilder<'_> { + fn pop_control(&mut self) -> Control { + let control = self.allocs.controls.pop().unwrap(); + + // Pop the actual types on the stack (which could be subtypes of the + // declared types) and then push the declared types. This avoids us + // accidentally generating code that relies on erased subtypes. + for _ in &control.results { + self.pop_operand(); + } + for ty in &control.results { + self.push_operand(Some(*ty)); + } + + control + } + + fn push_control( + &mut self, + kind: ControlKind, + params: impl Into<Vec<ValType>>, + results: impl Into<Vec<ValType>>, + ) { + let params = params.into(); + let results = results.into(); + + // Similar to in `pop_control`, we want to pop the actual argument types + // off the stack (which could be subtypes of the declared parameter + // types) and then push the parameter types. This effectively does type + // erasure of any subtyping that exists so that we don't accidentally + // generate code that relies on the specific subtypes. + for _ in ¶ms { + self.pop_operand(); + } + self.push_operands(¶ms); + + let height = self.allocs.operands.len() - params.len(); + self.allocs.controls.push(Control { + kind, + params, + results, + height, + }); + } + + /// Get the operands that are in-scope within the current control frame. + #[inline] + fn operands(&self) -> &[Option<ValType>] { + let height = self.allocs.controls.last().map_or(0, |c| c.height); + &self.allocs.operands[height..] + } + + /// Pop a single operand from the stack, regardless of expected type. + #[inline] + fn pop_operand(&mut self) -> Option<ValType> { + self.allocs.operands.pop().unwrap() + } + + #[inline] + fn pop_operands(&mut self, module: &Module, to_pop: &[ValType]) { + debug_assert!(self.types_on_stack(module, to_pop)); + self.allocs + .operands + .truncate(self.allocs.operands.len() - to_pop.len()); + } + + #[inline] + fn push_operands(&mut self, to_push: &[ValType]) { + self.allocs + .operands + .extend(to_push.iter().copied().map(Some)); + } + + #[inline] + fn push_operand(&mut self, ty: Option<ValType>) { + self.allocs.operands.push(ty); + } + + fn label_types_on_stack(&self, module: &Module, to_check: &Control) -> bool { + self.types_on_stack(module, to_check.label_types()) + } + + /// Is the given type on top of the stack? + #[inline] + fn type_on_stack(&self, module: &Module, ty: ValType) -> bool { + self.type_on_stack_at(module, 0, ty) + } + + /// Is the given type on the stack at the given index (indexing from the top + /// of the stack towards the bottom). + #[inline] + fn type_on_stack_at(&self, module: &Module, at: usize, expected: ValType) -> bool { + let operands = self.operands(); + if at >= operands.len() { + return false; + } + match operands[operands.len() - 1 - at] { + None => true, + Some(actual) => module.val_type_is_sub_type(actual, expected), + } + } + + /// Are the given types on top of the stack? + #[inline] + fn types_on_stack(&self, module: &Module, types: &[ValType]) -> bool { + self.operands().len() >= types.len() + && types + .iter() + .rev() + .enumerate() + .all(|(idx, ty)| self.type_on_stack_at(module, idx, *ty)) + } + + /// Are the given field types on top of the stack? + #[inline] + fn field_types_on_stack(&self, module: &Module, types: &[FieldType]) -> bool { + self.operands().len() >= types.len() + && types + .iter() + .rev() + .enumerate() + .all(|(idx, ty)| self.type_on_stack_at(module, idx, ty.element_type.unpack())) + } + + /// Is the given field type on top of the stack? + #[inline] + fn field_type_on_stack(&self, module: &Module, ty: FieldType) -> bool { + self.type_on_stack(module, ty.element_type.unpack()) + } + + /// Is the given field type on the stack at the given position (indexed from + /// the top of the stack)? + #[inline] + fn field_type_on_stack_at(&self, module: &Module, at: usize, ty: FieldType) -> bool { + self.type_on_stack_at(module, at, ty.element_type.unpack()) + } + + /// Get the ref type on the top of the operand stack, if any. + /// + /// * `None` means no reftype on the stack. + /// * `Some(None)` means that the stack is polymorphic. + /// * `Some(Some(r))` means that `r` is the ref type on top of the stack. + fn ref_type_on_stack(&self) -> Option<Option<RefType>> { + match self.operands().last().copied()? { + Some(ValType::Ref(r)) => Some(Some(r)), + Some(_) => None, + None => Some(None), + } + } + + /// Is there a `(ref null? <index>)` on the stack at the given position? If + /// so return its nullability and type index. + fn concrete_ref_type_on_stack_at(&self, at: usize) -> Option<(bool, u32)> { + match self.operands().iter().copied().rev().nth(at)?? { + ValType::Ref(RefType { + nullable, + heap_type: HeapType::Concrete(ty), + }) => Some((nullable, ty)), + _ => None, + } + } + + /// Is there a `(ref null? <index>)` at the given stack position that + /// references a concrete array type? + fn concrete_array_ref_type_on_stack_at( + &self, + module: &Module, + at: usize, + ) -> Option<(bool, u32, ArrayType)> { + let (nullable, ty) = self.concrete_ref_type_on_stack_at(at)?; + match &module.ty(ty).composite_type { + CompositeType::Array(a) => Some((nullable, ty, *a)), + _ => None, + } + } + + /// Is there a `(ref null? <index>)` at the given stack position that + /// references a concrete struct type? + fn concrete_struct_ref_type_on_stack_at<'a>( + &self, + module: &'a Module, + at: usize, + ) -> Option<(bool, u32, &'a StructType)> { + let (nullable, ty) = self.concrete_ref_type_on_stack_at(at)?; + match &module.ty(ty).composite_type { + CompositeType::Struct(s) => Some((nullable, ty, s)), + _ => None, + } + } + + /// Pop a reference type from the stack and return it. + /// + /// When in unreachable code and the stack is polymorphic, returns `None`. + fn pop_ref_type(&mut self) -> Option<RefType> { + let ref_ty = self.ref_type_on_stack().unwrap(); + self.pop_operand(); + ref_ty + } + + /// Pops a `(ref null? <index>)` from the stack and return its nullability + /// and type index. + fn pop_concrete_ref_type(&mut self) -> (bool, u32) { + let ref_ty = self.pop_ref_type().unwrap(); + match ref_ty.heap_type { + HeapType::Concrete(i) => (ref_ty.nullable, i), + _ => panic!("not a concrete ref type"), + } + } + + /// Get the `(ref null? <index>)` type on the top of the stack that + /// references a function type, if any. + fn concrete_funcref_on_stack(&self, module: &Module) -> Option<RefType> { + match self.operands().last().copied()?? { + ValType::Ref(r) => match r.heap_type { + HeapType::Concrete(idx) => match &module.ty(idx).composite_type { + CompositeType::Func(_) => Some(r), + CompositeType::Struct(_) | CompositeType::Array(_) => None, + }, + _ => None, + }, + _ => None, + } + } + + /// Is there a `(ref null? <index>)` on the top of the stack that references + /// a struct type with at least one field? + fn non_empty_struct_ref_on_stack(&self, module: &Module, allow_null_refs: bool) -> bool { + match self.operands().last() { + Some(Some(ValType::Ref(RefType { + nullable, + heap_type: HeapType::Concrete(idx), + }))) => match &module.ty(*idx).composite_type { + CompositeType::Struct(s) => !s.fields.is_empty() && (!nullable || allow_null_refs), + _ => false, + }, + _ => false, + } + } + + #[inline(never)] + fn arbitrary_block_type(&self, u: &mut Unstructured, module: &Module) -> Result<BlockType> { + let mut options: Vec<Box<dyn Fn(&mut Unstructured) -> Result<BlockType>>> = vec![ + Box::new(|_| Ok(BlockType::Empty)), + Box::new(|u| { + Ok(BlockType::Result(module.arbitrary_valtype( + u, + u32::try_from(module.types.len()).unwrap(), + )?)) + }), + ]; + if module.config.multi_value_enabled { + for (i, ty) in module.func_types() { + if self.types_on_stack(module, &ty.params) { + options.push(Box::new(move |_| Ok(BlockType::FunctionType(i as u32)))); + } + } + } + let f = u.choose(&options)?; + f(u) + } + + pub(crate) fn arbitrary( + mut self, + u: &mut Unstructured, + module: &Module, + ) -> Result<Vec<Instruction>> { + let max_instructions = module.config.max_instructions; + let allowed_instructions = module.config.allowed_instructions; + let mut instructions = vec![]; + + while !self.allocs.controls.is_empty() { + let keep_going = instructions.len() < max_instructions && u.arbitrary::<u8>()? != 0; + if !keep_going { + self.end_active_control_frames( + u, + module, + &mut instructions, + module.config.disallow_traps, + )?; + break; + } + + match choose_instruction(u, module, allowed_instructions, &mut self) { + Some(f) => { + f(u, module, &mut self, &mut instructions)?; + } + // Choosing an instruction can fail because there is not enough + // underlying data, so we really cannot generate any more + // instructions. In this case we swallow that error and instead + // just terminate our wasm function's frames. + None => { + self.end_active_control_frames( + u, + module, + &mut instructions, + module.config.disallow_traps, + )?; + break; + } + } + + // If the configuration for this module requests nan + // canonicalization then perform that here based on whether or not + // the previous instruction needs canonicalization. Note that this + // is based off Cranelift's pass for nan canonicalization for which + // instructions to canonicalize, but the general idea is most + // floating-point operations. + if module.config.canonicalize_nans { + match instructions.last().unwrap() { + Instruction::F32Ceil + | Instruction::F32Floor + | Instruction::F32Nearest + | Instruction::F32Sqrt + | Instruction::F32Trunc + | Instruction::F32Div + | Instruction::F32Max + | Instruction::F32Min + | Instruction::F32Mul + | Instruction::F32Sub + | Instruction::F32Add => self.canonicalize_nan(Float::F32, &mut instructions), + Instruction::F64Ceil + | Instruction::F64Floor + | Instruction::F64Nearest + | Instruction::F64Sqrt + | Instruction::F64Trunc + | Instruction::F64Div + | Instruction::F64Max + | Instruction::F64Min + | Instruction::F64Mul + | Instruction::F64Sub + | Instruction::F64Add => self.canonicalize_nan(Float::F64, &mut instructions), + Instruction::F32x4Ceil + | Instruction::F32x4Floor + | Instruction::F32x4Nearest + | Instruction::F32x4Sqrt + | Instruction::F32x4Trunc + | Instruction::F32x4Div + | Instruction::F32x4Max + | Instruction::F32x4Min + | Instruction::F32x4Mul + | Instruction::F32x4Sub + | Instruction::F32x4Add => { + self.canonicalize_nan(Float::F32x4, &mut instructions) + } + Instruction::F64x2Ceil + | Instruction::F64x2Floor + | Instruction::F64x2Nearest + | Instruction::F64x2Sqrt + | Instruction::F64x2Trunc + | Instruction::F64x2Div + | Instruction::F64x2Max + | Instruction::F64x2Min + | Instruction::F64x2Mul + | Instruction::F64x2Sub + | Instruction::F64x2Add => { + self.canonicalize_nan(Float::F64x2, &mut instructions) + } + _ => {} + } + } + } + + self.locals.extend(self.extra_locals.drain(..)); + + Ok(instructions) + } + + fn canonicalize_nan(&mut self, ty: Float, ins: &mut Vec<Instruction>) { + // We'll need to temporarily save the top of the stack into a local, so + // figure out that local here. Note that this tries to use the same + // local if canonicalization happens more than once in a function. + let (local, val_ty) = match ty { + Float::F32 => (&mut self.f32_scratch, ValType::F32), + Float::F64 => (&mut self.f64_scratch, ValType::F64), + Float::F32x4 | Float::F64x2 => (&mut self.v128_scratch, ValType::V128), + }; + let local = match *local { + Some(i) => i as u32, + None => self.alloc_local(val_ty), + }; + + // Save the previous instruction's result into a local. This also leaves + // a value on the stack as `val1` for the `select` instruction. + ins.push(Instruction::LocalTee(local)); + + // The `val2` value input to the `select` below, our nan pattern. + // + // The nan patterns here are chosen to be a canonical representation + // which is still NaN but the wasm will always produce the same bits of + // a nan so if the wasm takes a look at the nan inside it'll always see + // the same representation. + const CANON_32BIT_NAN: u32 = 0b01111111110000000000000000000000; + const CANON_64BIT_NAN: u64 = + 0b0111111111111000000000000000000000000000000000000000000000000000; + ins.push(match ty { + Float::F32 => Instruction::F32Const(f32::from_bits(CANON_32BIT_NAN)), + Float::F64 => Instruction::F64Const(f64::from_bits(CANON_64BIT_NAN)), + Float::F32x4 => { + let nan = CANON_32BIT_NAN as i128; + let nan = nan | (nan << 32) | (nan << 64) | (nan << 96); + Instruction::V128Const(nan) + } + Float::F64x2 => { + let nan = CANON_64BIT_NAN as i128; + let nan = nan | (nan << 64); + Instruction::V128Const(nan) + } + }); + + // the condition of the `select`, which is the float's equality test + // with itself. + ins.push(Instruction::LocalGet(local)); + ins.push(Instruction::LocalGet(local)); + ins.push(match ty { + Float::F32 => Instruction::F32Eq, + Float::F64 => Instruction::F64Eq, + Float::F32x4 => Instruction::F32x4Eq, + Float::F64x2 => Instruction::F64x2Eq, + }); + + // Select the result. If the condition is nonzero (aka the float is + // equal to itself) it picks `val1`, otherwise if zero (aka the float + // is nan) it picks `val2`. + ins.push(match ty { + Float::F32 | Float::F64 => Instruction::Select, + Float::F32x4 | Float::F64x2 => Instruction::V128Bitselect, + }); + } + + fn alloc_local(&mut self, ty: ValType) -> u32 { + let val = self.locals.len() + self.func_ty.params.len() + self.extra_locals.len(); + self.extra_locals.push(ty); + u32::try_from(val).unwrap() + } + + fn end_active_control_frames( + &mut self, + u: &mut Unstructured<'_>, + module: &Module, + instructions: &mut Vec<Instruction>, + disallow_traps: bool, + ) -> Result<()> { + while !self.allocs.controls.is_empty() { + // Ensure that this label is valid by placing the right types onto + // the operand stack for the end of the label. + self.guarantee_label_results(u, module, instructions, disallow_traps)?; + + // Remove the label and clear the operand stack since the label has + // been removed. + let label = self.allocs.controls.pop().unwrap(); + self.allocs.operands.truncate(label.height); + + // If this is an `if` that is not stack neutral, then it + // must have an `else`. Generate synthetic results here in the same + // manner we did above. + if label.kind == ControlKind::If && label.params != label.results { + instructions.push(Instruction::Else); + self.allocs.controls.push(label.clone()); + self.allocs + .operands + .extend(label.params.into_iter().map(Some)); + self.guarantee_label_results(u, module, instructions, disallow_traps)?; + self.allocs.controls.pop(); + self.allocs.operands.truncate(label.height); + } + + // The last control frame for the function return does not + // need an `end` instruction. + if !self.allocs.controls.is_empty() { + instructions.push(Instruction::End); + } + + // Place the results of the label onto the operand stack for use + // after the label. + self.allocs + .operands + .extend(label.results.into_iter().map(Some)); + } + Ok(()) + } + + /// Modifies the instruction stream to guarantee that the current control + /// label's results are on the stack and ready for the control label to return. + fn guarantee_label_results( + &mut self, + u: &mut Unstructured<'_>, + module: &Module, + instructions: &mut Vec<Instruction>, + disallow_traps: bool, + ) -> Result<()> { + let operands = self.operands(); + let label = self.allocs.controls.last().unwrap(); + + // Already done, yay! + if label.results.len() == operands.len() && self.types_on_stack(module, &label.results) { + return Ok(()); + } + + // Generating an unreachable instruction is always a valid way to + // generate any types for a label, but it's not too interesting, so + // don't favor it. + if !disallow_traps && u.ratio(1, u16::MAX)? { + instructions.push(Instruction::Unreachable); + return Ok(()); + } + + // Arbitrarily massage the stack to get the expected results. First we + // drop all extraneous results to we're only dealing with those we want + // to deal with. Afterwards we start at the bottom of the stack and move + // up, figuring out what matches and what doesn't. As soon as something + // doesn't match we throw out that and everything else remaining, + // filling in results with dummy values. + let operands = operands.to_vec(); + let mut operands = operands.as_slice(); + let label_results = label.results.to_vec(); + while operands.len() > label_results.len() { + self.drop_operand(u, *operands.last().unwrap(), instructions)?; + operands = &operands[..operands.len() - 1]; + } + for (i, expected) in label_results.iter().enumerate() { + if let Some(actual) = operands.get(i) { + if Some(*expected) == *actual { + continue; + } + for ty in operands[i..].iter().rev() { + self.drop_operand(u, *ty, instructions)?; + } + operands = &[]; + } + instructions.push(arbitrary_val(*expected, u)); + } + Ok(()) + } + + fn drop_operand( + &mut self, + u: &mut Unstructured<'_>, + ty: Option<ValType>, + instructions: &mut Vec<Instruction>, + ) -> Result<()> { + if !self.mix_operand_into_global(u, ty, instructions)? { + instructions.push(Instruction::Drop); + } + Ok(()) + } + + /// Attempts to drop the top operand on the stack by "mixing" it into a + /// global. + /// + /// This is done to avoid dropping values on the floor to ensure that + /// everything is part of some computation somewhere. Otherwise, for + /// example, most function results are dropped on the floor as the stack + /// won't happen to match the function type that we're generating. + /// + /// This will return `true` if the operand has been dropped, and `false` if + /// it didn't for one reason or another. + fn mix_operand_into_global( + &mut self, + u: &mut Unstructured<'_>, + ty: Option<ValType>, + instructions: &mut Vec<Instruction>, + ) -> Result<bool> { + // If the type of this operand isn't known, for example if it's relevant + // to unreachable code, then it can't be combined, so return `false`. + let ty = match ty { + Some(ty) => ty, + None => return Ok(false), + }; + + // Use the input stream to allow a small chance of dropping the value + // without combining it. + if u.ratio(1, 100)? { + return Ok(false); + } + + // Depending on the type lookup or inject a global to place this value + // into. + let (global, combine) = match ty { + ValType::I32 => { + let global = *self.allocs.global_dropped_i32.get_or_insert_with(|| { + self.allocs.new_globals.push((ty, ConstExpr::i32_const(0))); + inc(&mut self.allocs.globals_cnt) + }); + (global, Instruction::I32Xor) + } + ValType::I64 => { + let global = *self.allocs.global_dropped_i64.get_or_insert_with(|| { + self.allocs.new_globals.push((ty, ConstExpr::i64_const(0))); + inc(&mut self.allocs.globals_cnt) + }); + (global, Instruction::I64Xor) + } + ValType::F32 => { + let global = *self.allocs.global_dropped_f32.get_or_insert_with(|| { + self.allocs + .new_globals + .push((ValType::I32, ConstExpr::i32_const(0))); + inc(&mut self.allocs.globals_cnt) + }); + instructions.push(Instruction::I32ReinterpretF32); + (global, Instruction::I32Xor) + } + ValType::F64 => { + let global = *self.allocs.global_dropped_f64.get_or_insert_with(|| { + self.allocs + .new_globals + .push((ValType::I64, ConstExpr::i64_const(0))); + inc(&mut self.allocs.globals_cnt) + }); + instructions.push(Instruction::I64ReinterpretF64); + (global, Instruction::I64Xor) + } + ValType::V128 => { + let global = *self.allocs.global_dropped_v128.get_or_insert_with(|| { + self.allocs.new_globals.push((ty, ConstExpr::v128_const(0))); + inc(&mut self.allocs.globals_cnt) + }); + (global, Instruction::V128Xor) + } + + // Don't know how to combine reference types at this time, so just + // let it get dropped. + ValType::Ref(_) => return Ok(false), + }; + instructions.push(Instruction::GlobalGet(global)); + instructions.push(combine); + instructions.push(Instruction::GlobalSet(global)); + + return Ok(true); + + fn inc(val: &mut u32) -> u32 { + let ret = *val; + *val += 1; + ret + } + } +} + +fn arbitrary_val(ty: ValType, u: &mut Unstructured<'_>) -> Instruction { + match ty { + ValType::I32 => Instruction::I32Const(u.arbitrary().unwrap_or(0)), + ValType::I64 => Instruction::I64Const(u.arbitrary().unwrap_or(0)), + ValType::F32 => Instruction::F32Const(u.arbitrary().unwrap_or(0.0)), + ValType::F64 => Instruction::F64Const(u.arbitrary().unwrap_or(0.0)), + ValType::V128 => Instruction::V128Const(u.arbitrary().unwrap_or(0)), + ValType::Ref(ty) => { + assert!(ty.nullable); + Instruction::RefNull(ty.heap_type) + } + } +} + +#[inline] +fn unreachable_valid(module: &Module, _: &mut CodeBuilder) -> bool { + !module.config.disallow_traps +} + +fn unreachable( + _: &mut Unstructured, + _: &Module, + _: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + instructions.push(Instruction::Unreachable); + Ok(()) +} + +fn nop( + _: &mut Unstructured, + _: &Module, + _: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + instructions.push(Instruction::Nop); + Ok(()) +} + +fn block( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let block_ty = builder.arbitrary_block_type(u, module)?; + let (params, results) = module.params_results(&block_ty); + builder.push_control(ControlKind::Block, params, results); + instructions.push(Instruction::Block(block_ty)); + Ok(()) +} + +#[inline] +fn try_table_valid(module: &Module, _: &mut CodeBuilder) -> bool { + module.config.exceptions_enabled +} + +fn try_table( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let block_ty = builder.arbitrary_block_type(u, module)?; + + let mut catch_options: Vec< + Box<dyn Fn(&mut Unstructured<'_>, &mut CodeBuilder<'_>) -> Result<Catch>>, + > = Vec::new(); + + for (i, ctrl) in builder.allocs.controls.iter().rev().enumerate() { + let i = i as u32; + + let label_types = ctrl.label_types(); + if label_types.is_empty() { + catch_options.push(Box::new(move |_, _| Ok(Catch::All { label: i }))); + } + if label_types == [ValType::EXNREF] { + catch_options.push(Box::new(move |_, _| Ok(Catch::AllRef { label: i }))); + } + + if builder.allocs.tags.contains_key(label_types) { + let label_types = label_types.to_vec(); + catch_options.push(Box::new(move |u, builder| { + Ok(Catch::One { + tag: *u.choose(&builder.allocs.tags[&label_types])?, + label: i, + }) + })); + } + + let mut label_types_with_exnref = label_types.to_vec(); + label_types_with_exnref.push(ValType::EXNREF); + if builder.allocs.tags.contains_key(&label_types_with_exnref) { + catch_options.push(Box::new(move |u, builder| { + Ok(Catch::OneRef { + tag: *u.choose(&builder.allocs.tags[&label_types_with_exnref])?, + label: i, + }) + })); + } + } + + let mut catches = Vec::new(); + if catch_options.len() > 0 { + for _ in 0..u.int_in_range(0..=10)? { + catches.push(u.choose(&mut catch_options)?(u, builder)?); + } + } + + let (params, results) = module.params_results(&block_ty); + builder.push_control(ControlKind::TryTable, params, results); + + instructions.push(Instruction::TryTable(block_ty, catches.into())); + Ok(()) +} + +fn r#loop( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let block_ty = builder.arbitrary_block_type(u, module)?; + let (params, results) = module.params_results(&block_ty); + builder.push_control(ControlKind::Loop, params, results); + instructions.push(Instruction::Loop(block_ty)); + Ok(()) +} + +#[inline] +fn if_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + builder.type_on_stack(module, ValType::I32) +} + +fn r#if( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + let block_ty = builder.arbitrary_block_type(u, module)?; + let (params, results) = module.params_results(&block_ty); + builder.push_control(ControlKind::If, params, results); + instructions.push(Instruction::If(block_ty)); + Ok(()) +} + +#[inline] +fn else_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + let last_control = builder.allocs.controls.last().unwrap(); + last_control.kind == ControlKind::If + && builder.operands().len() == last_control.results.len() + && builder.types_on_stack(module, &last_control.results) +} + +fn r#else( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let control = builder.pop_control(); + builder.pop_operands(module, &control.results); + builder.push_operands(&control.params); + builder.push_control(ControlKind::Block, control.params, control.results); + instructions.push(Instruction::Else); + Ok(()) +} + +#[inline] +fn end_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + // Note: first control frame is the function return's control frame, which + // does not have an associated `end`. + if builder.allocs.controls.len() <= 1 { + return false; + } + let control = builder.allocs.controls.last().unwrap(); + builder.operands().len() == control.results.len() + && builder.types_on_stack(module, &control.results) + // `if`s that don't leave the stack as they found it must have an + // `else`. + && !(control.kind == ControlKind::If && control.params != control.results) +} + +fn end( + _: &mut Unstructured, + _: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_control(); + instructions.push(Instruction::End); + Ok(()) +} + +#[inline] +fn br_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + builder + .allocs + .controls + .iter() + .any(|l| builder.label_types_on_stack(module, l)) +} + +fn br( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let n = builder + .allocs + .controls + .iter() + .filter(|l| builder.label_types_on_stack(module, l)) + .count(); + debug_assert!(n > 0); + let i = u.int_in_range(0..=n - 1)?; + let (target, _) = builder + .allocs + .controls + .iter() + .rev() + .enumerate() + .filter(|(_, l)| builder.label_types_on_stack(module, l)) + .nth(i) + .unwrap(); + let control = &builder.allocs.controls[builder.allocs.controls.len() - 1 - target]; + let tys = control.label_types().to_vec(); + builder.pop_operands(module, &tys); + instructions.push(Instruction::Br(target as u32)); + Ok(()) +} + +#[inline] +fn br_if_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !builder.type_on_stack(module, ValType::I32) { + return false; + } + let ty = builder.allocs.operands.pop().unwrap(); + let is_valid = builder + .allocs + .controls + .iter() + .any(|l| builder.label_types_on_stack(module, l)); + builder.allocs.operands.push(ty); + is_valid +} + +fn br_if( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + + let n = builder + .allocs + .controls + .iter() + .filter(|l| builder.label_types_on_stack(module, l)) + .count(); + debug_assert!(n > 0); + let i = u.int_in_range(0..=n - 1)?; + let (target, _) = builder + .allocs + .controls + .iter() + .rev() + .enumerate() + .filter(|(_, l)| builder.label_types_on_stack(module, l)) + .nth(i) + .unwrap(); + instructions.push(Instruction::BrIf(target as u32)); + Ok(()) +} + +#[inline] +fn br_table_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !builder.type_on_stack(module, ValType::I32) { + return false; + } + let ty = builder.allocs.operands.pop().unwrap(); + let is_valid = br_valid(module, builder); + builder.allocs.operands.push(ty); + is_valid +} + +fn br_table( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + + let n = builder + .allocs + .controls + .iter() + .filter(|l| builder.label_types_on_stack(module, l)) + .count(); + debug_assert!(n > 0); + + let i = u.int_in_range(0..=n - 1)?; + let (default_target, _) = builder + .allocs + .controls + .iter() + .rev() + .enumerate() + .filter(|(_, l)| builder.label_types_on_stack(module, l)) + .nth(i) + .unwrap(); + let control = &builder.allocs.controls[builder.allocs.controls.len() - 1 - default_target]; + + let targets = builder + .allocs + .controls + .iter() + .rev() + .enumerate() + .filter(|(_, l)| l.label_types() == control.label_types()) + .map(|(t, _)| t as u32) + .collect(); + + let tys = control.label_types().to_vec(); + builder.pop_operands(module, &tys); + + instructions.push(Instruction::BrTable(targets, default_target as u32)); + Ok(()) +} + +#[inline] +fn return_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + builder.label_types_on_stack(module, &builder.allocs.controls[0]) +} + +fn r#return( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let results = builder.allocs.controls[0].results.clone(); + builder.pop_operands(module, &results); + instructions.push(Instruction::Return); + Ok(()) +} + +#[inline] +fn call_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + builder + .allocs + .functions + .keys() + .any(|func_ty| builder.types_on_stack(module, &func_ty.params)) +} + +fn call( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let candidates = builder + .allocs + .functions + .iter() + .filter(|(func_ty, _)| builder.types_on_stack(module, &func_ty.params)) + .flat_map(|(_, v)| v.iter().copied()) + .collect::<Vec<_>>(); + assert!(candidates.len() > 0); + let i = u.int_in_range(0..=candidates.len() - 1)?; + let (func_idx, ty) = module.funcs().nth(candidates[i] as usize).unwrap(); + builder.pop_operands(module, &ty.params); + builder.push_operands(&ty.results); + instructions.push(Instruction::Call(func_idx as u32)); + Ok(()) +} + +#[inline] +fn call_ref_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !module.config.gc_enabled { + return false; + } + let funcref = match builder.concrete_funcref_on_stack(module) { + Some(f) => f, + None => return false, + }; + if module.config.disallow_traps && funcref.nullable { + return false; + } + match funcref.heap_type { + HeapType::Concrete(idx) => { + let ty = builder.allocs.operands.pop().unwrap(); + let params = &module.ty(idx).unwrap_func().params; + let valid = builder.types_on_stack(module, params); + builder.allocs.operands.push(ty); + valid + } + _ => unreachable!(), + } +} + +fn call_ref( + _u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let heap_ty = match builder.pop_operand() { + Some(ValType::Ref(r)) => r.heap_type, + _ => unreachable!(), + }; + let idx = match heap_ty { + HeapType::Concrete(idx) => idx, + _ => unreachable!(), + }; + let func_ty = match &module.ty(idx).composite_type { + CompositeType::Func(f) => f, + _ => unreachable!(), + }; + builder.pop_operands(module, &func_ty.params); + builder.push_operands(&func_ty.results); + instructions.push(Instruction::CallRef(idx)); + Ok(()) +} + +#[inline] +fn call_indirect_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if builder.allocs.funcref_tables.is_empty() || !builder.type_on_stack(module, ValType::I32) { + return false; + } + if module.config.disallow_traps { + // We have no way to reflect, at run time, on a `funcref` in + // the `i`th slot in a table and dynamically avoid trapping + // `call_indirect`s. Therefore, we can't emit *any* + // `call_indirect` instructions if we want to avoid traps. + return false; + } + let ty = builder.allocs.operands.pop().unwrap(); + let is_valid = module + .func_types() + .any(|(_, ty)| builder.types_on_stack(module, &ty.params)); + builder.allocs.operands.push(ty); + is_valid +} + +fn call_indirect( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + + let choices = module + .func_types() + .filter(|(_, ty)| builder.types_on_stack(module, &ty.params)) + .collect::<Vec<_>>(); + let (type_idx, ty) = u.choose(&choices)?; + builder.pop_operands(module, &ty.params); + builder.push_operands(&ty.results); + let table = *u.choose(&builder.allocs.funcref_tables)?; + instructions.push(Instruction::CallIndirect { + ty: *type_idx as u32, + table, + }); + Ok(()) +} + +#[inline] +fn return_call_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !module.config.tail_call_enabled { + return false; + } + + builder.allocs.functions.keys().any(|func_ty| { + builder.types_on_stack(module, &func_ty.params) + && builder.allocs.controls[0].label_types() == &func_ty.results + }) +} + +fn return_call( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let candidates = builder + .allocs + .functions + .iter() + .filter(|(func_ty, _)| { + builder.types_on_stack(module, &func_ty.params) + && builder.allocs.controls[0].label_types() == &func_ty.results + }) + .flat_map(|(_, v)| v.iter().copied()) + .collect::<Vec<_>>(); + assert!(candidates.len() > 0); + let i = u.int_in_range(0..=candidates.len() - 1)?; + let (func_idx, ty) = module.funcs().nth(candidates[i] as usize).unwrap(); + builder.pop_operands(module, &ty.params); + builder.push_operands(&ty.results); + instructions.push(Instruction::ReturnCall(func_idx as u32)); + Ok(()) +} + +#[inline] +fn return_call_ref_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !module.config.gc_enabled { + return false; + } + + let ref_ty = match builder.concrete_funcref_on_stack(module) { + None => return false, + Some(r) if r.nullable && module.config.disallow_traps => return false, + Some(r) => r, + }; + + let idx = match ref_ty.heap_type { + HeapType::Concrete(idx) => idx, + _ => unreachable!(), + }; + let func_ty = match &module.ty(idx).composite_type { + CompositeType::Func(f) => f, + CompositeType::Array(_) | CompositeType::Struct(_) => return false, + }; + + let ty = builder.allocs.operands.pop().unwrap(); + let valid = builder.types_on_stack(module, &func_ty.params) + && builder.func_ty.results == func_ty.results; + builder.allocs.operands.push(ty); + valid +} + +fn return_call_ref( + _u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let heap_ty = match builder.pop_operand() { + Some(ValType::Ref(r)) => r.heap_type, + _ => unreachable!(), + }; + let idx = match heap_ty { + HeapType::Concrete(idx) => idx, + _ => unreachable!(), + }; + let func_ty = match &module.ty(idx).composite_type { + CompositeType::Func(f) => f, + _ => unreachable!(), + }; + builder.pop_operands(module, &func_ty.params); + builder.push_operands(&func_ty.results); + instructions.push(Instruction::ReturnCallRef(idx)); + Ok(()) +} + +#[inline] +fn return_call_indirect_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !module.config.tail_call_enabled + || builder.allocs.funcref_tables.is_empty() + || !builder.type_on_stack(module, ValType::I32) + { + return false; + } + + if module.config.disallow_traps { + // See comment in `call_indirect_valid`; same applies here. + return false; + } + + let ty = builder.allocs.operands.pop().unwrap(); + let is_valid = module.func_types().any(|(_, ty)| { + builder.types_on_stack(module, &ty.params) + && builder.allocs.controls[0].label_types() == &ty.results + }); + builder.allocs.operands.push(ty); + is_valid +} + +fn return_call_indirect( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + + let choices = module + .func_types() + .filter(|(_, ty)| { + builder.types_on_stack(module, &ty.params) + && builder.allocs.controls[0].label_types() == &ty.results + }) + .collect::<Vec<_>>(); + let (type_idx, ty) = u.choose(&choices)?; + builder.pop_operands(module, &ty.params); + builder.push_operands(&ty.results); + let table = *u.choose(&builder.allocs.funcref_tables)?; + instructions.push(Instruction::ReturnCallIndirect { + ty: *type_idx as u32, + table, + }); + Ok(()) +} + +#[inline] +fn throw_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.exceptions_enabled + && builder + .allocs + .tags + .keys() + .any(|k| builder.types_on_stack(module, k)) +} + +fn throw( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let candidates = builder + .allocs + .tags + .iter() + .filter(|(k, _)| builder.types_on_stack(module, k)) + .flat_map(|(_, v)| v.iter().copied()) + .collect::<Vec<_>>(); + assert!(candidates.len() > 0); + let i = u.int_in_range(0..=candidates.len() - 1)?; + let (tag_idx, tag_type) = module.tags().nth(candidates[i] as usize).unwrap(); + // Tags have no results, throwing cannot return + assert!(tag_type.func_type.results.len() == 0); + builder.pop_operands(module, &tag_type.func_type.params); + instructions.push(Instruction::Throw(tag_idx as u32)); + Ok(()) +} + +#[inline] +fn throw_ref_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.exceptions_enabled && builder.types_on_stack(module, &[ValType::EXNREF]) +} + +fn throw_ref( + _u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::EXNREF]); + instructions.push(Instruction::ThrowRef); + Ok(()) +} + +#[inline] +fn br_on_null_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !module.config.gc_enabled { + return false; + } + if builder.ref_type_on_stack().is_none() { + return false; + } + let ty = builder.allocs.operands.pop().unwrap(); + let valid = br_valid(module, builder); + builder.allocs.operands.push(ty); + valid +} + +fn br_on_null( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let heap_type = match builder.pop_ref_type() { + Some(r) => r.heap_type, + None => { + if !module.types.is_empty() && u.arbitrary()? { + HeapType::Concrete(u.int_in_range(0..=u32::try_from(module.types.len()).unwrap())?) + } else { + *u.choose(&[ + HeapType::Func, + HeapType::Extern, + HeapType::Any, + HeapType::None, + HeapType::NoExtern, + HeapType::NoFunc, + HeapType::Eq, + HeapType::Struct, + HeapType::Array, + HeapType::I31, + ])? + } + } + }; + + let n = builder + .allocs + .controls + .iter() + .filter(|l| builder.label_types_on_stack(module, l)) + .count(); + debug_assert!(n > 0); + + let i = u.int_in_range(0..=n - 1)?; + let (target, _) = builder + .allocs + .controls + .iter() + .rev() + .enumerate() + .filter(|(_, l)| builder.label_types_on_stack(module, l)) + .nth(i) + .unwrap(); + + builder.push_operands(&[ValType::Ref(RefType { + nullable: false, + heap_type, + })]); + + instructions.push(Instruction::BrOnNull(u32::try_from(target).unwrap())); + Ok(()) +} + +fn is_valid_br_on_non_null_control( + module: &Module, + control: &Control, + builder: &CodeBuilder, +) -> bool { + let ref_ty = match control.label_types().last() { + Some(ValType::Ref(r)) => *r, + Some(_) | None => return false, + }; + let nullable_ref_ty = RefType { + nullable: true, + ..ref_ty + }; + builder.type_on_stack(module, ValType::Ref(nullable_ref_ty)) + && control + .label_types() + .iter() + .rev() + .enumerate() + .skip(1) + .all(|(idx, ty)| builder.type_on_stack_at(module, idx, *ty)) +} + +#[inline] +fn br_on_non_null_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && builder + .allocs + .controls + .iter() + .any(|l| is_valid_br_on_non_null_control(module, l, builder)) +} + +fn br_on_non_null( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let n = builder + .allocs + .controls + .iter() + .filter(|l| is_valid_br_on_non_null_control(module, l, builder)) + .count(); + debug_assert!(n > 0); + + let i = u.int_in_range(0..=n - 1)?; + let (target, _) = builder + .allocs + .controls + .iter() + .rev() + .enumerate() + .filter(|(_, l)| is_valid_br_on_non_null_control(module, l, builder)) + .nth(i) + .unwrap(); + + builder.pop_ref_type(); + instructions.push(Instruction::BrOnNonNull(u32::try_from(target).unwrap())); + Ok(()) +} + +fn is_valid_br_on_cast_control( + module: &Module, + builder: &CodeBuilder, + control: &Control, + from_ref_ty: Option<RefType>, +) -> bool { + // The last label type is a sub type of the type we are casting from... + let to_ref_ty = match control.label_types().last() { + Some(ValType::Ref(r)) => *r, + _ => return false, + }; + if let Some(from_ty) = from_ref_ty { + if !module.ref_type_is_sub_type(to_ref_ty, from_ty) { + return false; + } + } + // ... and the rest of the label types are on the stack. + control + .label_types() + .iter() + .rev() + .enumerate() + .skip(1) + .all(|(idx, ty)| builder.type_on_stack_at(module, idx, *ty)) +} + +#[inline] +fn br_on_cast_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + let from_ref_ty = match builder.ref_type_on_stack() { + None => return false, + Some(r) => r, + }; + module.config.gc_enabled + && builder + .allocs + .controls + .iter() + .any(|l| is_valid_br_on_cast_control(module, builder, l, from_ref_ty)) +} + +/// Compute the [type difference] between the two given ref types. +/// +/// [type difference]: https://webassembly.github.io/gc/core/valid/conventions.html#aux-reftypediff +fn ref_type_difference(a: RefType, b: RefType) -> RefType { + RefType { + nullable: if b.nullable { false } else { a.nullable }, + heap_type: a.heap_type, + } +} + +fn br_on_cast( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let from_ref_type = builder.ref_type_on_stack().unwrap(); + + let n = builder + .allocs + .controls + .iter() + .filter(|l| is_valid_br_on_cast_control(module, builder, l, from_ref_type)) + .count(); + debug_assert!(n > 0); + + let i = u.int_in_range(0..=n - 1)?; + let (relative_depth, control) = builder + .allocs + .controls + .iter() + .rev() + .enumerate() + .filter(|(_, l)| is_valid_br_on_cast_control(module, builder, l, from_ref_type)) + .nth(i) + .unwrap(); + let relative_depth = u32::try_from(relative_depth).unwrap(); + + let to_ref_type = match control.label_types().last() { + Some(ValType::Ref(r)) => *r, + _ => unreachable!(), + }; + + let to_ref_type = module.arbitrary_matching_ref_type(u, to_ref_type)?; + let from_ref_type = from_ref_type.unwrap_or(to_ref_type); + let from_ref_type = module.arbitrary_super_type_of_ref_type(u, from_ref_type)?; + + builder.pop_operand(); + builder.push_operands(&[ValType::Ref(ref_type_difference( + from_ref_type, + to_ref_type, + ))]); + + instructions.push(Instruction::BrOnCast { + from_ref_type, + to_ref_type, + relative_depth, + }); + Ok(()) +} + +fn is_valid_br_on_cast_fail_control( + module: &Module, + builder: &CodeBuilder, + control: &Control, + from_ref_type: Option<RefType>, +) -> bool { + control + .label_types() + .last() + .map_or(false, |label_ty| match (label_ty, from_ref_type) { + (ValType::Ref(label_ty), Some(from_ty)) => { + module.ref_type_is_sub_type(from_ty, *label_ty) + } + (ValType::Ref(_), None) => true, + _ => false, + }) + && control + .label_types() + .iter() + .rev() + .enumerate() + .skip(1) + .all(|(idx, ty)| builder.type_on_stack_at(module, idx, *ty)) +} + +#[inline] +fn br_on_cast_fail_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + let from_ref_ty = match builder.ref_type_on_stack() { + None => return false, + Some(r) => r, + }; + module.config.gc_enabled + && builder + .allocs + .controls + .iter() + .any(|l| is_valid_br_on_cast_fail_control(module, builder, l, from_ref_ty)) +} + +fn br_on_cast_fail( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let from_ref_type = builder.ref_type_on_stack().unwrap(); + + let n = builder + .allocs + .controls + .iter() + .filter(|l| is_valid_br_on_cast_fail_control(module, builder, l, from_ref_type)) + .count(); + debug_assert!(n > 0); + + let i = u.int_in_range(0..=n - 1)?; + let (target, control) = builder + .allocs + .controls + .iter() + .rev() + .enumerate() + .filter(|(_, l)| is_valid_br_on_cast_fail_control(module, builder, l, from_ref_type)) + .nth(i) + .unwrap(); + + let from_ref_type = + from_ref_type.unwrap_or_else(|| match control.label_types().last().unwrap() { + ValType::Ref(r) => *r, + _ => unreachable!(), + }); + let to_ref_type = module.arbitrary_matching_ref_type(u, from_ref_type)?; + + builder.pop_operand(); + builder.push_operand(Some(ValType::Ref(to_ref_type))); + + instructions.push(Instruction::BrOnCastFail { + from_ref_type, + to_ref_type, + relative_depth: u32::try_from(target).unwrap(), + }); + Ok(()) +} + +#[inline] +fn drop_valid(_module: &Module, builder: &mut CodeBuilder) -> bool { + !builder.operands().is_empty() +} + +fn drop( + u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let ty = builder.pop_operand(); + builder.drop_operand(u, ty, instructions)?; + Ok(()) +} + +#[inline] +fn select_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !(builder.operands().len() >= 3 && builder.type_on_stack(module, ValType::I32)) { + return false; + } + let t = builder.operands()[builder.operands().len() - 2]; + let u = builder.operands()[builder.operands().len() - 3]; + t.is_none() || u.is_none() || t == u +} + +fn select( + _: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operand(); + let t = builder.pop_operand(); + let u = builder.pop_operand(); + let ty = t.or(u); + builder.allocs.operands.push(ty); + match ty { + Some(ty @ ValType::Ref(_)) => instructions.push(Instruction::TypedSelect(ty)), + Some(ValType::I32) | Some(ValType::I64) | Some(ValType::F32) | Some(ValType::F64) + | Some(ValType::V128) | None => instructions.push(Instruction::Select), + } + Ok(()) +} + +#[inline] +fn local_get_valid(_module: &Module, builder: &mut CodeBuilder) -> bool { + !builder.func_ty.params.is_empty() || !builder.locals.is_empty() +} + +fn local_get( + u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let num_params = builder.func_ty.params.len(); + let n = num_params + builder.locals.len(); + debug_assert!(n > 0); + let i = u.int_in_range(0..=n - 1)?; + builder.allocs.operands.push(Some(if i < num_params { + builder.func_ty.params[i] + } else { + builder.locals[i - num_params] + })); + instructions.push(Instruction::LocalGet(i as u32)); + Ok(()) +} + +#[inline] +fn local_set_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + builder + .func_ty + .params + .iter() + .chain(builder.locals.iter()) + .any(|ty| builder.type_on_stack(module, *ty)) +} + +fn local_set( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let n = builder + .func_ty + .params + .iter() + .chain(builder.locals.iter()) + .filter(|ty| builder.type_on_stack(module, **ty)) + .count(); + debug_assert!(n > 0); + let i = u.int_in_range(0..=n - 1)?; + let (j, _) = builder + .func_ty + .params + .iter() + .chain(builder.locals.iter()) + .enumerate() + .filter(|(_, ty)| builder.type_on_stack(module, **ty)) + .nth(i) + .unwrap(); + builder.allocs.operands.pop(); + instructions.push(Instruction::LocalSet(j as u32)); + Ok(()) +} + +fn local_tee( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let n = builder + .func_ty + .params + .iter() + .chain(builder.locals.iter()) + .filter(|ty| builder.type_on_stack(module, **ty)) + .count(); + debug_assert!(n > 0); + let i = u.int_in_range(0..=n - 1)?; + let (j, _) = builder + .func_ty + .params + .iter() + .chain(builder.locals.iter()) + .enumerate() + .filter(|(_, ty)| builder.type_on_stack(module, **ty)) + .nth(i) + .unwrap(); + instructions.push(Instruction::LocalTee(j as u32)); + Ok(()) +} + +#[inline] +fn global_get_valid(module: &Module, _: &mut CodeBuilder) -> bool { + module.globals.len() > 0 +} + +fn global_get( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + debug_assert!(module.globals.len() > 0); + let global_idx = u.int_in_range(0..=module.globals.len() - 1)?; + builder + .allocs + .operands + .push(Some(module.globals[global_idx].val_type)); + instructions.push(Instruction::GlobalGet(global_idx as u32)); + Ok(()) +} + +#[inline] +fn global_set_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + builder + .allocs + .mutable_globals + .iter() + .any(|(ty, _)| builder.type_on_stack(module, *ty)) +} + +fn global_set( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let candidates = builder + .allocs + .mutable_globals + .iter() + .find(|(ty, _)| builder.type_on_stack(module, **ty)) + .unwrap() + .1; + let i = u.int_in_range(0..=candidates.len() - 1)?; + builder.allocs.operands.pop(); + instructions.push(Instruction::GlobalSet(candidates[i])); + Ok(()) +} + +#[inline] +fn have_memory(module: &Module, _: &mut CodeBuilder) -> bool { + module.memories.len() > 0 +} + +#[inline] +fn have_memory_and_offset(module: &Module, builder: &mut CodeBuilder) -> bool { + (builder.allocs.memory32.len() > 0 && builder.type_on_stack(module, ValType::I32)) + || (builder.allocs.memory64.len() > 0 && builder.type_on_stack(module, ValType::I64)) +} + +#[inline] +fn have_data(module: &Module, _: &mut CodeBuilder) -> bool { + module.data.len() > 0 +} + +fn i32_load( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0, 1, 2])?; + builder.allocs.operands.push(Some(ValType::I32)); + if module.config.disallow_traps { + no_traps::load(Instruction::I32Load(memarg), module, builder, instructions); + } else { + instructions.push(Instruction::I32Load(memarg)); + } + Ok(()) +} + +fn i64_load( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0, 1, 2, 3])?; + builder.allocs.operands.push(Some(ValType::I64)); + if module.config.disallow_traps { + no_traps::load(Instruction::I64Load(memarg), module, builder, instructions); + } else { + instructions.push(Instruction::I64Load(memarg)); + } + Ok(()) +} + +fn f32_load( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0, 1, 2])?; + builder.allocs.operands.push(Some(ValType::F32)); + if module.config.disallow_traps { + no_traps::load(Instruction::F32Load(memarg), module, builder, instructions); + } else { + instructions.push(Instruction::F32Load(memarg)); + } + Ok(()) +} + +fn f64_load( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0, 1, 2, 3])?; + builder.allocs.operands.push(Some(ValType::F64)); + if module.config.disallow_traps { + no_traps::load(Instruction::F64Load(memarg), module, builder, instructions); + } else { + instructions.push(Instruction::F64Load(memarg)); + } + Ok(()) +} + +fn i32_load_8_s( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0])?; + builder.allocs.operands.push(Some(ValType::I32)); + if module.config.disallow_traps { + no_traps::load( + Instruction::I32Load8S(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I32Load8S(memarg)); + } + Ok(()) +} + +fn i32_load_8_u( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0])?; + builder.allocs.operands.push(Some(ValType::I32)); + if module.config.disallow_traps { + no_traps::load( + Instruction::I32Load8U(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I32Load8U(memarg)); + } + Ok(()) +} + +fn i32_load_16_s( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0, 1])?; + builder.allocs.operands.push(Some(ValType::I32)); + if module.config.disallow_traps { + no_traps::load( + Instruction::I32Load16S(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I32Load16S(memarg)); + } + Ok(()) +} + +fn i32_load_16_u( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0, 1])?; + builder.allocs.operands.push(Some(ValType::I32)); + if module.config.disallow_traps { + no_traps::load( + Instruction::I32Load16U(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I32Load16U(memarg)); + } + Ok(()) +} + +fn i64_load_8_s( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0])?; + builder.allocs.operands.push(Some(ValType::I64)); + if module.config.disallow_traps { + no_traps::load( + Instruction::I64Load8S(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I64Load8S(memarg)); + } + Ok(()) +} + +fn i64_load_16_s( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0, 1])?; + builder.allocs.operands.push(Some(ValType::I64)); + if module.config.disallow_traps { + no_traps::load( + Instruction::I64Load16S(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I64Load16S(memarg)); + } + Ok(()) +} + +fn i64_load_32_s( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0, 1, 2])?; + builder.allocs.operands.push(Some(ValType::I64)); + if module.config.disallow_traps { + no_traps::load( + Instruction::I64Load32S(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I64Load32S(memarg)); + } + Ok(()) +} + +fn i64_load_8_u( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0])?; + builder.allocs.operands.push(Some(ValType::I64)); + if module.config.disallow_traps { + no_traps::load( + Instruction::I64Load8U(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I64Load8U(memarg)); + } + Ok(()) +} + +fn i64_load_16_u( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0, 1])?; + builder.allocs.operands.push(Some(ValType::I64)); + if module.config.disallow_traps { + no_traps::load( + Instruction::I64Load16U(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I64Load16U(memarg)); + } + Ok(()) +} + +fn i64_load_32_u( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let memarg = mem_arg(u, module, builder, &[0, 1, 2])?; + builder.allocs.operands.push(Some(ValType::I64)); + if module.config.disallow_traps { + no_traps::load( + Instruction::I64Load32U(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I64Load32U(memarg)); + } + Ok(()) +} + +#[inline] +fn store_valid(module: &Module, builder: &mut CodeBuilder, f: impl Fn() -> ValType) -> bool { + (builder.allocs.memory32.len() > 0 && builder.types_on_stack(module, &[ValType::I32, f()])) + || (builder.allocs.memory64.len() > 0 + && builder.types_on_stack(module, &[ValType::I64, f()])) +} + +#[inline] +fn i32_store_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + store_valid(module, builder, || ValType::I32) +} + +fn i32_store( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + let memarg = mem_arg(u, module, builder, &[0, 1, 2])?; + if module.config.disallow_traps { + no_traps::store(Instruction::I32Store(memarg), module, builder, instructions); + } else { + instructions.push(Instruction::I32Store(memarg)); + } + Ok(()) +} + +#[inline] +fn i64_store_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + store_valid(module, builder, || ValType::I64) +} + +fn i64_store( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + let memarg = mem_arg(u, module, builder, &[0, 1, 2, 3])?; + if module.config.disallow_traps { + no_traps::store(Instruction::I64Store(memarg), module, builder, instructions); + } else { + instructions.push(Instruction::I64Store(memarg)); + } + Ok(()) +} + +#[inline] +fn f32_store_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + store_valid(module, builder, || ValType::F32) +} + +fn f32_store( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + let memarg = mem_arg(u, module, builder, &[0, 1, 2])?; + if module.config.disallow_traps { + no_traps::store(Instruction::F32Store(memarg), module, builder, instructions); + } else { + instructions.push(Instruction::F32Store(memarg)); + } + Ok(()) +} + +#[inline] +fn f64_store_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + store_valid(module, builder, || ValType::F64) +} + +fn f64_store( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + let memarg = mem_arg(u, module, builder, &[0, 1, 2, 3])?; + if module.config.disallow_traps { + no_traps::store(Instruction::F64Store(memarg), module, builder, instructions); + } else { + instructions.push(Instruction::F64Store(memarg)); + } + Ok(()) +} + +fn i32_store_8( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + let memarg = mem_arg(u, module, builder, &[0])?; + if module.config.disallow_traps { + no_traps::store( + Instruction::I32Store8(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I32Store8(memarg)); + } + Ok(()) +} + +fn i32_store_16( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + let memarg = mem_arg(u, module, builder, &[0, 1])?; + if module.config.disallow_traps { + no_traps::store( + Instruction::I32Store16(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I32Store16(memarg)); + } + Ok(()) +} + +fn i64_store_8( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + let memarg = mem_arg(u, module, builder, &[0])?; + if module.config.disallow_traps { + no_traps::store( + Instruction::I64Store8(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I64Store8(memarg)); + } + Ok(()) +} + +fn i64_store_16( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + let memarg = mem_arg(u, module, builder, &[0, 1])?; + if module.config.disallow_traps { + no_traps::store( + Instruction::I64Store16(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I64Store16(memarg)); + } + Ok(()) +} + +fn i64_store_32( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + let memarg = mem_arg(u, module, builder, &[0, 1, 2])?; + if module.config.disallow_traps { + no_traps::store( + Instruction::I64Store32(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::I64Store32(memarg)); + } + Ok(()) +} + +fn memory_size( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let i = u.int_in_range(0..=module.memories.len() - 1)?; + let ty = if module.memories[i].memory64 { + ValType::I64 + } else { + ValType::I32 + }; + builder.push_operands(&[ty]); + instructions.push(Instruction::MemorySize(i as u32)); + Ok(()) +} + +#[inline] +fn memory_grow_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + (builder.allocs.memory32.len() > 0 && builder.type_on_stack(module, ValType::I32)) + || (builder.allocs.memory64.len() > 0 && builder.type_on_stack(module, ValType::I64)) +} + +fn memory_grow( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let ty = if builder.type_on_stack(module, ValType::I32) { + ValType::I32 + } else { + ValType::I64 + }; + let index = memory_index(u, builder, ty)?; + builder.pop_operands(module, &[ty]); + builder.push_operands(&[ty]); + instructions.push(Instruction::MemoryGrow(index)); + Ok(()) +} + +#[inline] +fn memory_init_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.bulk_memory_enabled + && have_data(module, builder) + && !module.config.disallow_traps // Non-trapping memory init not yet implemented + && (builder.allocs.memory32.len() > 0 + && builder.types_on_stack(module, &[ValType::I32, ValType::I32, ValType::I32]) + || (builder.allocs.memory64.len() > 0 + && builder.types_on_stack(module, &[ValType::I64, ValType::I32, ValType::I32]))) +} + +fn memory_init( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + let ty = if builder.type_on_stack(module, ValType::I32) { + ValType::I32 + } else { + ValType::I64 + }; + let mem = memory_index(u, builder, ty)?; + let data_index = data_index(u, module)?; + builder.pop_operands(module, &[ty]); + instructions.push(Instruction::MemoryInit { mem, data_index }); + Ok(()) +} + +#[inline] +fn memory_fill_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.bulk_memory_enabled + && !module.config.disallow_traps // Non-trapping memory fill generation not yet implemented + && (builder.allocs.memory32.len() > 0 + && builder.types_on_stack(module, &[ValType::I32, ValType::I32, ValType::I32]) + || (builder.allocs.memory64.len() > 0 + && builder.types_on_stack(module, &[ValType::I64, ValType::I32, ValType::I64]))) +} + +fn memory_fill( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let ty = if builder.type_on_stack(module, ValType::I32) { + ValType::I32 + } else { + ValType::I64 + }; + let mem = memory_index(u, builder, ty)?; + builder.pop_operands(module, &[ty, ValType::I32, ty]); + instructions.push(Instruction::MemoryFill(mem)); + Ok(()) +} + +#[inline] +fn memory_copy_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !module.config.bulk_memory_enabled { + return false; + } + + // The non-trapping case for memory copy has not yet been implemented, + // so we are excluding them for now + if module.config.disallow_traps { + return false; + } + + if builder.types_on_stack(module, &[ValType::I64, ValType::I64, ValType::I64]) + && builder.allocs.memory64.len() > 0 + { + return true; + } + if builder.types_on_stack(module, &[ValType::I32, ValType::I32, ValType::I32]) + && builder.allocs.memory32.len() > 0 + { + return true; + } + if builder.types_on_stack(module, &[ValType::I64, ValType::I32, ValType::I32]) + && builder.allocs.memory32.len() > 0 + && builder.allocs.memory64.len() > 0 + { + return true; + } + if builder.types_on_stack(module, &[ValType::I32, ValType::I64, ValType::I32]) + && builder.allocs.memory32.len() > 0 + && builder.allocs.memory64.len() > 0 + { + return true; + } + false +} + +fn memory_copy( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let (src_mem, dst_mem) = + if builder.types_on_stack(module, &[ValType::I64, ValType::I64, ValType::I64]) { + builder.pop_operands(module, &[ValType::I64, ValType::I64, ValType::I64]); + ( + memory_index(u, builder, ValType::I64)?, + memory_index(u, builder, ValType::I64)?, + ) + } else if builder.types_on_stack(module, &[ValType::I32, ValType::I32, ValType::I32]) { + builder.pop_operands(module, &[ValType::I32, ValType::I32, ValType::I32]); + ( + memory_index(u, builder, ValType::I32)?, + memory_index(u, builder, ValType::I32)?, + ) + } else if builder.types_on_stack(module, &[ValType::I64, ValType::I32, ValType::I32]) { + builder.pop_operands(module, &[ValType::I64, ValType::I32, ValType::I32]); + ( + memory_index(u, builder, ValType::I32)?, + memory_index(u, builder, ValType::I64)?, + ) + } else if builder.types_on_stack(module, &[ValType::I32, ValType::I64, ValType::I32]) { + builder.pop_operands(module, &[ValType::I32, ValType::I64, ValType::I32]); + ( + memory_index(u, builder, ValType::I64)?, + memory_index(u, builder, ValType::I32)?, + ) + } else { + unreachable!() + }; + instructions.push(Instruction::MemoryCopy { dst_mem, src_mem }); + Ok(()) +} + +#[inline] +fn data_drop_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + have_data(module, builder) && module.config.bulk_memory_enabled +} + +fn data_drop( + u: &mut Unstructured, + module: &Module, + _builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + instructions.push(Instruction::DataDrop(data_index(u, module)?)); + Ok(()) +} + +fn i32_const( + u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let x = u.arbitrary()?; + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Const(x)); + Ok(()) +} + +fn i64_const( + u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let x = u.arbitrary()?; + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Const(x)); + Ok(()) +} + +fn f32_const( + u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let x = u.arbitrary()?; + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Const(x)); + Ok(()) +} + +fn f64_const( + u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let x = u.arbitrary()?; + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Const(x)); + Ok(()) +} + +#[inline] +fn i32_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + builder.type_on_stack(module, ValType::I32) +} + +fn i32_eqz( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Eqz); + Ok(()) +} + +#[inline] +fn i32_i32_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + builder.types_on_stack(module, &[ValType::I32, ValType::I32]) +} + +fn i32_eq( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Eq); + Ok(()) +} + +fn i32_ne( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Ne); + Ok(()) +} + +fn i32_lt_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32LtS); + Ok(()) +} + +fn i32_lt_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32LtU); + Ok(()) +} + +fn i32_gt_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32GtS); + Ok(()) +} + +fn i32_gt_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32GtU); + Ok(()) +} + +fn i32_le_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32LeS); + Ok(()) +} + +fn i32_le_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32LeU); + Ok(()) +} + +fn i32_ge_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32GeS); + Ok(()) +} + +fn i32_ge_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32GeU); + Ok(()) +} + +#[inline] +fn i64_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + builder.types_on_stack(module, &[ValType::I64]) +} + +fn i64_eqz( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I64Eqz); + Ok(()) +} + +#[inline] +fn i64_i64_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + builder.types_on_stack(module, &[ValType::I64, ValType::I64]) +} + +fn i64_eq( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I64Eq); + Ok(()) +} + +fn i64_ne( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I64Ne); + Ok(()) +} + +fn i64_lt_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I64LtS); + Ok(()) +} + +fn i64_lt_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I64LtU); + Ok(()) +} + +fn i64_gt_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I64GtS); + Ok(()) +} + +fn i64_gt_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I64GtU); + Ok(()) +} + +fn i64_le_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I64LeS); + Ok(()) +} + +fn i64_le_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I64LeU); + Ok(()) +} + +fn i64_ge_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I64GeS); + Ok(()) +} + +fn i64_ge_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I64GeU); + Ok(()) +} + +fn f32_f32_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + builder.types_on_stack(module, &[ValType::F32, ValType::F32]) +} + +fn f32_eq( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32, ValType::F32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::F32Eq); + Ok(()) +} + +fn f32_ne( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32, ValType::F32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::F32Ne); + Ok(()) +} + +fn f32_lt( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32, ValType::F32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::F32Lt); + Ok(()) +} + +fn f32_gt( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32, ValType::F32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::F32Gt); + Ok(()) +} + +fn f32_le( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32, ValType::F32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::F32Le); + Ok(()) +} + +fn f32_ge( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32, ValType::F32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::F32Ge); + Ok(()) +} + +fn f64_f64_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + builder.types_on_stack(module, &[ValType::F64, ValType::F64]) +} + +fn f64_eq( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64, ValType::F64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::F64Eq); + Ok(()) +} + +fn f64_ne( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64, ValType::F64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::F64Ne); + Ok(()) +} + +fn f64_lt( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64, ValType::F64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::F64Lt); + Ok(()) +} + +fn f64_gt( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64, ValType::F64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::F64Gt); + Ok(()) +} + +fn f64_le( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64, ValType::F64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::F64Le); + Ok(()) +} + +fn f64_ge( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64, ValType::F64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::F64Ge); + Ok(()) +} + +fn i32_clz( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Clz); + Ok(()) +} + +fn i32_ctz( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Ctz); + Ok(()) +} + +fn i32_popcnt( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Popcnt); + Ok(()) +} + +fn i32_add( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Add); + Ok(()) +} + +fn i32_sub( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Sub); + Ok(()) +} + +fn i32_mul( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Mul); + Ok(()) +} + +fn i32_div_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + if module.config.disallow_traps { + no_traps::signed_div_rem(Instruction::I32DivS, builder, instructions); + } else { + instructions.push(Instruction::I32DivS); + } + Ok(()) +} + +fn i32_div_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + if module.config.disallow_traps { + no_traps::unsigned_div_rem(Instruction::I32DivU, builder, instructions); + } else { + instructions.push(Instruction::I32DivU); + } + Ok(()) +} + +fn i32_rem_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + if module.config.disallow_traps { + no_traps::signed_div_rem(Instruction::I32RemS, builder, instructions); + } else { + instructions.push(Instruction::I32RemS); + } + Ok(()) +} + +fn i32_rem_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + if module.config.disallow_traps { + no_traps::unsigned_div_rem(Instruction::I32RemU, builder, instructions); + } else { + instructions.push(Instruction::I32RemU); + } + Ok(()) +} + +fn i32_and( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32And); + Ok(()) +} + +fn i32_or( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Or); + Ok(()) +} + +fn i32_xor( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Xor); + Ok(()) +} + +fn i32_shl( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Shl); + Ok(()) +} + +fn i32_shr_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32ShrS); + Ok(()) +} + +fn i32_shr_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32ShrU); + Ok(()) +} + +fn i32_rotl( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Rotl); + Ok(()) +} + +fn i32_rotr( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Rotr); + Ok(()) +} + +fn i64_clz( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Clz); + Ok(()) +} + +fn i64_ctz( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Ctz); + Ok(()) +} + +fn i64_popcnt( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Popcnt); + Ok(()) +} + +fn i64_add( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Add); + Ok(()) +} + +fn i64_sub( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Sub); + Ok(()) +} + +fn i64_mul( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Mul); + Ok(()) +} + +fn i64_div_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + if module.config.disallow_traps { + no_traps::signed_div_rem(Instruction::I64DivS, builder, instructions); + } else { + instructions.push(Instruction::I64DivS); + } + Ok(()) +} + +fn i64_div_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + if module.config.disallow_traps { + no_traps::unsigned_div_rem(Instruction::I64DivU, builder, instructions); + } else { + instructions.push(Instruction::I64DivU); + } + Ok(()) +} + +fn i64_rem_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + if module.config.disallow_traps { + no_traps::signed_div_rem(Instruction::I64RemS, builder, instructions); + } else { + instructions.push(Instruction::I64RemS); + } + Ok(()) +} + +fn i64_rem_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + if module.config.disallow_traps { + no_traps::unsigned_div_rem(Instruction::I64RemU, builder, instructions); + } else { + instructions.push(Instruction::I64RemU); + } + Ok(()) +} + +fn i64_and( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64And); + Ok(()) +} + +fn i64_or( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Or); + Ok(()) +} + +fn i64_xor( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Xor); + Ok(()) +} + +fn i64_shl( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Shl); + Ok(()) +} + +fn i64_shr_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64ShrS); + Ok(()) +} + +fn i64_shr_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64ShrU); + Ok(()) +} + +fn i64_rotl( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Rotl); + Ok(()) +} + +fn i64_rotr( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64, ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Rotr); + Ok(()) +} + +#[inline] +fn f32_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + builder.types_on_stack(module, &[ValType::F32]) +} + +fn f32_abs( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Abs); + Ok(()) +} + +fn f32_neg( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Neg); + Ok(()) +} + +fn f32_ceil( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Ceil); + Ok(()) +} + +fn f32_floor( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Floor); + Ok(()) +} + +fn f32_trunc( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Trunc); + Ok(()) +} + +fn f32_nearest( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Nearest); + Ok(()) +} + +fn f32_sqrt( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Sqrt); + Ok(()) +} + +fn f32_add( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32, ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Add); + Ok(()) +} + +fn f32_sub( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32, ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Sub); + Ok(()) +} + +fn f32_mul( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32, ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Mul); + Ok(()) +} + +fn f32_div( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32, ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Div); + Ok(()) +} + +fn f32_min( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32, ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Min); + Ok(()) +} + +fn f32_max( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32, ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Max); + Ok(()) +} + +fn f32_copysign( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32, ValType::F32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32Copysign); + Ok(()) +} + +#[inline] +fn f64_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + builder.types_on_stack(module, &[ValType::F64]) +} + +fn f64_abs( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Abs); + Ok(()) +} + +fn f64_neg( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Neg); + Ok(()) +} + +fn f64_ceil( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Ceil); + Ok(()) +} + +fn f64_floor( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Floor); + Ok(()) +} + +fn f64_trunc( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Trunc); + Ok(()) +} + +fn f64_nearest( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Nearest); + Ok(()) +} + +fn f64_sqrt( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Sqrt); + Ok(()) +} + +fn f64_add( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64, ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Add); + Ok(()) +} + +fn f64_sub( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64, ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Sub); + Ok(()) +} + +fn f64_mul( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64, ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Mul); + Ok(()) +} + +fn f64_div( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64, ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Div); + Ok(()) +} + +fn f64_min( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64, ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Min); + Ok(()) +} + +fn f64_max( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64, ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Max); + Ok(()) +} + +fn f64_copysign( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64, ValType::F64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64Copysign); + Ok(()) +} + +fn i32_wrap_i64( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32WrapI64); + Ok(()) +} + +fn nontrapping_f32_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.saturating_float_to_int_enabled && f32_on_stack(module, builder) +} + +fn i32_trunc_f32_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::I32]); + if module.config.disallow_traps { + no_traps::trunc(Instruction::I32TruncF32S, builder, instructions); + } else { + instructions.push(Instruction::I32TruncF32S); + } + Ok(()) +} + +fn i32_trunc_f32_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::I32]); + if module.config.disallow_traps { + no_traps::trunc(Instruction::I32TruncF32U, builder, instructions); + } else { + instructions.push(Instruction::I32TruncF32U); + } + Ok(()) +} + +fn nontrapping_f64_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.saturating_float_to_int_enabled && f64_on_stack(module, builder) +} + +fn i32_trunc_f64_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::I32]); + if module.config.disallow_traps { + no_traps::trunc(Instruction::I32TruncF64S, builder, instructions); + } else { + instructions.push(Instruction::I32TruncF64S); + } + Ok(()) +} + +fn i32_trunc_f64_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::I32]); + if module.config.disallow_traps { + no_traps::trunc(Instruction::I32TruncF64U, builder, instructions); + } else { + instructions.push(Instruction::I32TruncF64U); + } + Ok(()) +} + +fn i64_extend_i32_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64ExtendI32S); + Ok(()) +} + +fn i64_extend_i32_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64ExtendI32U); + Ok(()) +} + +fn i64_trunc_f32_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::I64]); + if module.config.disallow_traps { + no_traps::trunc(Instruction::I64TruncF32S, builder, instructions); + } else { + instructions.push(Instruction::I64TruncF32S); + } + Ok(()) +} + +fn i64_trunc_f32_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::I64]); + if module.config.disallow_traps { + no_traps::trunc(Instruction::I64TruncF32U, builder, instructions); + } else { + instructions.push(Instruction::I64TruncF32U); + } + Ok(()) +} + +fn i64_trunc_f64_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::I64]); + if module.config.disallow_traps { + no_traps::trunc(Instruction::I64TruncF64S, builder, instructions); + } else { + instructions.push(Instruction::I64TruncF64S); + } + Ok(()) +} + +fn i64_trunc_f64_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::I64]); + if module.config.disallow_traps { + no_traps::trunc(Instruction::I64TruncF64U, builder, instructions); + } else { + instructions.push(Instruction::I64TruncF64U); + } + Ok(()) +} + +fn f32_convert_i32_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32ConvertI32S); + Ok(()) +} + +fn f32_convert_i32_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32ConvertI32U); + Ok(()) +} + +fn f32_convert_i64_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32ConvertI64S); + Ok(()) +} + +fn f32_convert_i64_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32ConvertI64U); + Ok(()) +} + +fn f32_demote_f64( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32DemoteF64); + Ok(()) +} + +fn f64_convert_i32_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64ConvertI32S); + Ok(()) +} + +fn f64_convert_i32_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64ConvertI32U); + Ok(()) +} + +fn f64_convert_i64_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64ConvertI64S); + Ok(()) +} + +fn f64_convert_i64_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64ConvertI64U); + Ok(()) +} + +fn f64_promote_f32( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64PromoteF32); + Ok(()) +} + +fn i32_reinterpret_f32( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32ReinterpretF32); + Ok(()) +} + +fn i64_reinterpret_f64( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64ReinterpretF64); + Ok(()) +} + +fn f32_reinterpret_i32( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + builder.push_operands(&[ValType::F32]); + instructions.push(Instruction::F32ReinterpretI32); + Ok(()) +} + +fn f64_reinterpret_i64( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + builder.push_operands(&[ValType::F64]); + instructions.push(Instruction::F64ReinterpretI64); + Ok(()) +} + +fn extendable_i32_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.sign_extension_ops_enabled && i32_on_stack(module, builder) +} + +fn i32_extend_8_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Extend8S); + Ok(()) +} + +fn i32_extend_16_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32Extend16S); + Ok(()) +} + +fn extendable_i64_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.sign_extension_ops_enabled && i64_on_stack(module, builder) +} + +fn i64_extend_8_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Extend8S); + Ok(()) +} + +fn i64_extend_16_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Extend16S); + Ok(()) +} + +fn i64_extend_32_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64Extend32S); + Ok(()) +} + +fn i32_trunc_sat_f32_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32TruncSatF32S); + Ok(()) +} + +fn i32_trunc_sat_f32_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32TruncSatF32U); + Ok(()) +} + +fn i32_trunc_sat_f64_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32TruncSatF64S); + Ok(()) +} + +fn i32_trunc_sat_f64_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::I32TruncSatF64U); + Ok(()) +} + +fn i64_trunc_sat_f32_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64TruncSatF32S); + Ok(()) +} + +fn i64_trunc_sat_f32_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F32]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64TruncSatF32U); + Ok(()) +} + +fn i64_trunc_sat_f64_s( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64TruncSatF64S); + Ok(()) +} + +fn i64_trunc_sat_f64_u( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::F64]); + builder.push_operands(&[ValType::I64]); + instructions.push(Instruction::I64TruncSatF64U); + Ok(()) +} + +fn memory_offset(u: &mut Unstructured, module: &Module, memory_index: u32) -> Result<u64> { + let MemoryOffsetChoices(a, b, c) = module.config.memory_offset_choices; + assert!(a + b + c != 0); + + let memory_type = &module.memories[memory_index as usize]; + let min = memory_type.minimum.saturating_mul(65536); + let max = memory_type + .maximum + .map(|max| max.saturating_mul(65536)) + .unwrap_or(u64::MAX); + + let (min, max, true_max) = match (memory_type.memory64, module.config.disallow_traps) { + (true, false) => { + // 64-bit memories can use the limits calculated above as-is + (min, max, u64::MAX) + } + (false, false) => { + // 32-bit memories can't represent a full 4gb offset, so if that's the + // min/max sizes then we need to switch the m to `u32::MAX`. + ( + u64::from(u32::try_from(min).unwrap_or(u32::MAX)), + u64::from(u32::try_from(max).unwrap_or(u32::MAX)), + u64::from(u32::MAX), + ) + } + // The logic for non-trapping versions of load/store involves pushing + // the offset + load/store size onto the stack as either an i32 or i64 + // value. So even though offsets can normally be as high as u32 or u64, + // we need to limit them to lower in order for our non-trapping logic to + // work. 16 is the number of bytes of the largest load type (V128). + (true, true) => { + let no_trap_max = (i64::MAX - 16) as u64; + (min.min(no_trap_max), no_trap_max, no_trap_max) + } + (false, true) => { + let no_trap_max = (i32::MAX - 16) as u64; + (min.min(no_trap_max), no_trap_max, no_trap_max) + } + }; + + let choice = u.int_in_range(0..=a + b + c - 1)?; + if choice < a { + u.int_in_range(0..=min) + } else if choice < a + b { + u.int_in_range(min..=max) + } else { + u.int_in_range(max..=true_max) + } +} + +fn mem_arg( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + alignments: &[u32], +) -> Result<MemArg> { + let memory_index = if builder.type_on_stack(module, ValType::I32) { + builder.pop_operands(module, &[ValType::I32]); + memory_index(u, builder, ValType::I32)? + } else { + builder.pop_operands(module, &[ValType::I64]); + memory_index(u, builder, ValType::I64)? + }; + let offset = memory_offset(u, module, memory_index)?; + let align = *u.choose(alignments)?; + Ok(MemArg { + memory_index, + offset, + align, + }) +} + +fn memory_index(u: &mut Unstructured, builder: &CodeBuilder, ty: ValType) -> Result<u32> { + if ty == ValType::I32 { + Ok(*u.choose(&builder.allocs.memory32)?) + } else { + Ok(*u.choose(&builder.allocs.memory64)?) + } +} + +fn data_index(u: &mut Unstructured, module: &Module) -> Result<u32> { + let data = module.data.len() as u32; + assert!(data > 0); + if data == 1 { + Ok(0) + } else { + u.int_in_range(0..=data - 1) + } +} + +#[inline] +fn ref_null_valid(module: &Module, _: &mut CodeBuilder) -> bool { + module.config.reference_types_enabled +} + +fn ref_null( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let mut choices = vec![RefType::EXTERNREF, RefType::FUNCREF]; + if module.config.exceptions_enabled { + choices.push(RefType::EXNREF); + } + if module.config.gc_enabled { + let r = |heap_type| RefType { + nullable: true, + heap_type, + }; + choices.push(r(HeapType::Any)); + choices.push(r(HeapType::Eq)); + choices.push(r(HeapType::Array)); + choices.push(r(HeapType::Struct)); + choices.push(r(HeapType::I31)); + choices.push(r(HeapType::None)); + choices.push(r(HeapType::NoFunc)); + choices.push(r(HeapType::NoExtern)); + for i in 0..module.types.len() { + let i = u32::try_from(i).unwrap(); + choices.push(r(HeapType::Concrete(i))); + } + } + let ty = *u.choose(&choices)?; + builder.push_operand(Some(ty.into())); + instructions.push(Instruction::RefNull(ty.heap_type)); + Ok(()) +} + +#[inline] +fn ref_func_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.reference_types_enabled && builder.allocs.referenced_functions.len() > 0 +} + +fn ref_func( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let i = *u.choose(&builder.allocs.referenced_functions)?; + let ty = module.funcs[usize::try_from(i).unwrap()].0; + builder.push_operand(Some(ValType::Ref(if module.config.gc_enabled { + RefType { + nullable: false, + heap_type: HeapType::Concrete(ty), + } + } else { + RefType::FUNCREF + }))); + instructions.push(Instruction::RefFunc(i)); + Ok(()) +} + +#[inline] +fn ref_as_non_null_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled && builder.ref_type_on_stack().is_some() +} + +fn ref_as_non_null( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let ref_ty = match builder.pop_ref_type() { + Some(r) => r, + None => module.arbitrary_ref_type(u)?, + }; + builder.push_operand(Some(ValType::Ref(RefType { + nullable: false, + heap_type: ref_ty.heap_type, + }))); + instructions.push(Instruction::RefAsNonNull); + Ok(()) +} + +#[inline] +fn ref_eq_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + let eq_ref = ValType::Ref(RefType { + nullable: true, + heap_type: HeapType::Eq, + }); + module.config.gc_enabled && builder.types_on_stack(module, &[eq_ref, eq_ref]) +} + +fn ref_eq( + _u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operand(); + builder.pop_operand(); + builder.push_operand(Some(ValType::I32)); + instructions.push(Instruction::RefEq); + Ok(()) +} + +#[inline] +fn ref_test_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled && builder.ref_type_on_stack().is_some() +} + +fn ref_test( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let ref_ty = match builder.pop_ref_type() { + Some(r) => r, + None => module.arbitrary_ref_type(u)?, + }; + builder.push_operand(Some(ValType::I32)); + + let sub_ty = module.arbitrary_matching_heap_type(u, ref_ty.heap_type)?; + instructions.push(if !ref_ty.nullable || u.arbitrary()? { + Instruction::RefTestNonNull(sub_ty) + } else { + Instruction::RefTestNullable(sub_ty) + }); + Ok(()) +} + +#[inline] +fn ref_cast_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.gc_enabled + && builder.ref_type_on_stack().is_some() +} + +fn ref_cast( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let ref_ty = match builder.pop_ref_type() { + Some(r) => r, + None => module.arbitrary_ref_type(u)?, + }; + let sub_ty = RefType { + nullable: if !ref_ty.nullable { + false + } else { + u.arbitrary()? + }, + heap_type: module.arbitrary_matching_heap_type(u, ref_ty.heap_type)?, + }; + builder.push_operand(Some(ValType::Ref(sub_ty))); + + instructions.push(if !sub_ty.nullable { + Instruction::RefCastNonNull(sub_ty.heap_type) + } else { + Instruction::RefCastNullable(sub_ty.heap_type) + }); + Ok(()) +} + +#[inline] +fn ref_is_null_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.reference_types_enabled + && (builder.type_on_stack(module, ValType::EXTERNREF) + || builder.type_on_stack(module, ValType::FUNCREF)) +} + +fn ref_is_null( + _: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_ref_type(); + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::RefIsNull); + Ok(()) +} + +#[inline] +fn table_fill_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.reference_types_enabled + && module.config.bulk_memory_enabled + && !module.config.disallow_traps // Non-trapping table fill generation not yet implemented + && [ValType::EXTERNREF, ValType::FUNCREF].iter().any(|ty| { + builder.types_on_stack(module, &[ValType::I32, *ty, ValType::I32]) + && module.tables.iter().any(|t| { + module.val_type_is_sub_type(*ty, t.element_type.into()) + }) + }) +} + +fn table_fill( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + let table = match builder.pop_ref_type() { + Some(ty) => table_index(ty, u, module)?, + // Stack polymorphic, can choose any reference type we have a table for, + // so just choose the table directly. + None => u.int_in_range(0..=u32::try_from(module.tables.len()).unwrap())?, + }; + builder.pop_operands(module, &[ValType::I32]); + instructions.push(Instruction::TableFill(table)); + Ok(()) +} + +#[inline] +fn table_set_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.reference_types_enabled + && !module.config.disallow_traps // Non-trapping table.set generation not yet implemented + && [ValType::EXTERNREF, ValType::FUNCREF].iter().any(|ty| { + builder.types_on_stack(module, &[ValType::I32, *ty]) + && module.tables.iter().any(|t| { + module.val_type_is_sub_type(*ty, t.element_type.into()) + }) + }) +} + +fn table_set( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let table = match builder.pop_ref_type() { + Some(ty) => table_index(ty, u, module)?, + // Stack polymorphic, can choose any reference type we have a table for, + // so just choose the table directly. + None => u.int_in_range(0..=u32::try_from(module.tables.len()).unwrap())?, + }; + builder.pop_operands(module, &[ValType::I32]); + instructions.push(Instruction::TableSet(table)); + Ok(()) +} + +#[inline] +fn table_get_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.reference_types_enabled + && !module.config.disallow_traps // Non-trapping table.get generation not yet implemented + && builder.type_on_stack(module, ValType::I32) + && module.tables.len() > 0 +} + +fn table_get( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + let idx = u.int_in_range(0..=module.tables.len() - 1)?; + let ty = module.tables[idx].element_type; + builder.push_operands(&[ty.into()]); + instructions.push(Instruction::TableGet(idx as u32)); + Ok(()) +} + +#[inline] +fn table_size_valid(module: &Module, _: &mut CodeBuilder) -> bool { + module.config.reference_types_enabled && module.tables.len() > 0 +} + +fn table_size( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let table = u.int_in_range(0..=module.tables.len() - 1)? as u32; + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::TableSize(table)); + Ok(()) +} + +#[inline] +fn table_grow_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.reference_types_enabled + && [ValType::EXTERNREF, ValType::FUNCREF].iter().any(|ty| { + builder.types_on_stack(module, &[*ty, ValType::I32]) + && module + .tables + .iter() + .any(|t| module.val_type_is_sub_type(*ty, t.element_type.into())) + }) +} + +fn table_grow( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32]); + let table = match builder.pop_ref_type() { + Some(ty) => table_index(ty, u, module)?, + // Stack polymorphic, can choose any reference type we have a table for, + // so just choose the table directly. + None => u.int_in_range(0..=u32::try_from(module.tables.len()).unwrap())?, + }; + builder.push_operands(&[ValType::I32]); + instructions.push(Instruction::TableGrow(table)); + Ok(()) +} + +#[inline] +fn table_copy_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.bulk_memory_enabled + && !module.config.disallow_traps // Non-trapping table.copy generation not yet implemented + && module.tables.len() > 0 + && builder.types_on_stack(module, &[ValType::I32, ValType::I32, ValType::I32]) +} + +fn table_copy( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32, ValType::I32]); + let src_table = u.int_in_range(0..=module.tables.len() - 1)? as u32; + let dst_table = table_index(module.tables[src_table as usize].element_type, u, module)?; + instructions.push(Instruction::TableCopy { + src_table, + dst_table, + }); + Ok(()) +} + +#[inline] +fn table_init_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.bulk_memory_enabled + && !module.config.disallow_traps // Non-trapping table.init generation not yet implemented. + && builder.allocs.table_init_possible + && builder.types_on_stack(module, &[ValType::I32, ValType::I32, ValType::I32]) +} + +fn table_init( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::I32, ValType::I32, ValType::I32]); + let segments = module + .elems + .iter() + .enumerate() + .filter(|(_, e)| module.tables.iter().any(|t| t.element_type == e.ty)) + .map(|(i, _)| i) + .collect::<Vec<_>>(); + let segment = *u.choose(&segments)?; + let table = table_index(module.elems[segment].ty, u, module)?; + instructions.push(Instruction::TableInit { + elem_index: segment as u32, + table, + }); + Ok(()) +} + +#[inline] +fn elem_drop_valid(module: &Module, _builder: &mut CodeBuilder) -> bool { + module.config.bulk_memory_enabled && module.elems.len() > 0 +} + +fn elem_drop( + u: &mut Unstructured, + module: &Module, + _builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let segment = u.int_in_range(0..=module.elems.len() - 1)? as u32; + instructions.push(Instruction::ElemDrop(segment)); + Ok(()) +} + +#[inline] +fn struct_new_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && module + .struct_types + .iter() + .copied() + .any(|i| builder.field_types_on_stack(module, &module.ty(i).unwrap_struct().fields)) +} + +fn struct_new( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let n = module + .struct_types + .iter() + .filter(|i| builder.field_types_on_stack(module, &module.ty(**i).unwrap_struct().fields)) + .count(); + debug_assert!(n > 0); + let i = u.int_in_range(0..=n - 1)?; + let ty = module + .struct_types + .iter() + .copied() + .filter(|i| builder.field_types_on_stack(module, &module.ty(*i).unwrap_struct().fields)) + .nth(i) + .unwrap(); + + for _ in module.ty(ty).unwrap_struct().fields.iter() { + builder.pop_operand(); + } + builder.push_operand(Some(ValType::Ref(RefType { + nullable: false, + heap_type: HeapType::Concrete(ty), + }))); + + instructions.push(Instruction::StructNew(ty)); + Ok(()) +} + +#[inline] +fn struct_new_default_valid(module: &Module, _builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && module.struct_types.iter().copied().any(|i| { + module + .ty(i) + .unwrap_struct() + .fields + .iter() + .all(|f| f.element_type.is_defaultable()) + }) +} + +fn struct_new_default( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let n = module + .struct_types + .iter() + .filter(|i| { + module + .ty(**i) + .unwrap_struct() + .fields + .iter() + .all(|f| f.element_type.is_defaultable()) + }) + .count(); + debug_assert!(n > 0); + let i = u.int_in_range(0..=n - 1)?; + let ty = module + .struct_types + .iter() + .copied() + .filter(|i| { + module + .ty(*i) + .unwrap_struct() + .fields + .iter() + .all(|f| f.element_type.is_defaultable()) + }) + .nth(i) + .unwrap(); + + builder.push_operand(Some(ValType::Ref(RefType { + nullable: false, + heap_type: HeapType::Concrete(ty), + }))); + + instructions.push(Instruction::StructNewDefault(ty)); + Ok(()) +} + +#[inline] +fn struct_get_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && !module.config.disallow_traps + && builder.non_empty_struct_ref_on_stack(module, !module.config.disallow_traps) +} + +fn struct_get( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let (_, struct_type_index) = builder.pop_concrete_ref_type(); + let struct_ty = module.ty(struct_type_index).unwrap_struct(); + let num_fields = u32::try_from(struct_ty.fields.len()).unwrap(); + debug_assert!(num_fields > 0); + let field_index = u.int_in_range(0..=num_fields - 1)?; + let (val_ty, ext) = match struct_ty.fields[usize::try_from(field_index).unwrap()].element_type { + StorageType::I8 | StorageType::I16 => (ValType::I32, Some(u.arbitrary()?)), + StorageType::Val(v) => (v, None), + }; + builder.push_operand(Some(val_ty)); + instructions.push(match ext { + None => Instruction::StructGet { + struct_type_index, + field_index, + }, + Some(true) => Instruction::StructGetS { + struct_type_index, + field_index, + }, + Some(false) => Instruction::StructGetU { + struct_type_index, + field_index, + }, + }); + Ok(()) +} + +#[inline] +fn struct_set_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !module.config.gc_enabled { + return false; + } + match builder.concrete_struct_ref_type_on_stack_at(module, 1) { + None => return false, + Some((true, _, _)) if module.config.disallow_traps => return false, + Some((_, _, ty)) => ty + .fields + .iter() + .any(|f| f.mutable && builder.type_on_stack(module, f.element_type.unpack())), + } +} + +fn struct_set( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let val_ty = builder.pop_operand(); + let (_, struct_type_index) = builder.pop_concrete_ref_type(); + let struct_ty = module.ty(struct_type_index).unwrap_struct(); + + let valid_field = |f: &FieldType| -> bool { + match val_ty { + None => f.mutable, + Some(val_ty) => { + f.mutable && module.val_type_is_sub_type(val_ty, f.element_type.unpack()) + } + } + }; + + let n = struct_ty.fields.iter().filter(|f| valid_field(f)).count(); + debug_assert!(n > 0); + let i = u.int_in_range(0..=n - 1)?; + let (field_index, _) = struct_ty + .fields + .iter() + .enumerate() + .filter(|(_, f)| valid_field(f)) + .nth(i) + .unwrap(); + let field_index = u32::try_from(field_index).unwrap(); + + instructions.push(Instruction::StructSet { + struct_type_index, + field_index, + }); + Ok(()) +} + +#[inline] +fn array_new_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && builder.type_on_stack(module, ValType::I32) + && module + .array_types + .iter() + .any(|i| builder.field_type_on_stack_at(module, 1, module.ty(*i).unwrap_array().0)) +} + +fn array_new( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let n = module + .array_types + .iter() + .filter(|i| builder.field_type_on_stack_at(module, 1, module.ty(**i).unwrap_array().0)) + .count(); + debug_assert!(n > 0); + let i = u.int_in_range(0..=n - 1)?; + let ty = module + .array_types + .iter() + .copied() + .filter(|i| builder.field_type_on_stack_at(module, 1, module.ty(*i).unwrap_array().0)) + .nth(i) + .unwrap(); + + builder.pop_operand(); + builder.pop_operand(); + builder.push_operand(Some(ValType::Ref(RefType { + nullable: false, + heap_type: HeapType::Concrete(ty), + }))); + + instructions.push(Instruction::ArrayNew(ty)); + Ok(()) +} + +#[inline] +fn array_new_fixed_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && module + .array_types + .iter() + .any(|i| builder.field_type_on_stack(module, module.ty(*i).unwrap_array().0)) +} + +fn array_new_fixed( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let n = module + .array_types + .iter() + .filter(|i| builder.field_type_on_stack(module, module.ty(**i).unwrap_array().0)) + .count(); + debug_assert!(n > 0); + let i = u.int_in_range(0..=n - 1)?; + let array_type_index = module + .array_types + .iter() + .copied() + .filter(|i| builder.field_type_on_stack(module, module.ty(*i).unwrap_array().0)) + .nth(i) + .unwrap(); + let elem_ty = module + .ty(array_type_index) + .unwrap_array() + .0 + .element_type + .unpack(); + + let m = (0..builder.operands().len()) + .take_while(|i| builder.type_on_stack_at(module, *i, elem_ty)) + .count(); + debug_assert!(m > 0); + let array_size = u.int_in_range(0..=m - 1)?; + let array_size = u32::try_from(array_size).unwrap(); + + for _ in 0..array_size { + builder.pop_operand(); + } + builder.push_operand(Some(ValType::Ref(RefType { + nullable: false, + heap_type: HeapType::Concrete(array_type_index), + }))); + + instructions.push(Instruction::ArrayNewFixed { + array_type_index, + array_size, + }); + Ok(()) +} + +#[inline] +fn array_new_default_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && builder.type_on_stack(module, ValType::I32) + && module + .array_types + .iter() + .any(|i| module.ty(*i).unwrap_array().0.element_type.is_defaultable()) +} + +fn array_new_default( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let n = module + .array_types + .iter() + .filter(|i| { + module + .ty(**i) + .unwrap_array() + .0 + .element_type + .is_defaultable() + }) + .count(); + debug_assert!(n > 0); + let i = u.int_in_range(0..=n - 1)?; + let array_type_index = module + .array_types + .iter() + .copied() + .filter(|i| module.ty(*i).unwrap_array().0.element_type.is_defaultable()) + .nth(i) + .unwrap(); + + builder.pop_operand(); + builder.push_operand(Some(ValType::Ref(RefType { + nullable: false, + heap_type: HeapType::Concrete(array_type_index), + }))); + instructions.push(Instruction::ArrayNewDefault(array_type_index)); + Ok(()) +} + +#[inline] +fn array_new_data_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && module.config.bulk_memory_enabled // Requires data count section + && !module.config.disallow_traps + && !module.data.is_empty() + && builder.types_on_stack(module, &[ValType::I32, ValType::I32]) + && module.array_types.iter().any(|i| { + let ty = module.ty(*i).unwrap_array().0.element_type.unpack(); + ty.is_numeric() | ty.is_vector() + }) +} + +fn array_new_data( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let n = module + .array_types + .iter() + .filter(|i| { + let ty = module.ty(**i).unwrap_array().0.element_type.unpack(); + ty.is_numeric() | ty.is_vector() + }) + .count(); + debug_assert!(n > 0); + let i = u.int_in_range(0..=n - 1)?; + let array_type_index = module + .array_types + .iter() + .copied() + .filter(|i| { + let ty = module.ty(*i).unwrap_array().0.element_type.unpack(); + ty.is_numeric() | ty.is_vector() + }) + .nth(i) + .unwrap(); + + let m = module.data.len(); + debug_assert!(m > 0); + let array_data_index = u.int_in_range(0..=m - 1)?; + let array_data_index = u32::try_from(array_data_index).unwrap(); + + builder.pop_operand(); + builder.pop_operand(); + builder.push_operand(Some(ValType::Ref(RefType { + nullable: false, + heap_type: HeapType::Concrete(array_type_index), + }))); + instructions.push(Instruction::ArrayNewData { + array_type_index, + array_data_index, + }); + Ok(()) +} + +fn module_has_elem_segment_of_array_type(module: &Module, ty: &ArrayType) -> bool { + module + .elems + .iter() + .any(|elem| module.val_type_is_sub_type(ValType::Ref(elem.ty), ty.0.element_type.unpack())) +} + +#[inline] +fn array_new_elem_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && !module.config.disallow_traps + && builder.types_on_stack(module, &[ValType::I32, ValType::I32]) + && module + .array_types + .iter() + .any(|i| module_has_elem_segment_of_array_type(module, module.ty(*i).unwrap_array())) +} + +fn array_new_elem( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let n = module + .array_types + .iter() + .filter(|i| module_has_elem_segment_of_array_type(module, module.ty(**i).unwrap_array())) + .count(); + debug_assert!(n > 0); + let i = u.int_in_range(0..=n - 1)?; + let array_type_index = module + .array_types + .iter() + .copied() + .filter(|i| module_has_elem_segment_of_array_type(module, module.ty(*i).unwrap_array())) + .nth(i) + .unwrap(); + let elem_ty = module + .ty(array_type_index) + .unwrap_array() + .0 + .element_type + .unpack(); + + let m = module + .elems + .iter() + .filter(|elem| module.val_type_is_sub_type(ValType::Ref(elem.ty), elem_ty)) + .count(); + debug_assert!(m > 0); + let j = u.int_in_range(0..=m - 1)?; + let (array_elem_index, _) = module + .elems + .iter() + .enumerate() + .filter(|(_, elem)| module.val_type_is_sub_type(ValType::Ref(elem.ty), elem_ty)) + .nth(j) + .unwrap(); + let array_elem_index = u32::try_from(array_elem_index).unwrap(); + + builder.pop_operand(); + builder.pop_operand(); + builder.push_operand(Some(ValType::Ref(RefType { + nullable: false, + heap_type: HeapType::Concrete(array_type_index), + }))); + + instructions.push(Instruction::ArrayNewElem { + array_type_index, + array_elem_index, + }); + Ok(()) +} + +#[inline] +fn array_get_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && !module.config.disallow_traps // TODO: add support for disallowing traps + && builder.type_on_stack(module, ValType::I32) + && builder.concrete_array_ref_type_on_stack_at(module, 1).is_some() +} + +fn array_get( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operand(); + let (_, array_type_index) = builder.pop_concrete_ref_type(); + let elem_ty = module.ty(array_type_index).unwrap_array().0.element_type; + builder.push_operand(Some(elem_ty.unpack())); + instructions.push(match elem_ty { + StorageType::I8 | StorageType::I16 => { + if u.arbitrary()? { + Instruction::ArrayGetS(array_type_index) + } else { + Instruction::ArrayGetU(array_type_index) + } + } + StorageType::Val(_) => Instruction::ArrayGet(array_type_index), + }); + Ok(()) +} + +#[inline] +fn array_set_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !module.config.gc_enabled + // TODO: implement disallowing traps. + || module.config.disallow_traps + || !builder.type_on_stack_at(module, 1, ValType::I32) + { + return false; + } + match builder.concrete_array_ref_type_on_stack_at(module, 2) { + None => false, + Some((_nullable, _idx, array_ty)) => { + array_ty.0.mutable && builder.field_type_on_stack(module, array_ty.0) + } + } +} + +fn array_set( + _u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operand(); + builder.pop_operand(); + let (_, ty) = builder.pop_concrete_ref_type(); + instructions.push(Instruction::ArraySet(ty)); + Ok(()) +} + +#[inline] +fn array_len_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && builder.type_on_stack( + module, + ValType::Ref(RefType { + nullable: true, + heap_type: HeapType::Array, + }), + ) +} + +fn array_len( + _u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operand(); + builder.push_operand(Some(ValType::I32)); + instructions.push(Instruction::ArrayLen); + Ok(()) +} + +#[inline] +fn array_fill_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !module.config.gc_enabled + // TODO: add support for disallowing traps + || module.config.disallow_traps + || !builder.type_on_stack_at(module, 0, ValType::I32) + || !builder.type_on_stack_at(module, 2, ValType::I32) + { + return false; + } + match builder.concrete_array_ref_type_on_stack_at(module, 3) { + None => return false, + Some((_, _, array_ty)) => { + array_ty.0.mutable && builder.field_type_on_stack_at(module, 1, array_ty.0) + } + } +} + +fn array_fill( + _u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operand(); + builder.pop_operand(); + builder.pop_operand(); + let (_, ty) = builder.pop_concrete_ref_type(); + instructions.push(Instruction::ArrayFill(ty)); + Ok(()) +} + +#[inline] +fn array_copy_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !module.config.gc_enabled + // TODO: add support for disallowing traps + || module.config.disallow_traps + || !builder.type_on_stack_at(module, 0, ValType::I32) + || !builder.type_on_stack_at(module, 1, ValType::I32) + || !builder.type_on_stack_at(module, 3, ValType::I32) + { + return false; + } + let x = match builder.concrete_array_ref_type_on_stack_at(module, 4) { + None => return false, + Some((_, _, x)) => x, + }; + if !x.0.mutable { + return false; + } + let y = match builder.concrete_array_ref_type_on_stack_at(module, 2) { + None => return false, + Some((_, _, y)) => y, + }; + match (x.0.element_type, y.0.element_type) { + (StorageType::I8, StorageType::I8) => true, + (StorageType::I8, _) => false, + (StorageType::I16, StorageType::I16) => true, + (StorageType::I16, _) => false, + (StorageType::Val(x), StorageType::Val(y)) => module.val_type_is_sub_type(y, x), + (StorageType::Val(_), _) => false, + } +} + +fn array_copy( + _u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operand(); + builder.pop_operand(); + let (_, array_type_index_src) = builder.pop_concrete_ref_type(); + builder.pop_operand(); + let (_, array_type_index_dst) = builder.pop_concrete_ref_type(); + instructions.push(Instruction::ArrayCopy { + array_type_index_dst, + array_type_index_src, + }); + Ok(()) +} + +#[inline] +fn array_init_data_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !module.config.gc_enabled + || !module.config.bulk_memory_enabled // Requires data count section + || module.config.disallow_traps + || module.data.is_empty() + || !builder.types_on_stack(module, &[ValType::I32, ValType::I32, ValType::I32]) + { + return false; + } + match builder.concrete_array_ref_type_on_stack_at(module, 3) { + None => return false, + Some((_, _, ty)) => { + let elem_ty = ty.0.element_type.unpack(); + ty.0.mutable && (elem_ty.is_numeric() || elem_ty.is_vector()) + } + } +} + +fn array_init_data( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operand(); + builder.pop_operand(); + builder.pop_operand(); + let (_, array_type_index) = builder.pop_concrete_ref_type(); + + let n = module.data.len(); + debug_assert!(n > 0); + let array_data_index = u.int_in_range(0..=n - 1)?; + let array_data_index = u32::try_from(array_data_index).unwrap(); + + instructions.push(Instruction::ArrayInitData { + array_type_index, + array_data_index, + }); + Ok(()) +} + +#[inline] +fn array_init_elem_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + if !module.config.gc_enabled + || module.config.disallow_traps + || !builder.types_on_stack(module, &[ValType::I32, ValType::I32, ValType::I32]) + { + return false; + } + match builder.concrete_array_ref_type_on_stack_at(module, 3) { + None => return false, + Some((_, _, array_ty)) => { + array_ty.0.mutable && module_has_elem_segment_of_array_type(module, &array_ty) + } + } +} + +fn array_init_elem( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operand(); + builder.pop_operand(); + builder.pop_operand(); + let (_, array_type_index) = builder.pop_concrete_ref_type(); + + let elem_ty = module + .ty(array_type_index) + .unwrap_array() + .0 + .element_type + .unpack(); + + let n = module + .elems + .iter() + .filter(|elem| module.val_type_is_sub_type(ValType::Ref(elem.ty), elem_ty)) + .count(); + debug_assert!(n > 0); + let j = u.int_in_range(0..=n - 1)?; + let (array_elem_index, _) = module + .elems + .iter() + .enumerate() + .filter(|(_, elem)| module.val_type_is_sub_type(ValType::Ref(elem.ty), elem_ty)) + .nth(j) + .unwrap(); + let array_elem_index = u32::try_from(array_elem_index).unwrap(); + + instructions.push(Instruction::ArrayInitElem { + array_type_index, + array_elem_index, + }); + Ok(()) +} + +#[inline] +fn ref_i31_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled && builder.type_on_stack(module, ValType::I32) +} + +fn ref_i31( + _u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operand(); + builder.push_operand(Some(ValType::Ref(RefType { + nullable: false, + heap_type: HeapType::I31, + }))); + instructions.push(Instruction::RefI31); + Ok(()) +} + +#[inline] +fn i31_get_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && builder.type_on_stack( + module, + ValType::Ref(RefType { + nullable: true, + heap_type: HeapType::I31, + }), + ) +} + +fn i31_get( + u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operand(); + builder.push_operand(Some(ValType::I32)); + instructions.push(if u.arbitrary()? { + Instruction::I31GetS + } else { + Instruction::I31GetU + }); + Ok(()) +} + +#[inline] +fn any_convert_extern_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && builder.type_on_stack( + module, + ValType::Ref(RefType { + nullable: true, + heap_type: HeapType::Extern, + }), + ) +} + +fn any_convert_extern( + u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let nullable = match builder.pop_ref_type() { + None => u.arbitrary()?, + Some(r) => r.nullable, + }; + builder.push_operand(Some(ValType::Ref(RefType { + nullable, + heap_type: HeapType::Any, + }))); + instructions.push(Instruction::AnyConvertExtern); + Ok(()) +} + +#[inline] +fn extern_convert_any_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + module.config.gc_enabled + && builder.type_on_stack( + module, + ValType::Ref(RefType { + nullable: true, + heap_type: HeapType::Any, + }), + ) +} + +fn extern_convert_any( + u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + let nullable = match builder.pop_ref_type() { + None => u.arbitrary()?, + Some(r) => r.nullable, + }; + builder.push_operand(Some(ValType::Ref(RefType { + nullable, + heap_type: HeapType::Extern, + }))); + instructions.push(Instruction::ExternConvertAny); + Ok(()) +} + +fn table_index(ty: RefType, u: &mut Unstructured, module: &Module) -> Result<u32> { + let tables = module + .tables + .iter() + .enumerate() + .filter(|(_, t)| module.ref_type_is_sub_type(ty, t.element_type)) + .map(|t| t.0 as u32) + .collect::<Vec<_>>(); + Ok(*u.choose(&tables)?) +} + +fn lane_index(u: &mut Unstructured, number_of_lanes: u8) -> Result<u8> { + u.int_in_range(0..=(number_of_lanes - 1)) +} + +#[inline] +fn simd_v128_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && builder.types_on_stack(module, &[ValType::V128]) +} + +#[inline] +fn simd_v128_on_stack_relaxed(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.relaxed_simd_enabled + && builder.types_on_stack(module, &[ValType::V128]) +} + +#[inline] +fn simd_v128_v128_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && builder.types_on_stack(module, &[ValType::V128, ValType::V128]) +} + +#[inline] +fn simd_v128_v128_on_stack_relaxed(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.relaxed_simd_enabled + && builder.types_on_stack(module, &[ValType::V128, ValType::V128]) +} + +#[inline] +fn simd_v128_v128_v128_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && builder.types_on_stack(module, &[ValType::V128, ValType::V128, ValType::V128]) +} + +#[inline] +fn simd_v128_v128_v128_on_stack_relaxed(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.relaxed_simd_enabled + && builder.types_on_stack(module, &[ValType::V128, ValType::V128, ValType::V128]) +} + +#[inline] +fn simd_v128_i32_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && builder.types_on_stack(module, &[ValType::V128, ValType::I32]) +} + +#[inline] +fn simd_v128_i64_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && builder.types_on_stack(module, &[ValType::V128, ValType::I64]) +} + +#[inline] +fn simd_v128_f32_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && builder.types_on_stack(module, &[ValType::V128, ValType::F32]) +} + +#[inline] +fn simd_v128_f64_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && builder.types_on_stack(module, &[ValType::V128, ValType::F64]) +} + +#[inline] +fn simd_i32_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && builder.type_on_stack(module, ValType::I32) +} + +#[inline] +fn simd_i64_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && builder.type_on_stack(module, ValType::I64) +} + +#[inline] +fn simd_f32_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && builder.type_on_stack(module, ValType::F32) +} + +#[inline] +fn simd_f64_on_stack(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && builder.type_on_stack(module, ValType::F64) +} + +#[inline] +fn simd_have_memory_and_offset(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && have_memory_and_offset(module, builder) +} + +#[inline] +fn simd_have_memory_and_offset_and_v128(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && store_valid(module, builder, || ValType::V128) +} + +#[inline] +fn simd_load_lane_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + // The SIMD non-trapping case is not yet implemented. + !module.config.disallow_traps && simd_have_memory_and_offset_and_v128(module, builder) +} + +#[inline] +fn simd_v128_store_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + !module.config.disallow_traps + && module.config.simd_enabled + && store_valid(module, builder, || ValType::V128) +} + +#[inline] +fn simd_store_lane_valid(module: &Module, builder: &mut CodeBuilder) -> bool { + // The SIMD non-trapping case is not yet implemented. + !module.config.disallow_traps && simd_v128_store_valid(module, builder) +} + +#[inline] +fn simd_enabled(module: &Module, _: &mut CodeBuilder) -> bool { + module.config.simd_enabled +} + +macro_rules! simd_load { + ($instruction:ident, $generator_fn_name:ident, $alignments:expr) => { + fn $generator_fn_name( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + + instructions: &mut Vec<Instruction>, + ) -> Result<()> { + let memarg = mem_arg(u, module, builder, $alignments)?; + builder.push_operands(&[ValType::V128]); + if module.config.disallow_traps { + no_traps::load( + Instruction::$instruction(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::$instruction(memarg)); + } + Ok(()) + } + }; +} + +simd_load!(V128Load, v128_load, &[0, 1, 2, 3, 4]); +simd_load!(V128Load8x8S, v128_load8x8s, &[0, 1, 2, 3]); +simd_load!(V128Load8x8U, v128_load8x8u, &[0, 1, 2, 3]); +simd_load!(V128Load16x4S, v128_load16x4s, &[0, 1, 2, 3]); +simd_load!(V128Load16x4U, v128_load16x4u, &[0, 1, 2, 3]); +simd_load!(V128Load32x2S, v128_load32x2s, &[0, 1, 2, 3]); +simd_load!(V128Load32x2U, v128_load32x2u, &[0, 1, 2, 3]); +simd_load!(V128Load8Splat, v128_load8_splat, &[0]); +simd_load!(V128Load16Splat, v128_load16_splat, &[0, 1]); +simd_load!(V128Load32Splat, v128_load32_splat, &[0, 1, 2]); +simd_load!(V128Load64Splat, v128_load64_splat, &[0, 1, 2, 3]); +simd_load!(V128Load32Zero, v128_load32_zero, &[0, 1, 2]); +simd_load!(V128Load64Zero, v128_load64_zero, &[0, 1, 2, 3]); + +fn v128_store( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::V128]); + let memarg = mem_arg(u, module, builder, &[0, 1, 2, 3, 4])?; + if module.config.disallow_traps { + no_traps::store( + Instruction::V128Store(memarg), + module, + builder, + instructions, + ); + } else { + instructions.push(Instruction::V128Store(memarg)); + } + Ok(()) +} + +macro_rules! simd_load_lane { + ($instruction:ident, $generator_fn_name:ident, $alignments:expr, $number_of_lanes:expr) => { + fn $generator_fn_name( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, + ) -> Result<()> { + builder.pop_operands(module, &[ValType::V128]); + let memarg = mem_arg(u, module, builder, $alignments)?; + builder.push_operands(&[ValType::V128]); + instructions.push(Instruction::$instruction { + memarg, + lane: lane_index(u, $number_of_lanes)?, + }); + Ok(()) + } + }; +} + +simd_load_lane!(V128Load8Lane, v128_load8_lane, &[0], 16); +simd_load_lane!(V128Load16Lane, v128_load16_lane, &[0, 1], 8); +simd_load_lane!(V128Load32Lane, v128_load32_lane, &[0, 1, 2], 4); +simd_load_lane!(V128Load64Lane, v128_load64_lane, &[0, 1, 2, 3], 2); + +macro_rules! simd_store_lane { + ($instruction:ident, $generator_fn_name:ident, $alignments:expr, $number_of_lanes:expr) => { + fn $generator_fn_name( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, + ) -> Result<()> { + builder.pop_operands(module, &[ValType::V128]); + let memarg = mem_arg(u, module, builder, $alignments)?; + instructions.push(Instruction::$instruction { + memarg, + lane: lane_index(u, $number_of_lanes)?, + }); + Ok(()) + } + }; +} + +simd_store_lane!(V128Store8Lane, v128_store8_lane, &[0], 16); +simd_store_lane!(V128Store16Lane, v128_store16_lane, &[0, 1], 8); +simd_store_lane!(V128Store32Lane, v128_store32_lane, &[0, 1, 2], 4); +simd_store_lane!(V128Store64Lane, v128_store64_lane, &[0, 1, 2, 3], 2); + +fn v128_const( + u: &mut Unstructured, + _module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.push_operands(&[ValType::V128]); + let c = i128::from_le_bytes(u.arbitrary()?); + instructions.push(Instruction::V128Const(c)); + Ok(()) +} + +fn i8x16_shuffle( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, +) -> Result<()> { + builder.pop_operands(module, &[ValType::V128, ValType::V128]); + builder.push_operands(&[ValType::V128]); + let mut lanes = [0; 16]; + for i in 0..16 { + lanes[i] = u.int_in_range(0..=31)?; + } + instructions.push(Instruction::I8x16Shuffle(lanes)); + Ok(()) +} + +macro_rules! simd_lane_access { + ($instruction:ident, $generator_fn_name:ident, $in_types:expr => $out_types:expr, $number_of_lanes:expr) => { + fn $generator_fn_name( + u: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + instructions: &mut Vec<Instruction>, + ) -> Result<()> { + builder.pop_operands(module, $in_types); + builder.push_operands($out_types); + instructions.push(Instruction::$instruction(lane_index(u, $number_of_lanes)?)); + Ok(()) + } + }; +} + +simd_lane_access!(I8x16ExtractLaneS, i8x16_extract_lane_s, &[ValType::V128] => &[ValType::I32], 16); +simd_lane_access!(I8x16ExtractLaneU, i8x16_extract_lane_u, &[ValType::V128] => &[ValType::I32], 16); +simd_lane_access!(I8x16ReplaceLane, i8x16_replace_lane, &[ValType::V128, ValType::I32] => &[ValType::V128], 16); +simd_lane_access!(I16x8ExtractLaneS, i16x8_extract_lane_s, &[ValType::V128] => &[ValType::I32], 8); +simd_lane_access!(I16x8ExtractLaneU, i16x8_extract_lane_u, &[ValType::V128] => &[ValType::I32], 8); +simd_lane_access!(I16x8ReplaceLane, i16x8_replace_lane, &[ValType::V128, ValType::I32] => &[ValType::V128], 8); +simd_lane_access!(I32x4ExtractLane, i32x4_extract_lane, &[ValType::V128] => &[ValType::I32], 4); +simd_lane_access!(I32x4ReplaceLane, i32x4_replace_lane, &[ValType::V128, ValType::I32] => &[ValType::V128], 4); +simd_lane_access!(I64x2ExtractLane, i64x2_extract_lane, &[ValType::V128] => &[ValType::I64], 2); +simd_lane_access!(I64x2ReplaceLane, i64x2_replace_lane, &[ValType::V128, ValType::I64] => &[ValType::V128], 2); +simd_lane_access!(F32x4ExtractLane, f32x4_extract_lane, &[ValType::V128] => &[ValType::F32], 4); +simd_lane_access!(F32x4ReplaceLane, f32x4_replace_lane, &[ValType::V128, ValType::F32] => &[ValType::V128], 4); +simd_lane_access!(F64x2ExtractLane, f64x2_extract_lane, &[ValType::V128] => &[ValType::F64], 2); +simd_lane_access!(F64x2ReplaceLane, f64x2_replace_lane, &[ValType::V128, ValType::F64] => &[ValType::V128], 2); + +macro_rules! simd_binop { + ($instruction:ident, $generator_fn_name:ident) => { + fn $generator_fn_name( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + + instructions: &mut Vec<Instruction>, + ) -> Result<()> { + builder.pop_operands(module, &[ValType::V128, ValType::V128]); + builder.push_operands(&[ValType::V128]); + instructions.push(Instruction::$instruction); + Ok(()) + } + }; +} + +macro_rules! simd_unop { + ($instruction:ident, $generator_fn_name:ident) => { + simd_unop!($instruction, $generator_fn_name, V128 -> V128); + }; + + ($instruction:ident, $generator_fn_name:ident, $in_type:ident -> $out_type:ident) => { + fn $generator_fn_name( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + + instructions: &mut Vec<Instruction>, ) -> Result<()> { + builder.pop_operands(module, &[ValType::$in_type]); + builder.push_operands(&[ValType::$out_type]); + instructions.push(Instruction::$instruction); + Ok(()) + } + }; +} + +macro_rules! simd_ternop { + ($instruction:ident, $generator_fn_name:ident) => { + fn $generator_fn_name( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + + instructions: &mut Vec<Instruction>, + ) -> Result<()> { + builder.pop_operands(module, &[ValType::V128, ValType::V128, ValType::V128]); + builder.push_operands(&[ValType::V128]); + instructions.push(Instruction::$instruction); + Ok(()) + } + }; +} + +macro_rules! simd_shift { + ($instruction:ident, $generator_fn_name:ident) => { + fn $generator_fn_name( + _: &mut Unstructured, + module: &Module, + builder: &mut CodeBuilder, + + instructions: &mut Vec<Instruction>, + ) -> Result<()> { + builder.pop_operands(module, &[ValType::V128, ValType::I32]); + builder.push_operands(&[ValType::V128]); + instructions.push(Instruction::$instruction); + Ok(()) + } + }; +} + +simd_unop!(I8x16Splat, i8x16_splat, I32 -> V128); +simd_unop!(I16x8Splat, i16x8_splat, I32 -> V128); +simd_unop!(I32x4Splat, i32x4_splat, I32 -> V128); +simd_unop!(I64x2Splat, i64x2_splat, I64 -> V128); +simd_unop!(F32x4Splat, f32x4_splat, F32 -> V128); +simd_unop!(F64x2Splat, f64x2_splat, F64 -> V128); +simd_binop!(I8x16Swizzle, i8x16_swizzle); +simd_binop!(I8x16Eq, i8x16_eq); +simd_binop!(I8x16Ne, i8x16_ne); +simd_binop!(I8x16LtS, i8x16_lt_s); +simd_binop!(I8x16LtU, i8x16_lt_u); +simd_binop!(I8x16GtS, i8x16_gt_s); +simd_binop!(I8x16GtU, i8x16_gt_u); +simd_binop!(I8x16LeS, i8x16_le_s); +simd_binop!(I8x16LeU, i8x16_le_u); +simd_binop!(I8x16GeS, i8x16_ge_s); +simd_binop!(I8x16GeU, i8x16_ge_u); +simd_binop!(I16x8Eq, i16x8_eq); +simd_binop!(I16x8Ne, i16x8_ne); +simd_binop!(I16x8LtS, i16x8_lt_s); +simd_binop!(I16x8LtU, i16x8_lt_u); +simd_binop!(I16x8GtS, i16x8_gt_s); +simd_binop!(I16x8GtU, i16x8_gt_u); +simd_binop!(I16x8LeS, i16x8_le_s); +simd_binop!(I16x8LeU, i16x8_le_u); +simd_binop!(I16x8GeS, i16x8_ge_s); +simd_binop!(I16x8GeU, i16x8_ge_u); +simd_binop!(I32x4Eq, i32x4_eq); +simd_binop!(I32x4Ne, i32x4_ne); +simd_binop!(I32x4LtS, i32x4_lt_s); +simd_binop!(I32x4LtU, i32x4_lt_u); +simd_binop!(I32x4GtS, i32x4_gt_s); +simd_binop!(I32x4GtU, i32x4_gt_u); +simd_binop!(I32x4LeS, i32x4_le_s); +simd_binop!(I32x4LeU, i32x4_le_u); +simd_binop!(I32x4GeS, i32x4_ge_s); +simd_binop!(I32x4GeU, i32x4_ge_u); +simd_binop!(I64x2Eq, i64x2_eq); +simd_binop!(I64x2Ne, i64x2_ne); +simd_binop!(I64x2LtS, i64x2_lt_s); +simd_binop!(I64x2GtS, i64x2_gt_s); +simd_binop!(I64x2LeS, i64x2_le_s); +simd_binop!(I64x2GeS, i64x2_ge_s); +simd_binop!(F32x4Eq, f32x4_eq); +simd_binop!(F32x4Ne, f32x4_ne); +simd_binop!(F32x4Lt, f32x4_lt); +simd_binop!(F32x4Gt, f32x4_gt); +simd_binop!(F32x4Le, f32x4_le); +simd_binop!(F32x4Ge, f32x4_ge); +simd_binop!(F64x2Eq, f64x2_eq); +simd_binop!(F64x2Ne, f64x2_ne); +simd_binop!(F64x2Lt, f64x2_lt); +simd_binop!(F64x2Gt, f64x2_gt); +simd_binop!(F64x2Le, f64x2_le); +simd_binop!(F64x2Ge, f64x2_ge); +simd_unop!(V128Not, v128_not); +simd_binop!(V128And, v128_and); +simd_binop!(V128AndNot, v128_and_not); +simd_binop!(V128Or, v128_or); +simd_binop!(V128Xor, v128_xor); +simd_unop!(V128AnyTrue, v128_any_true, V128 -> I32); +simd_unop!(I8x16Abs, i8x16_abs); +simd_unop!(I8x16Neg, i8x16_neg); +simd_unop!(I8x16Popcnt, i8x16_popcnt); +simd_unop!(I8x16AllTrue, i8x16_all_true, V128 -> I32); +simd_unop!(I8x16Bitmask, i8x16_bitmask, V128 -> I32); +simd_binop!(I8x16NarrowI16x8S, i8x16_narrow_i16x8s); +simd_binop!(I8x16NarrowI16x8U, i8x16_narrow_i16x8u); +simd_shift!(I8x16Shl, i8x16_shl); +simd_shift!(I8x16ShrS, i8x16_shr_s); +simd_shift!(I8x16ShrU, i8x16_shr_u); +simd_binop!(I8x16Add, i8x16_add); +simd_binop!(I8x16AddSatS, i8x16_add_sat_s); +simd_binop!(I8x16AddSatU, i8x16_add_sat_u); +simd_binop!(I8x16Sub, i8x16_sub); +simd_binop!(I8x16SubSatS, i8x16_sub_sat_s); +simd_binop!(I8x16SubSatU, i8x16_sub_sat_u); +simd_binop!(I8x16MinS, i8x16_min_s); +simd_binop!(I8x16MinU, i8x16_min_u); +simd_binop!(I8x16MaxS, i8x16_max_s); +simd_binop!(I8x16MaxU, i8x16_max_u); +simd_binop!(I8x16AvgrU, i8x16_avgr_u); +simd_unop!(I16x8ExtAddPairwiseI8x16S, i16x8_extadd_pairwise_i8x16s); +simd_unop!(I16x8ExtAddPairwiseI8x16U, i16x8_extadd_pairwise_i8x16u); +simd_unop!(I16x8Abs, i16x8_abs); +simd_unop!(I16x8Neg, i16x8_neg); +simd_binop!(I16x8Q15MulrSatS, i16x8q15_mulr_sat_s); +simd_unop!(I16x8AllTrue, i16x8_all_true, V128 -> I32); +simd_unop!(I16x8Bitmask, i16x8_bitmask, V128 -> I32); +simd_binop!(I16x8NarrowI32x4S, i16x8_narrow_i32x4s); +simd_binop!(I16x8NarrowI32x4U, i16x8_narrow_i32x4u); +simd_unop!(I16x8ExtendLowI8x16S, i16x8_extend_low_i8x16s); +simd_unop!(I16x8ExtendHighI8x16S, i16x8_extend_high_i8x16s); +simd_unop!(I16x8ExtendLowI8x16U, i16x8_extend_low_i8x16u); +simd_unop!(I16x8ExtendHighI8x16U, i16x8_extend_high_i8x16u); +simd_shift!(I16x8Shl, i16x8_shl); +simd_shift!(I16x8ShrS, i16x8_shr_s); +simd_shift!(I16x8ShrU, i16x8_shr_u); +simd_binop!(I16x8Add, i16x8_add); +simd_binop!(I16x8AddSatS, i16x8_add_sat_s); +simd_binop!(I16x8AddSatU, i16x8_add_sat_u); +simd_binop!(I16x8Sub, i16x8_sub); +simd_binop!(I16x8SubSatS, i16x8_sub_sat_s); +simd_binop!(I16x8SubSatU, i16x8_sub_sat_u); +simd_binop!(I16x8Mul, i16x8_mul); +simd_binop!(I16x8MinS, i16x8_min_s); +simd_binop!(I16x8MinU, i16x8_min_u); +simd_binop!(I16x8MaxS, i16x8_max_s); +simd_binop!(I16x8MaxU, i16x8_max_u); +simd_binop!(I16x8AvgrU, i16x8_avgr_u); +simd_binop!(I16x8ExtMulLowI8x16S, i16x8_extmul_low_i8x16s); +simd_binop!(I16x8ExtMulHighI8x16S, i16x8_extmul_high_i8x16s); +simd_binop!(I16x8ExtMulLowI8x16U, i16x8_extmul_low_i8x16u); +simd_binop!(I16x8ExtMulHighI8x16U, i16x8_extmul_high_i8x16u); +simd_unop!(I32x4ExtAddPairwiseI16x8S, i32x4_extadd_pairwise_i16x8s); +simd_unop!(I32x4ExtAddPairwiseI16x8U, i32x4_extadd_pairwise_i16x8u); +simd_unop!(I32x4Abs, i32x4_abs); +simd_unop!(I32x4Neg, i32x4_neg); +simd_unop!(I32x4AllTrue, i32x4_all_true, V128 -> I32); +simd_unop!(I32x4Bitmask, i32x4_bitmask, V128 -> I32); +simd_unop!(I32x4ExtendLowI16x8S, i32x4_extend_low_i16x8s); +simd_unop!(I32x4ExtendHighI16x8S, i32x4_extend_high_i16x8s); +simd_unop!(I32x4ExtendLowI16x8U, i32x4_extend_low_i16x8u); +simd_unop!(I32x4ExtendHighI16x8U, i32x4_extend_high_i16x8u); +simd_shift!(I32x4Shl, i32x4_shl); +simd_shift!(I32x4ShrS, i32x4_shr_s); +simd_shift!(I32x4ShrU, i32x4_shr_u); +simd_binop!(I32x4Add, i32x4_add); +simd_binop!(I32x4Sub, i32x4_sub); +simd_binop!(I32x4Mul, i32x4_mul); +simd_binop!(I32x4MinS, i32x4_min_s); +simd_binop!(I32x4MinU, i32x4_min_u); +simd_binop!(I32x4MaxS, i32x4_max_s); +simd_binop!(I32x4MaxU, i32x4_max_u); +simd_binop!(I32x4DotI16x8S, i32x4_dot_i16x8s); +simd_binop!(I32x4ExtMulLowI16x8S, i32x4_extmul_low_i16x8s); +simd_binop!(I32x4ExtMulHighI16x8S, i32x4_extmul_high_i16x8s); +simd_binop!(I32x4ExtMulLowI16x8U, i32x4_extmul_low_i16x8u); +simd_binop!(I32x4ExtMulHighI16x8U, i32x4_extmul_high_i16x8u); +simd_unop!(I64x2Abs, i64x2_abs); +simd_unop!(I64x2Neg, i64x2_neg); +simd_unop!(I64x2AllTrue, i64x2_all_true, V128 -> I32); +simd_unop!(I64x2Bitmask, i64x2_bitmask, V128 -> I32); +simd_unop!(I64x2ExtendLowI32x4S, i64x2_extend_low_i32x4s); +simd_unop!(I64x2ExtendHighI32x4S, i64x2_extend_high_i32x4s); +simd_unop!(I64x2ExtendLowI32x4U, i64x2_extend_low_i32x4u); +simd_unop!(I64x2ExtendHighI32x4U, i64x2_extend_high_i32x4u); +simd_shift!(I64x2Shl, i64x2_shl); +simd_shift!(I64x2ShrS, i64x2_shr_s); +simd_shift!(I64x2ShrU, i64x2_shr_u); +simd_binop!(I64x2Add, i64x2_add); +simd_binop!(I64x2Sub, i64x2_sub); +simd_binop!(I64x2Mul, i64x2_mul); +simd_binop!(I64x2ExtMulLowI32x4S, i64x2_extmul_low_i32x4s); +simd_binop!(I64x2ExtMulHighI32x4S, i64x2_extmul_high_i32x4s); +simd_binop!(I64x2ExtMulLowI32x4U, i64x2_extmul_low_i32x4u); +simd_binop!(I64x2ExtMulHighI32x4U, i64x2_extmul_high_i32x4u); +simd_unop!(F32x4Ceil, f32x4_ceil); +simd_unop!(F32x4Floor, f32x4_floor); +simd_unop!(F32x4Trunc, f32x4_trunc); +simd_unop!(F32x4Nearest, f32x4_nearest); +simd_unop!(F32x4Abs, f32x4_abs); +simd_unop!(F32x4Neg, f32x4_neg); +simd_unop!(F32x4Sqrt, f32x4_sqrt); +simd_binop!(F32x4Add, f32x4_add); +simd_binop!(F32x4Sub, f32x4_sub); +simd_binop!(F32x4Mul, f32x4_mul); +simd_binop!(F32x4Div, f32x4_div); +simd_binop!(F32x4Min, f32x4_min); +simd_binop!(F32x4Max, f32x4_max); +simd_binop!(F32x4PMin, f32x4p_min); +simd_binop!(F32x4PMax, f32x4p_max); +simd_unop!(F64x2Ceil, f64x2_ceil); +simd_unop!(F64x2Floor, f64x2_floor); +simd_unop!(F64x2Trunc, f64x2_trunc); +simd_unop!(F64x2Nearest, f64x2_nearest); +simd_unop!(F64x2Abs, f64x2_abs); +simd_unop!(F64x2Neg, f64x2_neg); +simd_unop!(F64x2Sqrt, f64x2_sqrt); +simd_binop!(F64x2Add, f64x2_add); +simd_binop!(F64x2Sub, f64x2_sub); +simd_binop!(F64x2Mul, f64x2_mul); +simd_binop!(F64x2Div, f64x2_div); +simd_binop!(F64x2Min, f64x2_min); +simd_binop!(F64x2Max, f64x2_max); +simd_binop!(F64x2PMin, f64x2p_min); +simd_binop!(F64x2PMax, f64x2p_max); +simd_unop!(I32x4TruncSatF32x4S, i32x4_trunc_sat_f32x4s); +simd_unop!(I32x4TruncSatF32x4U, i32x4_trunc_sat_f32x4u); +simd_unop!(F32x4ConvertI32x4S, f32x4_convert_i32x4s); +simd_unop!(F32x4ConvertI32x4U, f32x4_convert_i32x4u); +simd_unop!(I32x4TruncSatF64x2SZero, i32x4_trunc_sat_f64x2s_zero); +simd_unop!(I32x4TruncSatF64x2UZero, i32x4_trunc_sat_f64x2u_zero); +simd_unop!(F64x2ConvertLowI32x4S, f64x2_convert_low_i32x4s); +simd_unop!(F64x2ConvertLowI32x4U, f64x2_convert_low_i32x4u); +simd_unop!(F32x4DemoteF64x2Zero, f32x4_demote_f64x2_zero); +simd_unop!(F64x2PromoteLowF32x4, f64x2_promote_low_f32x4); +simd_ternop!(V128Bitselect, v128_bitselect); +simd_binop!(I8x16RelaxedSwizzle, i8x16_relaxed_swizzle); +simd_unop!(I32x4RelaxedTruncF32x4S, i32x4_relaxed_trunc_f32x4s); +simd_unop!(I32x4RelaxedTruncF32x4U, i32x4_relaxed_trunc_f32x4u); +simd_unop!(I32x4RelaxedTruncF64x2SZero, i32x4_relaxed_trunc_f64x2s_zero); +simd_unop!(I32x4RelaxedTruncF64x2UZero, i32x4_relaxed_trunc_f64x2u_zero); +simd_ternop!(F32x4RelaxedMadd, f32x4_relaxed_madd); +simd_ternop!(F32x4RelaxedNmadd, f32x4_relaxed_nmadd); +simd_ternop!(F64x2RelaxedMadd, f64x2_relaxed_madd); +simd_ternop!(F64x2RelaxedNmadd, f64x2_relaxed_nmadd); +simd_ternop!(I8x16RelaxedLaneselect, i8x16_relaxed_laneselect); +simd_ternop!(I16x8RelaxedLaneselect, i16x8_relaxed_laneselect); +simd_ternop!(I32x4RelaxedLaneselect, i32x4_relaxed_laneselect); +simd_ternop!(I64x2RelaxedLaneselect, i64x2_relaxed_laneselect); +simd_binop!(F32x4RelaxedMin, f32x4_relaxed_min); +simd_binop!(F32x4RelaxedMax, f32x4_relaxed_max); +simd_binop!(F64x2RelaxedMin, f64x2_relaxed_min); +simd_binop!(F64x2RelaxedMax, f64x2_relaxed_max); +simd_binop!(I16x8RelaxedQ15mulrS, i16x8_relaxed_q15mulr_s); +simd_binop!(I16x8RelaxedDotI8x16I7x16S, i16x8_relaxed_dot_i8x16_i7x16_s); +simd_ternop!( + I32x4RelaxedDotI8x16I7x16AddS, + i32x4_relaxed_dot_i8x16_i7x16_add_s +); diff --git a/third_party/rust/wasm-smith/src/core/code_builder/no_traps.rs b/third_party/rust/wasm-smith/src/core/code_builder/no_traps.rs new file mode 100644 index 0000000000..a1232b6922 --- /dev/null +++ b/third_party/rust/wasm-smith/src/core/code_builder/no_traps.rs @@ -0,0 +1,644 @@ +use crate::core::*; +use wasm_encoder::{BlockType, Instruction, ValType}; + +use super::CodeBuilder; + +// For loads, we dynamically check whether the load will +// trap, and if it will then we generate a dummy value to +// use instead. +pub(crate) fn load<'a>( + inst: Instruction<'a>, + module: &Module, + builder: &mut CodeBuilder, + insts: &mut Vec<Instruction<'a>>, +) { + let memarg = get_memarg(&inst); + let memory = &module.memories[memarg.memory_index as usize]; + let address_type = if memory.memory64 { + ValType::I64 + } else { + ValType::I32 + }; + // Add a temporary local to hold this load's address. + let address_local = builder.alloc_local(address_type); + + // Add a temporary local to hold the result of this load. + let load_type = type_of_memory_access(&inst); + let result_local = builder.alloc_local(load_type); + + // [address:address_type] + insts.push(Instruction::LocalSet(address_local)); + // [] + insts.push(Instruction::Block(wasm_encoder::BlockType::Empty)); + { + // [] + insts.push(Instruction::Block(wasm_encoder::BlockType::Empty)); + { + // [] + insts.push(Instruction::MemorySize(memarg.memory_index)); + // [mem_size_in_pages:address_type] + insts.push(int_const_inst(address_type, 65_536)); + // [mem_size_in_pages:address_type wasm_page_size:address_type] + insts.push(int_mul_inst(address_type)); + // [mem_size_in_bytes:address_type] + insts.push(int_const_inst( + address_type, + (memarg.offset + size_of_type_in_memory(load_type)) as i64, + )); + // [mem_size_in_bytes:address_type offset_and_size:address_type] + insts.push(Instruction::LocalGet(address_local)); + // [mem_size_in_bytes:address_type offset_and_size:address_type address:address_type] + insts.push(int_add_inst(address_type)); + // [mem_size_in_bytes:address_type highest_byte_accessed:address_type] + insts.push(int_le_u_inst(address_type)); + // [load_will_trap:i32] + insts.push(Instruction::BrIf(0)); + // [] + insts.push(Instruction::LocalGet(address_local)); + // [address:address_type] + insts.push(int_const_inst(address_type, 0)); + // [address:address_type 0:address_type] + insts.push(int_le_s_inst(address_type)); + // [load_will_trap:i32] + insts.push(Instruction::BrIf(0)); + // [] + insts.push(Instruction::LocalGet(address_local)); + // [address:address_type] + insts.push(inst); + // [result:load_type] + insts.push(Instruction::LocalSet(result_local)); + // [] + insts.push(Instruction::Br(1)); + // <unreachable> + } + // [] + insts.push(Instruction::End); + // [] + insts.push(dummy_value_inst(load_type)); + // [dummy_value:load_type] + insts.push(Instruction::LocalSet(result_local)); + // [] + } + // [] + insts.push(Instruction::End); + // [] + insts.push(Instruction::LocalGet(result_local)); + // [result:load_type] +} + +// Stores are similar to loads: we check whether the store +// will trap, and if it will then we just drop the value. +pub(crate) fn store<'a>( + inst: Instruction<'a>, + module: &Module, + builder: &mut CodeBuilder, + insts: &mut Vec<Instruction<'a>>, +) { + let memarg = get_memarg(&inst); + let memory = &module.memories[memarg.memory_index as usize]; + let address_type = if memory.memory64 { + ValType::I64 + } else { + ValType::I32 + }; + + // Add a temporary local to hold this store's address. + let address_local = builder.alloc_local(address_type); + + // Add a temporary local to hold the value to store. + let store_type = type_of_memory_access(&inst); + let value_local = builder.alloc_local(store_type); + + // [address:address_type value:store_type] + insts.push(Instruction::LocalSet(value_local)); + // [address:address_type] + insts.push(Instruction::LocalSet(address_local)); + // [] + insts.push(Instruction::MemorySize(memarg.memory_index)); + // [mem_size_in_pages:address_type] + insts.push(int_const_inst(address_type, 65_536)); + // [mem_size_in_pages:address_type wasm_page_size:address_type] + insts.push(int_mul_inst(address_type)); + // [mem_size_in_bytes:address_type] + insts.push(int_const_inst( + address_type, + (memarg.offset + size_of_type_in_memory(store_type)) as i64, + )); + // [mem_size_in_bytes:address_type offset_and_size:address_type] + insts.push(Instruction::LocalGet(address_local)); + // [mem_size_in_bytes:address_type offset_and_size:address_type address:address_type] + insts.push(int_add_inst(address_type)); + // [mem_size_in_bytes:address_type highest_byte_accessed:address_type] + insts.push(int_le_u_inst(address_type)); + // [store_will_trap:i32] + insts.push(Instruction::If(BlockType::Empty)); + insts.push(Instruction::Else); + { + // [] + insts.push(Instruction::LocalGet(address_local)); + // [address:address_type] + insts.push(int_const_inst(address_type, 0)); + // [address:address_type 0:address_type] + insts.push(int_le_s_inst(address_type)); + // [load_will_trap:i32] + insts.push(Instruction::If(BlockType::Empty)); + insts.push(Instruction::Else); + { + // [] + insts.push(Instruction::LocalGet(address_local)); + // [address:address_type] + insts.push(Instruction::LocalGet(value_local)); + // [address:address_type value:store_type] + insts.push(inst); + // [] + } + insts.push(Instruction::End); + } + // [] + insts.push(Instruction::End); +} + +// Unsigned integer division and remainder will trap when +// the divisor is 0. To avoid the trap, we will set any 0 +// divisors to 1 prior to the operation. +// +// The code below is equivalent to this expression: +// +// local.set $temp_divisor +// (select (i32.eqz (local.get $temp_divisor) (i32.const 1) (local.get $temp_divisor)) +pub(crate) fn unsigned_div_rem<'a>( + inst: Instruction<'a>, + builder: &mut CodeBuilder, + insts: &mut Vec<Instruction<'a>>, +) { + let op_type = type_of_integer_operation(&inst); + let temp_divisor = builder.alloc_local(op_type); + + // [dividend:op_type divisor:op_type] + insts.push(Instruction::LocalSet(temp_divisor)); + // [dividend:op_type] + insts.push(int_const_inst(op_type, 1)); + // [dividend:op_type 1:op_type] + insts.push(Instruction::LocalGet(temp_divisor)); + // [dividend:op_type 1:op_type divisor:op_type] + insts.push(Instruction::LocalGet(temp_divisor)); + // [dividend:op_type 1:op_type divisor:op_type divisor:op_type] + insts.push(eqz_inst(op_type)); + // [dividend:op_type 1:op_type divisor:op_type is_zero:i32] + insts.push(Instruction::Select); + // [dividend:op_type divisor:op_type] + insts.push(inst); + // [result:op_type] +} + +pub(crate) fn trunc<'a>( + inst: Instruction<'a>, + builder: &mut CodeBuilder, + insts: &mut Vec<Instruction<'a>>, +) { + // If NaN or ±inf, replace with dummy value. Our method of checking for NaN + // is to use `ne` because NaN is the only value that is not equal to itself + let conv_type = type_of_float_conversion(&inst); + let temp_float = builder.alloc_local(conv_type); + // [input:conv_type] + insts.push(Instruction::LocalTee(temp_float)); + // [input:conv_type] + insts.push(Instruction::LocalGet(temp_float)); + // [input:conv_type input:conv_type] + insts.push(ne_inst(conv_type)); + // [is_nan:i32] + insts.push(Instruction::LocalGet(temp_float)); + // [is_nan:i32 input:conv_type] + insts.push(flt_inf_const_inst(conv_type)); + // [is_nan:i32 input:conv_type inf:conv_type] + insts.push(eq_inst(conv_type)); + // [is_nan:i32 is_inf:i32] + insts.push(Instruction::LocalGet(temp_float)); + // [is_nan:i32 is_inf:i32 input:conv_type] + insts.push(flt_neg_inf_const_inst(conv_type)); + // [is_nan:i32 is_inf:i32 input:conv_type neg_inf:conv_type] + insts.push(eq_inst(conv_type)); + // [is_nan:i32 is_inf:i32 is_neg_inf:i32] + insts.push(Instruction::I32Or); + // [is_nan:i32 is_±inf:i32] + insts.push(Instruction::I32Or); + // [is_nan_or_inf:i32] + insts.push(Instruction::If(BlockType::Empty)); + { + // [] + insts.push(dummy_value_inst(conv_type)); + // [0:conv_type] + insts.push(Instruction::LocalSet(temp_float)); + // [] + } + insts.push(Instruction::End); + // [] + insts.push(Instruction::LocalGet(temp_float)); + // [input_or_0:conv_type] + + // first ensure that it is >= the min value of our target type + insts.push(min_input_const_for_trunc(&inst)); + // [input_or_0:conv_type min_value_of_target_type:conv_type] + insts.push(flt_lt_inst(conv_type)); + // [input_lt_min:i32] + insts.push(Instruction::If(BlockType::Empty)); + { + // [] + insts.push(min_input_const_for_trunc(&inst)); + // [min_value_of_target_type:conv_type] + insts.push(Instruction::LocalSet(temp_float)); + } + insts.push(Instruction::End); + // [] + insts.push(Instruction::LocalGet(temp_float)); + // [coerced_input:conv_type] + + // next ensure that it is <= the max value of our target type + insts.push(max_input_const_for_trunc(&inst)); + // [input_or_0:conv_type max_value_of_target_type:conv_type] + insts.push(flt_gt_inst(conv_type)); + // [input_gt_min:i32] + insts.push(Instruction::If(BlockType::Empty)); + { + // [] + insts.push(max_input_const_for_trunc(&inst)); + // [max_value_of_target_type:conv_type] + insts.push(Instruction::LocalSet(temp_float)); + } + insts.push(Instruction::End); + // [] + insts.push(Instruction::LocalGet(temp_float)); + // [coerced_input:conv_type] + insts.push(inst); +} + +// Signed division and remainder will trap in the following instances: +// - The divisor is 0 +// - The result of the division is 2^(n-1) +pub(crate) fn signed_div_rem<'a>( + inst: Instruction<'a>, + builder: &mut CodeBuilder, + insts: &mut Vec<Instruction<'a>>, +) { + // If divisor is 0, replace with 1 + let op_type = type_of_integer_operation(&inst); + let temp_divisor = builder.alloc_local(op_type); + // [dividend:op_type divisor:op_type] + insts.push(Instruction::LocalSet(temp_divisor)); + // [dividend:op_type] + insts.push(int_const_inst(op_type, 1)); + // [dividend:op_type 1:op_type] + insts.push(Instruction::LocalGet(temp_divisor)); + // [dividend:op_type 1:op_type divisor:op_type] + insts.push(Instruction::LocalGet(temp_divisor)); + // [dividend:op_type 1:op_type divisor:op_type divisor:op_type] + insts.push(eqz_inst(op_type)); + // [dividend:op_type 1:op_type divisor:op_type is_zero:i32] + insts.push(Instruction::Select); + // [dividend:op_type divisor:op_type] + // If dividend and divisor are -int.max and -1, replace + // divisor with 1. + let temp_dividend = builder.alloc_local(op_type); + insts.push(Instruction::LocalSet(temp_divisor)); + // [dividend:op_type] + insts.push(Instruction::LocalSet(temp_dividend)); + // [] + insts.push(Instruction::Block(wasm_encoder::BlockType::Empty)); + { + insts.push(Instruction::Block(wasm_encoder::BlockType::Empty)); + { + // [] + insts.push(Instruction::LocalGet(temp_dividend)); + // [dividend:op_type] + insts.push(Instruction::LocalGet(temp_divisor)); + // [dividend:op_type divisor:op_type] + insts.push(Instruction::LocalSet(temp_divisor)); + // [dividend:op_type] + insts.push(Instruction::LocalTee(temp_dividend)); + // [dividend:op_type] + insts.push(int_min_const_inst(op_type)); + // [dividend:op_type int_min:op_type] + insts.push(ne_inst(op_type)); + // [not_int_min:i32] + insts.push(Instruction::BrIf(0)); + // [] + insts.push(Instruction::LocalGet(temp_divisor)); + // [divisor:op_type] + insts.push(int_const_inst(op_type, -1)); + // [divisor:op_type -1:op_type] + insts.push(ne_inst(op_type)); + // [not_neg_one:i32] + insts.push(Instruction::BrIf(0)); + // [] + insts.push(int_const_inst(op_type, 1)); + // [divisor:op_type] + insts.push(Instruction::LocalSet(temp_divisor)); + // [] + insts.push(Instruction::Br(1)); + } + // [] + insts.push(Instruction::End); + } + // [] + insts.push(Instruction::End); + // [] + insts.push(Instruction::LocalGet(temp_dividend)); + // [dividend:op_type] + insts.push(Instruction::LocalGet(temp_divisor)); + // [dividend:op_type divisor:op_type] + insts.push(inst); +} + +fn get_memarg(inst: &Instruction) -> wasm_encoder::MemArg { + match *inst { + Instruction::I32Load(memarg) + | Instruction::I64Load(memarg) + | Instruction::F32Load(memarg) + | Instruction::F64Load(memarg) + | Instruction::I32Load8S(memarg) + | Instruction::I32Load8U(memarg) + | Instruction::I32Load16S(memarg) + | Instruction::I32Load16U(memarg) + | Instruction::I64Load8S(memarg) + | Instruction::I64Load8U(memarg) + | Instruction::I64Load16S(memarg) + | Instruction::I64Load16U(memarg) + | Instruction::I64Load32S(memarg) + | Instruction::I64Load32U(memarg) + | Instruction::V128Load(memarg) + | Instruction::V128Load8x8S(memarg) + | Instruction::V128Load8x8U(memarg) + | Instruction::V128Load16x4S(memarg) + | Instruction::V128Load16x4U(memarg) + | Instruction::V128Load32x2S(memarg) + | Instruction::V128Load32x2U(memarg) + | Instruction::V128Load8Splat(memarg) + | Instruction::V128Load16Splat(memarg) + | Instruction::V128Load32Splat(memarg) + | Instruction::V128Load64Splat(memarg) + | Instruction::V128Load32Zero(memarg) + | Instruction::V128Load64Zero(memarg) + | Instruction::I32Store(memarg) + | Instruction::I64Store(memarg) + | Instruction::F32Store(memarg) + | Instruction::F64Store(memarg) + | Instruction::I32Store8(memarg) + | Instruction::I32Store16(memarg) + | Instruction::I64Store8(memarg) + | Instruction::I64Store16(memarg) + | Instruction::I64Store32(memarg) + | Instruction::V128Store(memarg) => memarg, + _ => unreachable!(), + } +} + +fn dummy_value_inst<'a>(ty: ValType) -> Instruction<'a> { + match ty { + ValType::I32 => Instruction::I32Const(0), + ValType::I64 => Instruction::I64Const(0), + ValType::F32 => Instruction::F32Const(0.0), + ValType::F64 => Instruction::F64Const(0.0), + ValType::V128 => Instruction::V128Const(0), + ValType::Ref(ty) => { + assert!(ty.nullable); + Instruction::RefNull(ty.heap_type) + } + } +} + +fn eq_inst<'a>(ty: ValType) -> Instruction<'a> { + match ty { + ValType::F32 => Instruction::F32Eq, + ValType::F64 => Instruction::F64Eq, + ValType::I32 => Instruction::I32Eq, + ValType::I64 => Instruction::I64Eq, + _ => panic!("not a numeric type"), + } +} + +fn eqz_inst<'a>(ty: ValType) -> Instruction<'a> { + match ty { + ValType::I32 => Instruction::I32Eqz, + ValType::I64 => Instruction::I64Eqz, + _ => panic!("not an integer type"), + } +} + +fn type_of_integer_operation(inst: &Instruction) -> ValType { + match inst { + Instruction::I32DivU + | Instruction::I32DivS + | Instruction::I32RemU + | Instruction::I32RemS => ValType::I32, + Instruction::I64RemU + | Instruction::I64DivU + | Instruction::I64DivS + | Instruction::I64RemS => ValType::I64, + _ => panic!("not integer division or remainder"), + } +} + +fn type_of_float_conversion(inst: &Instruction) -> ValType { + match inst { + Instruction::I32TruncF32S + | Instruction::I32TruncF32U + | Instruction::I64TruncF32S + | Instruction::I64TruncF32U => ValType::F32, + Instruction::I32TruncF64S + | Instruction::I32TruncF64U + | Instruction::I64TruncF64S + | Instruction::I64TruncF64U => ValType::F64, + _ => panic!("not a float -> integer conversion"), + } +} + +fn min_input_const_for_trunc<'a>(inst: &Instruction) -> Instruction<'a> { + // This is the minimum float value that is representable as an i64 + let min_f64 = -9_223_372_036_854_775_000f64; + let min_f32 = -9_223_372_000_000_000_000f32; + + // This is the minimum float value that is representable as as i32 + let min_f32_as_i32 = -2_147_483_500f32; + match inst { + Instruction::I32TruncF32S => Instruction::F32Const(min_f32_as_i32), + Instruction::I32TruncF32U => Instruction::F32Const(0.0), + Instruction::I64TruncF32S => Instruction::F32Const(min_f32), + Instruction::I64TruncF32U => Instruction::F32Const(0.0), + Instruction::I32TruncF64S => Instruction::F64Const(i32::MIN as f64), + Instruction::I32TruncF64U => Instruction::F64Const(0.0), + Instruction::I64TruncF64S => Instruction::F64Const(min_f64), + Instruction::I64TruncF64U => Instruction::F64Const(0.0), + _ => panic!("not a trunc instruction"), + } +} + +fn max_input_const_for_trunc<'a>(inst: &Instruction) -> Instruction<'a> { + // This is the maximum float value that is representable as as i64 + let max_f64_as_i64 = 9_223_372_036_854_775_000f64; + let max_f32_as_i64 = 9_223_371_500_000_000_000f32; + + // This is the maximum float value that is representable as as i32 + let max_f32_as_i32 = 2_147_483_500f32; + match inst { + Instruction::I32TruncF32S | Instruction::I32TruncF32U => { + Instruction::F32Const(max_f32_as_i32) + } + Instruction::I64TruncF32S | Instruction::I64TruncF32U => { + Instruction::F32Const(max_f32_as_i64) + } + Instruction::I32TruncF64S | Instruction::I32TruncF64U => { + Instruction::F64Const(i32::MAX as f64) + } + Instruction::I64TruncF64S | Instruction::I64TruncF64U => { + Instruction::F64Const(max_f64_as_i64) + } + _ => panic!("not a trunc instruction"), + } +} + +fn type_of_memory_access(inst: &Instruction) -> ValType { + match inst { + Instruction::I32Load(_) + | Instruction::I32Load8S(_) + | Instruction::I32Load8U(_) + | Instruction::I32Load16S(_) + | Instruction::I32Load16U(_) + | Instruction::I32Store(_) + | Instruction::I32Store8(_) + | Instruction::I32Store16(_) => ValType::I32, + + Instruction::I64Load(_) + | Instruction::I64Load8S(_) + | Instruction::I64Load8U(_) + | Instruction::I64Load16S(_) + | Instruction::I64Load16U(_) + | Instruction::I64Load32S(_) + | Instruction::I64Load32U(_) + | Instruction::I64Store(_) + | Instruction::I64Store8(_) + | Instruction::I64Store16(_) + | Instruction::I64Store32(_) => ValType::I64, + + Instruction::F32Load(_) | Instruction::F32Store(_) => ValType::F32, + + Instruction::F64Load(_) | Instruction::F64Store(_) => ValType::F64, + + Instruction::V128Load { .. } + | Instruction::V128Load8x8S { .. } + | Instruction::V128Load8x8U { .. } + | Instruction::V128Load16x4S { .. } + | Instruction::V128Load16x4U { .. } + | Instruction::V128Load32x2S { .. } + | Instruction::V128Load32x2U { .. } + | Instruction::V128Load8Splat { .. } + | Instruction::V128Load16Splat { .. } + | Instruction::V128Load32Splat { .. } + | Instruction::V128Load64Splat { .. } + | Instruction::V128Load32Zero { .. } + | Instruction::V128Load64Zero { .. } + | Instruction::V128Store { .. } => ValType::V128, + + _ => panic!("not a memory access instruction"), + } +} + +fn int_min_const_inst<'a>(ty: ValType) -> Instruction<'a> { + match ty { + ValType::I32 => Instruction::I32Const(i32::MIN), + ValType::I64 => Instruction::I64Const(i64::MIN), + _ => panic!("not an int type"), + } +} + +fn int_const_inst<'a>(ty: ValType, x: i64) -> Instruction<'a> { + match ty { + ValType::I32 => Instruction::I32Const(x as i32), + ValType::I64 => Instruction::I64Const(x), + _ => panic!("not an int type"), + } +} + +fn int_mul_inst<'a>(ty: ValType) -> Instruction<'a> { + match ty { + ValType::I32 => Instruction::I32Mul, + ValType::I64 => Instruction::I64Mul, + _ => panic!("not an int type"), + } +} + +fn int_add_inst<'a>(ty: ValType) -> Instruction<'a> { + match ty { + ValType::I32 => Instruction::I32Add, + ValType::I64 => Instruction::I64Add, + _ => panic!("not an int type"), + } +} + +fn int_le_u_inst<'a>(ty: ValType) -> Instruction<'a> { + match ty { + ValType::I32 => Instruction::I32LeU, + ValType::I64 => Instruction::I64LeU, + _ => panic!("not an int type"), + } +} + +fn int_le_s_inst<'a>(ty: ValType) -> Instruction<'a> { + match ty { + ValType::I32 => Instruction::I32LeS, + ValType::I64 => Instruction::I64LeS, + _ => panic!("not an int type"), + } +} + +fn ne_inst<'a>(ty: ValType) -> Instruction<'a> { + match ty { + ValType::I32 => Instruction::I32Ne, + ValType::I64 => Instruction::I64Ne, + ValType::F32 => Instruction::F32Ne, + ValType::F64 => Instruction::F64Ne, + _ => panic!("not a numeric type"), + } +} + +fn flt_lt_inst<'a>(ty: ValType) -> Instruction<'a> { + match ty { + ValType::F32 => Instruction::F32Lt, + ValType::F64 => Instruction::F64Lt, + _ => panic!("not a float type"), + } +} + +fn flt_gt_inst<'a>(ty: ValType) -> Instruction<'a> { + match ty { + ValType::F32 => Instruction::F32Gt, + ValType::F64 => Instruction::F64Gt, + _ => panic!("not a float type"), + } +} + +fn flt_inf_const_inst<'a>(ty: ValType) -> Instruction<'a> { + match ty { + ValType::F32 => Instruction::F32Const(f32::INFINITY), + ValType::F64 => Instruction::F64Const(f64::INFINITY), + _ => panic!("not a float type"), + } +} + +fn flt_neg_inf_const_inst<'a>(ty: ValType) -> Instruction<'a> { + match ty { + ValType::F32 => Instruction::F32Const(f32::NEG_INFINITY), + ValType::F64 => Instruction::F64Const(f64::NEG_INFINITY), + _ => panic!("not a float type"), + } +} + +fn size_of_type_in_memory(ty: ValType) -> u64 { + match ty { + ValType::I32 => 4, + ValType::I64 => 8, + ValType::F32 => 4, + ValType::F64 => 8, + ValType::V128 => 16, + ValType::Ref(_) => panic!("not a memory type"), + } +} diff --git a/third_party/rust/wasm-smith/src/core/encode.rs b/third_party/rust/wasm-smith/src/core/encode.rs new file mode 100644 index 0000000000..7c781dc731 --- /dev/null +++ b/third_party/rust/wasm-smith/src/core/encode.rs @@ -0,0 +1,299 @@ +use super::*; +use std::convert::TryFrom; + +impl Module { + /// Encode this Wasm module into bytes. + pub fn to_bytes(&self) -> Vec<u8> { + self.encoded().finish() + } + + fn encoded(&self) -> wasm_encoder::Module { + let mut module = wasm_encoder::Module::new(); + + self.encode_types(&mut module); + self.encode_imports(&mut module); + self.encode_funcs(&mut module); + self.encode_tables(&mut module); + self.encode_memories(&mut module); + self.encode_tags(&mut module); + self.encode_globals(&mut module); + self.encode_exports(&mut module); + self.encode_start(&mut module); + self.encode_elems(&mut module); + self.encode_data_count(&mut module); + self.encode_code(&mut module); + self.encode_data(&mut module); + + module + } + + fn encode_types(&self, module: &mut wasm_encoder::Module) { + if !self.should_encode_types { + return; + } + + let mut section = wasm_encoder::TypeSection::new(); + + for group in &self.rec_groups { + if group.end - group.start == 1 { + let ty = &self.types[group.start]; + section.subtype(&wasm_encoder::SubType { + is_final: ty.is_final, + supertype_idx: ty.supertype, + composite_type: match &ty.composite_type { + CompositeType::Array(a) => wasm_encoder::CompositeType::Array(a.clone()), + CompositeType::Func(f) => { + wasm_encoder::CompositeType::Func(wasm_encoder::FuncType::new( + f.params.iter().cloned(), + f.results.iter().cloned(), + )) + } + CompositeType::Struct(s) => wasm_encoder::CompositeType::Struct(s.clone()), + }, + }); + } else { + section.rec( + self.types[group.clone()] + .iter() + .map(|ty| wasm_encoder::SubType { + is_final: ty.is_final, + supertype_idx: ty.supertype, + composite_type: match &ty.composite_type { + CompositeType::Array(a) => { + wasm_encoder::CompositeType::Array(a.clone()) + } + CompositeType::Func(f) => { + wasm_encoder::CompositeType::Func(wasm_encoder::FuncType::new( + f.params.iter().cloned(), + f.results.iter().cloned(), + )) + } + CompositeType::Struct(s) => { + wasm_encoder::CompositeType::Struct(s.clone()) + } + }, + }), + ); + } + } + + module.section(§ion); + } + + fn encode_imports(&self, module: &mut wasm_encoder::Module) { + if !self.should_encode_imports { + return; + } + + let mut section = wasm_encoder::ImportSection::new(); + for im in &self.imports { + section.import( + &im.module, + &im.field, + translate_entity_type(&im.entity_type), + ); + } + module.section(§ion); + } + + fn encode_tags(&self, module: &mut wasm_encoder::Module) { + if self.num_defined_tags == 0 { + return; + } + let mut tags = wasm_encoder::TagSection::new(); + for tag in self.tags[self.tags.len() - self.num_defined_tags..].iter() { + tags.tag(wasm_encoder::TagType { + kind: wasm_encoder::TagKind::Exception, + func_type_idx: tag.func_type_idx, + }); + } + module.section(&tags); + } + + fn encode_funcs(&self, module: &mut wasm_encoder::Module) { + if self.num_defined_funcs == 0 { + return; + } + let mut funcs = wasm_encoder::FunctionSection::new(); + for (ty, _) in self.funcs[self.funcs.len() - self.num_defined_funcs..].iter() { + funcs.function(*ty); + } + module.section(&funcs); + } + + fn encode_tables(&self, module: &mut wasm_encoder::Module) { + if self.num_defined_tables == 0 { + return; + } + let mut tables = wasm_encoder::TableSection::new(); + for t in self.tables[self.tables.len() - self.num_defined_tables..].iter() { + tables.table(*t); + } + module.section(&tables); + } + + fn encode_memories(&self, module: &mut wasm_encoder::Module) { + if self.num_defined_memories == 0 { + return; + } + let mut mems = wasm_encoder::MemorySection::new(); + for m in self.memories[self.memories.len() - self.num_defined_memories..].iter() { + mems.memory(*m); + } + module.section(&mems); + } + + fn encode_globals(&self, module: &mut wasm_encoder::Module) { + if self.globals.is_empty() { + return; + } + let mut globals = wasm_encoder::GlobalSection::new(); + for (idx, expr) in &self.defined_globals { + let ty = &self.globals[*idx as usize]; + match expr { + GlobalInitExpr::ConstExpr(expr) => globals.global(*ty, expr), + GlobalInitExpr::FuncRef(func) => globals.global(*ty, &ConstExpr::ref_func(*func)), + }; + } + module.section(&globals); + } + + fn encode_exports(&self, module: &mut wasm_encoder::Module) { + if self.exports.is_empty() { + return; + } + let mut exports = wasm_encoder::ExportSection::new(); + for (name, kind, idx) in &self.exports { + exports.export(name, *kind, *idx); + } + module.section(&exports); + } + + fn encode_start(&self, module: &mut wasm_encoder::Module) { + if let Some(f) = self.start { + module.section(&wasm_encoder::StartSection { function_index: f }); + } + } + + fn encode_elems(&self, module: &mut wasm_encoder::Module) { + if self.elems.is_empty() { + return; + } + let mut elems = wasm_encoder::ElementSection::new(); + let mut exps = vec![]; + for el in &self.elems { + let elements = match &el.items { + Elements::Expressions(es) => { + exps.clear(); + exps.extend(es.iter().map(|e| { + // TODO(nagisa): generate global.get of imported ref globals too. + match e { + Some(i) => match el.ty { + RefType::FUNCREF => wasm_encoder::ConstExpr::ref_func(*i), + _ => unreachable!(), + }, + None => wasm_encoder::ConstExpr::ref_null(el.ty.heap_type), + } + })); + wasm_encoder::Elements::Expressions(el.ty, &exps) + } + Elements::Functions(fs) => wasm_encoder::Elements::Functions(fs), + }; + match &el.kind { + ElementKind::Active { table, offset } => { + let offset = match *offset { + Offset::Const32(n) => ConstExpr::i32_const(n), + Offset::Const64(n) => ConstExpr::i64_const(n), + Offset::Global(g) => ConstExpr::global_get(g), + }; + elems.active(*table, &offset, elements); + } + ElementKind::Passive => { + elems.passive(elements); + } + ElementKind::Declared => { + elems.declared(elements); + } + } + } + module.section(&elems); + } + + fn encode_data_count(&self, module: &mut wasm_encoder::Module) { + // Without bulk memory there's no need for a data count section, + if !self.config.bulk_memory_enabled { + return; + } + // ... and also if there's no data no need for a data count section. + if self.data.is_empty() { + return; + } + module.section(&wasm_encoder::DataCountSection { + count: u32::try_from(self.data.len()).unwrap(), + }); + } + + fn encode_code(&self, module: &mut wasm_encoder::Module) { + if self.code.is_empty() { + return; + } + let mut code = wasm_encoder::CodeSection::new(); + for c in &self.code { + // Skip the run-length encoding because it is a little + // annoying to compute; use a length of one for every local. + let mut func = wasm_encoder::Function::new(c.locals.iter().map(|l| (1, *l))); + match &c.instructions { + Instructions::Generated(instrs) => { + for instr in instrs { + func.instruction(instr); + } + func.instruction(&wasm_encoder::Instruction::End); + } + Instructions::Arbitrary(body) => { + func.raw(body.iter().copied()); + } + } + code.function(&func); + } + module.section(&code); + } + + fn encode_data(&self, module: &mut wasm_encoder::Module) { + if self.data.is_empty() { + return; + } + let mut data = wasm_encoder::DataSection::new(); + for seg in &self.data { + match &seg.kind { + DataSegmentKind::Active { + memory_index, + offset, + } => { + let offset = match *offset { + Offset::Const32(n) => ConstExpr::i32_const(n), + Offset::Const64(n) => ConstExpr::i64_const(n), + Offset::Global(g) => ConstExpr::global_get(g), + }; + data.active(*memory_index, &offset, seg.init.iter().copied()); + } + DataSegmentKind::Passive => { + data.passive(seg.init.iter().copied()); + } + } + } + module.section(&data); + } +} + +pub(crate) fn translate_entity_type(ty: &EntityType) -> wasm_encoder::EntityType { + match ty { + EntityType::Tag(t) => wasm_encoder::EntityType::Tag(wasm_encoder::TagType { + kind: wasm_encoder::TagKind::Exception, + func_type_idx: t.func_type_idx, + }), + EntityType::Func(f, _) => wasm_encoder::EntityType::Function(*f), + EntityType::Table(ty) => (*ty).into(), + EntityType::Memory(m) => (*m).into(), + EntityType::Global(g) => (*g).into(), + } +} diff --git a/third_party/rust/wasm-smith/src/core/terminate.rs b/third_party/rust/wasm-smith/src/core/terminate.rs new file mode 100644 index 0000000000..adcfeed54f --- /dev/null +++ b/third_party/rust/wasm-smith/src/core/terminate.rs @@ -0,0 +1,70 @@ +use super::*; +use std::mem; +use wasm_encoder::BlockType; + +impl Module { + /// Ensure that all of this Wasm module's functions will terminate when + /// executed. + /// + /// This adds a new mutable, exported global to the module to keep track of + /// how much "fuel" is left. Fuel is decremented at the head of each loop + /// and function. When fuel reaches zero, a trap is raised. + /// + /// The index of the fuel global is returned, so that you may control how + /// much fuel the module is given. + pub fn ensure_termination(&mut self, default_fuel: u32) -> u32 { + let fuel_global = self.globals.len() as u32; + self.globals.push(GlobalType { + val_type: ValType::I32, + mutable: true, + }); + self.defined_globals.push(( + fuel_global, + GlobalInitExpr::ConstExpr(ConstExpr::i32_const(default_fuel as i32)), + )); + + for code in &mut self.code { + let check_fuel = |insts: &mut Vec<Instruction>| { + // if fuel == 0 { trap } + insts.push(Instruction::GlobalGet(fuel_global)); + insts.push(Instruction::I32Eqz); + insts.push(Instruction::If(BlockType::Empty)); + insts.push(Instruction::Unreachable); + insts.push(Instruction::End); + + // fuel -= 1 + insts.push(Instruction::GlobalGet(fuel_global)); + insts.push(Instruction::I32Const(1)); + insts.push(Instruction::I32Sub); + insts.push(Instruction::GlobalSet(fuel_global)); + }; + + let instrs = match &mut code.instructions { + Instructions::Generated(list) => list, + // only present on modules contained within + // `MaybeInvalidModule`, which doesn't expose its internal + // `Module`. + Instructions::Arbitrary(_) => unreachable!(), + }; + let mut new_insts = Vec::with_capacity(instrs.len() * 2); + + // Check fuel at the start of functions to deal with infinite + // recursion. + check_fuel(&mut new_insts); + + for inst in mem::replace(instrs, vec![]) { + let is_loop = matches!(&inst, Instruction::Loop(_)); + new_insts.push(inst); + + // Check fuel at loop heads to deal with infinite loops. + if is_loop { + check_fuel(&mut new_insts); + } + } + + *instrs = new_insts; + } + + fuel_global + } +} diff --git a/third_party/rust/wasm-smith/src/lib.rs b/third_party/rust/wasm-smith/src/lib.rs new file mode 100644 index 0000000000..8d17290473 --- /dev/null +++ b/third_party/rust/wasm-smith/src/lib.rs @@ -0,0 +1,192 @@ +//! A WebAssembly test case generator. +//! +//! ## Usage +//! +//! First, use [`cargo fuzz`](https://github.com/rust-fuzz/cargo-fuzz) to define +//! a new fuzz target: +//! +//! ```shell +//! $ cargo fuzz add my_wasm_smith_fuzz_target +//! ``` +//! +//! Next, add `wasm-smith` to your dependencies: +//! +//! ```shell +//! $ cargo add wasm-smith +//! ``` +//! +//! Then, define your fuzz target so that it takes arbitrary +//! `wasm_smith::Module`s as an argument, convert the module into serialized +//! Wasm bytes via the `to_bytes` method, and then feed it into your system: +//! +//! ```no_run +//! // fuzz/fuzz_targets/my_wasm_smith_fuzz_target.rs +//! +//! #![no_main] +//! +//! use libfuzzer_sys::fuzz_target; +//! use wasm_smith::Module; +//! +//! fuzz_target!(|module: Module| { +//! let wasm_bytes = module.to_bytes(); +//! +//! // Your code here... +//! }); +//! ``` +//! +//! Finally, start fuzzing: +//! +//! ```shell +//! $ cargo fuzz run my_wasm_smith_fuzz_target +//! ``` +//! +//! > **Note:** For a real world example, also check out [the `validate` fuzz +//! > target](https://github.com/fitzgen/wasm-smith/blob/main/fuzz/fuzz_targets/validate.rs) +//! > defined in this repository. Using the `wasmparser` crate, it checks that +//! > every module generated by `wasm-smith` validates successfully. +//! +//! ## Design +//! +//! The design and implementation strategy of wasm-smith is outlined in +//! [this article](https://fitzgeraldnick.com/2020/08/24/writing-a-test-case-generator.html). + +#![deny(missing_docs, missing_debug_implementations)] +// Needed for the `instructions!` macro in `src/code_builder.rs`. +#![recursion_limit = "512"] + +mod component; +mod config; +mod core; + +pub use crate::core::{InstructionKind, InstructionKinds, MaybeInvalidModule, Module}; +use arbitrary::{Result, Unstructured}; +pub use component::Component; +pub use config::{Config, MemoryOffsetChoices}; +use std::{collections::HashSet, fmt::Write, str}; + +#[cfg(feature = "_internal_cli")] +pub use config::InternalOptionalConfig; + +/// Do something an arbitrary number of times. +/// +/// The callback can return `false` to exit the loop early. +pub(crate) fn arbitrary_loop<'a>( + u: &mut Unstructured<'a>, + min: usize, + max: usize, + mut f: impl FnMut(&mut Unstructured<'a>) -> Result<bool>, +) -> Result<()> { + assert!(max >= min); + for _ in 0..min { + if !f(u)? { + return Err(arbitrary::Error::IncorrectFormat); + } + } + for _ in 0..(max - min) { + let keep_going = u.arbitrary().unwrap_or(false); + if !keep_going { + break; + } + + if !f(u)? { + break; + } + } + + Ok(()) +} + +// Mirror what happens in `Arbitrary for String`, but do so with a clamped size. +pub(crate) fn limited_str<'a>(max_size: usize, u: &mut Unstructured<'a>) -> Result<&'a str> { + let size = u.arbitrary_len::<u8>()?; + let size = std::cmp::min(size, max_size); + match str::from_utf8(u.peek_bytes(size).unwrap()) { + Ok(s) => { + u.bytes(size).unwrap(); + Ok(s) + } + Err(e) => { + let i = e.valid_up_to(); + let valid = u.bytes(i).unwrap(); + let s = unsafe { + debug_assert!(str::from_utf8(valid).is_ok()); + str::from_utf8_unchecked(valid) + }; + Ok(s) + } + } +} + +pub(crate) fn limited_string(max_size: usize, u: &mut Unstructured) -> Result<String> { + Ok(limited_str(max_size, u)?.into()) +} + +pub(crate) fn unique_string( + max_size: usize, + names: &mut HashSet<String>, + u: &mut Unstructured, +) -> Result<String> { + let mut name = limited_string(max_size, u)?; + while names.contains(&name) { + write!(&mut name, "{}", names.len()).unwrap(); + } + names.insert(name.clone()); + Ok(name) +} + +pub(crate) fn unique_kebab_string( + max_size: usize, + names: &mut HashSet<String>, + u: &mut Unstructured, +) -> Result<String> { + let size = std::cmp::min(u.arbitrary_len::<u8>()?, max_size); + let mut name = String::with_capacity(size); + let mut require_alpha = true; + for _ in 0..size { + name.push(match u.int_in_range::<u8>(0..=36)? { + x if (0..26).contains(&x) => { + require_alpha = false; + (b'a' + x) as char + } + x if (26..36).contains(&x) => { + if require_alpha { + require_alpha = false; + (b'a' + (x - 26)) as char + } else { + (b'0' + (x - 26)) as char + } + } + x if x == 36 => { + if require_alpha { + require_alpha = false; + 'a' + } else { + require_alpha = true; + '-' + } + } + _ => unreachable!(), + }); + } + + if name.is_empty() || name.ends_with('-') { + name.push('a'); + } + + while names.contains(&name) { + write!(&mut name, "{}", names.len()).unwrap(); + } + + names.insert(name.clone()); + + Ok(name) +} + +pub(crate) fn unique_url( + max_size: usize, + names: &mut HashSet<String>, + u: &mut Unstructured, +) -> Result<String> { + let path = unique_kebab_string(max_size, names, u)?; + Ok(format!("https://example.com/{path}")) +} |