Commit Graph

61 Commits

Author SHA1 Message Date
Ng Zhi An
aa001dce0a [wasm-simd] Fix generation of s128.store
s128.store should be in the list for generating kStmt, not kWasmS128.
No regression test added because the generated JS file is not helpful
for this bug - the failed assertion is in the fuzzer, not the engine.

Bug: chromium:1061049
Change-Id: I44092fa10c57aeeb34f1c6c5a7d655def31a7363
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2101927
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66692}
2020-03-13 01:08:31 +00:00
Jakob Kummerow
f3b4167f8b [wasm] Turn ValueType from an enum to a class
In preparation for adding reference types, which need an additional
parameter to indicate the referenced type.

Bug: v8:7748
Change-Id: If4023f3d9c7f42ed603b69c43356d2e8b81a0daa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2091471
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66687}
2020-03-12 17:03:16 +00:00
Ng Zhi An
d86f8ea50a Fix checking of prefixed memory ops in fuzzer
In https://crrev.com/c/2084321 I added s128 load store to the fuzzer,
and updated the memop generator to use IsPrefixOpcode check. But it was
used wrongly. IsPrefixOpcode checks a 1 byte opcode and see if it is a
prefix opcode, but if memory_op is already a 2 byte opcode, it will fail
the IsPrefixOpcode check.

Bug: chromium:1059899
Change-Id: I4caadfb2feaf42ebb9f5578cb790ef8a1d08d173
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2095681
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66638}
2020-03-09 23:13:37 +00:00
Ng Zhi An
2789be8fe9 [wasm-simd] Add s128 load store to fuzzer ops
Bug: v8:10180
Change-Id: If8dd729739854ee0bc08bf71100f48de6a0437b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2084321
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66602}
2020-03-06 00:57:14 +00:00
Ng Zhi An
27b41b54ab [wasm-simd] Add some simd ops to fuzzer
This is still very limited, but we will have some simd instructions.
We add 2 kinds of instructions:
- any_true to generate i32 from v128
- add to generate v128 from v128 and v128
- extract_lane to generate v128 from all other types

We do not add v128 to the list of types returned by GetValueType, since
that is used in a couple of places, like generating globals, which
requires v128.const but is not implemented yet.

Special case to enable the experimental-wasm-simd flag since simd is not
included in wasm-staging yet.

Bug: v8:10180
Change-Id: Ifd86f55bdd49cae9514b061965de81ff6d579934
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2040514
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66326}
2020-02-19 02:01:24 +00:00
Andreas Haas
a1e7895b11 [wasm] Extend fuzzer to test AtomicExchange and AtomicCompareExchange
R=clemensb@chromium.org
CC=zhin@chromium.org

Bug: v8:10108
Change-Id: I68b81f46166d806ac0bc9bc7cc9ae9fcb4ea6d84
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030729
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66127}
2020-02-05 09:01:58 +00:00
Andreas Haas
c93be468ff [wasm][fuzzer] Add atomic binops
R=clemensb@chromium.org

Bug: v8:10108
Change-Id: I6c1cb975c38542ae3811963fe08d9155f7ecef13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2011826
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65928}
2020-01-22 18:58:28 +00:00
Andreas Haas
b2f094bf93 [wasm] Add AtomicLoad and AtomicStore to the fuzzer
I also fixed one issue in the wasm interpreter.

R=clemensb@chromium.org

Bug: v8:10180
Change-Id: Ie30e908ad051a27fa611e8d36134b67aaf4c830c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2000741
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65764}
2020-01-14 19:29:57 +00:00
Ng Zhi An
76ed54ec3b [wasm-simd] Add more f32/f64 cases to fuzz test
Change-Id: I1c20a5c756394528af1e9f2bb720393d3045e926
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1865719
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64359}
2019-10-17 16:57:58 +00:00
Clemens Backes
dcc8b437c7 [wasm] Fix typo in compile fuzzer
"alternates" should be "alternatives".
Drive-by: Rename "generate_fn" to "GenerateFn".

R=ahaas@chromium.org

Change-Id: I09de4678dddcc4a8949dd9589e4dddd0c1c0661c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1866509
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64344}
2019-10-17 10:20:48 +00:00
Clemens Backes
1876767992 [wasm] Rename {Get,Set}Global to Global{Get,Set}
This brings our constants back in line with the changed spec text. We
already use kExprTableGet and kExprTableSet, but for locals and globals
we still use the old wording.

This renaming is mostly mechanical.

PS1 was created using:
ag -l 'kExpr(Get|Set)Global' src test | \
  xargs -L1 sed -E 's/kExpr(Get|Set)Global\b/kExprGlobal\1/g' -i

PS2 contains manual fixes.

R=mstarzinger@chromium.org

Bug: v8:9810
Change-Id: I064a6448cd95bc24d31a5931b5b4ef2464ea88b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1847355
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64163}
2019-10-08 14:27:50 +00:00
Clemens Backes
421fd3929d [wasm] Rename {Get,Set,Tee}Local to Local{Get,Set,Tee}
This brings our constants back in line with the changed spec text. We
already use kExprTableGet and kExprTableSet, but for locals and globals
we still use the old wording.

This renaming is mostly mechanical.

PS1 was created using:
ag -l 'kExpr(Get|Set|Tee)Local' src test | \
  xargs -L1 sed -E 's/kExpr(Get|Set|Tee)Local\b/kExprLocal\1/g' -i

PS2 contains manual fixes.

R=mstarzinger@chromium.org

Bug: v8:9810
Change-Id: I1617f1b2a100685a3bf56218e76845a9481959c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1847354
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64161}
2019-10-08 14:14:40 +00:00
Clemens Backes
7777aa4276 Change all TODOs from clemensh to clemensb
R=adamk@chromium.org

No-Try: true
Change-Id: I71824f52802c125dbee51216054575f44d08d534
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1825243
Commit-Queue: Clemens Backes [né Hammacher] <clemensb@chromium.org>
Auto-Submit: Clemens Backes [né Hammacher] <clemensb@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63983}
2019-09-26 10:25:27 +00:00
Jakob Kummerow
f43944a222 [cleanup] Unify exports handling in WasmModuleBuilder
Change-Id: Id474294a808f5c77321cd12ff5333eb6000b04fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692933
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62655}
2019-07-11 15:50:30 +00:00
Clemens Hammacher
4c9d52e1c8 [wasm] Remove non-const reference args from fuzzers
R=ahaas@chromium.org

Bug: v8:9429, v8:9396
Change-Id: Ie6119ff58fdf48612d81fe0616986a4da95135d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690836
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62569}
2019-07-08 13:46:46 +00:00
Clemens Hammacher
bcdf2e2a54 [wasm] Remove non-const arguments from module builder
R=ahaas@chromium.org

Bug: v8:9429, v8:9396
Change-Id: I2a66142c04b2ec0e3ed57ea2392dda6d17d53b38
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687895
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62554}
2019-07-08 11:42:59 +00:00
Clemens Hammacher
8e11cc395a Enable cpplint 'runtime/references' warning
Cpplint usually checks for non-const reference arguments. They are
forbidden in the style guide, and v8 does not explicitly make an
exception here.
This CL re-enables that warning, and fixes all current violations by
adding an explicit "NOLINT(runtime/references)" comment. In follow-up
CLs, we should aim to remove as many of them as possible.

TBR=mlippautz@chromium.org

Bug: v8:9429
Change-Id: If7054d0b366138b731972ed5d4e304b5ac8423bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687891
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62551}
2019-07-08 09:59:36 +00:00
Andreas Haas
32171b40bf [wasm][fuzzer] Enable anyref for the wasm-compile fuzzer
The newly introduced select-with-type instruction is only available when
anyref is enabled.

R=clemensh@chromium.org

Bug: chromium:967998
Change-Id: Idcb9ab447eedb93fe5374726da162ca1c79b3f16
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634927
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61919}
2019-05-29 14:03:19 +00:00
Andreas Haas
d34178fd73 [wasm][anyref] Introduce the select_with_type instruction
The instruction is the same as the existing {select} instruction with
type. Both inputs must be in a sub-type relationship with the type
specified in the type instruction.

R=clemensh@chromium.org

Bug: v8:7581
Change-Id: Ibead6cd0253210828c8114336ea0942e6cbd6126
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631413
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61886}
2019-05-28 10:46:23 +00:00
Yang Guo
dec3298d9c Move utility code to src/utils
NOPRESUBMIT=true
TBR=mstarzinger@chromium.org

Bug: v8:9247
Change-Id: I4cd6b79a1c2cba944f6f23caed59d4f1a4ee358b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624217
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61790}
2019-05-23 14:13:34 +00:00
Yang Guo
a0c3797461 Move more relevant files to src/objects
TBR=bmeurer@chromium.org,leszeks@chromium.org

Bug: v8:9247
Change-Id: I8d14d0192ea8c705f8274e8e61a162531826edb6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624220
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61769}
2019-05-23 08:52:30 +00:00
Yang Guo
0fa243af70 Move relevant files to src/execution
Bug: v8:9247
Change-Id: I79e0553e8a0d6dac2aa16b94a6c0e05b6ccde4a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1621934
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61725}
2019-05-22 08:36:33 +00:00
Clemens Hammacher
4b0f9c856e [cleanup] Use Vector::begin instead of Vector::start
Our {Vector} template provides both {start} and {begin} methods. They
return exactly the same value. Since the {begin} method is needed for
iteration, and is also what standard containers provide, this CL
switches all uses of the {start} method to use {begin} instead.

Patchset 1 was auto-generated by using this clang AST matcher:
    callExpr(
        callee(
          cxxMethodDecl(
            hasName("start"),
            ofClass(hasName("v8::internal::Vector")))
        ),
        argumentCountIs(0))

Patchset 2 was created by running clang-format. Patchset 3 then
removes the now unused {Vector::start} method.

R=jkummerow@chromium.org
TBR=mstarzinger@chromium.org,yangguo@chromium.org,verwaest@chromium.org

Bug: v8:9183
Change-Id: Id9f01c92870872556e2bb3f6d5667463b0e3e5c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1587381
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61081}
2019-04-29 12:43:16 +00:00
Clemens Hammacher
98b8715427 [wasm][cleanup] Using 'using' instead of 'typedef'
Even though both are allowed in the style guide, it recommends to use
'using', as its syntax is more consistent with the rest of C++.
This CL turns all typedefs in wasm code to 'using' declarations.

R=ahaas@chromium.org

Bug: v8:8834
Change-Id: Ibdce88a5cc31e0785cbc1b34088bd39aa3ec84b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1545890
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60519}
2019-03-29 10:20:30 +00:00
Clemens Hammacher
eeb99d31ab [wasm][fuzzer] Remove unused return value
R=ahaas@chromium.org

Bug: v8:8238
Change-Id: I7a7de894aa7bf074cbe732f40e16b10060fa37dd
Reviewed-on: https://chromium-review.googlesource.com/c/1344149
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57660}
2018-11-20 17:15:35 +00:00
Clemens Hammacher
e5847dd82a [fuzzer] Improve wasm-compile fuzzer
For short inputs (<= size of the type we want to generate), we fell back
to just generating constants. This CL changes that to only fall back to
constants once a single byte remains, and adds options to use constants
already before that.

R=ahaas@chromium.org

Bug: v8:894307
Change-Id: Ic4bf05d06090f52b67de2b322a9d5dcab6bbbe39
Reviewed-on: https://chromium-review.googlesource.com/c/1337739
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57573}
2018-11-16 14:15:48 +00:00
Clemens Hammacher
cc70a6b050 [wasm] Rename GrowMemory to MemoryGrow
The "grow_memory" opcode was renamed to "memory.grow", and the spec
repo was updated to use kExprMemoryGrow internally instead of
kExprGrowMemory (https://github.com/WebAssembly/spec/pull/720).
This CL does the same change for v8.

Drive-by: Rename "current_size" to "memory.size", and a minor cleanup
in wasm-graph-builder.js to bring it in line with the version in the
js-api tests in the spec repo.

R=titzer@chromium.org

Change-Id: If525dba898b2c248890a616d3392c22b45f698ef
Reviewed-on: https://chromium-review.googlesource.com/c/1302057
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57089}
2018-10-29 14:06:24 +00:00
Clemens Hammacher
897e17a255 [wasm][fuzzer] Generate more and longer sequences
In Liftoff, bugs often happen only if specific cache states are
constructed. For this, longer sequences of instructions are needed.
Thus, add a few rules to increase the chance of generating longer
sequences.

R=ahaas@chromium.org

Change-Id: I8f112edf0280282bf275585e8a15772013c25245
Reviewed-on: https://chromium-review.googlesource.com/1158695
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54927}
2018-08-06 14:58:05 +00:00
Florian Sattler
e2201a4458 Reland "Applied noexcept to all mctors and massigns"
This is a reland of baa055c7a6

Original change's description:
> Applied noexcept to all mctors and massigns
> 
> Refactoring the code base to use noexcept for their move constructors and move
> assignment operators.
> 
> Bug: v8:7999
> 
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: I13d24eddba3bfa601cff26fd680a040cf4e71426
> Reviewed-on: https://chromium-review.googlesource.com/1152817
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Florian Sattler <sattlerf@google.com>
> Cr-Commit-Position: refs/heads/master@{#54841}

Bug: v8:7999
Change-Id: I72394e326a4f8da462ee6285511d721440ceb21d
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/1158646
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#54863}
2018-08-02 10:37:09 +00:00
Clemens Hammacher
8332c0ff11 Revert "Applied noexcept to all mctors and massigns"
This reverts commit baa055c7a6.

Reason for revert: mips compile failure: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Mips%20-%20builder/18458

Original change's description:
> Applied noexcept to all mctors and massigns
> 
> Refactoring the code base to use noexcept for their move constructors and move
> assignment operators.
> 
> Bug: v8:7999
> 
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: I13d24eddba3bfa601cff26fd680a040cf4e71426
> Reviewed-on: https://chromium-review.googlesource.com/1152817
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Florian Sattler <sattlerf@google.com>
> Cr-Commit-Position: refs/heads/master@{#54841}

TBR=marja@chromium.org,yangguo@chromium.org,ahaas@chromium.org,jgruber@chromium.org,sattlerf@google.com

Change-Id: I49757025daac368a647887a63164e927f0106803
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7999
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/1158644
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54843}
2018-08-01 13:19:09 +00:00
Florian Sattler
baa055c7a6 Applied noexcept to all mctors and massigns
Refactoring the code base to use noexcept for their move constructors and move
assignment operators.

Bug: v8:7999

Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I13d24eddba3bfa601cff26fd680a040cf4e71426
Reviewed-on: https://chromium-review.googlesource.com/1152817
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#54841}
2018-08-01 13:00:30 +00:00
Clemens Hammacher
dad67377c3 [wasm] "Vectorize" fuzzer
Instead of passing {uint8_t*, size_t} pairs as arguments, pass
{Vector<uint8_t>}. This is less error prone and {Vector} provides some
helpful methods.

R=ahaas@chromium.org

Bug: v8:7754
Change-Id: I7469054774618e0bd5c9d38501759b1b2c51d104
Reviewed-on: https://chromium-review.googlesource.com/1134773
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54406}
2018-07-12 12:44:39 +00:00
Andreas Haas
3a56441a8c [wasm][cleanup] Move ValueType into its own header file
This CL splits the definition of ValueType and its helper functions
into its own header file.

R=clemensh@chromium.org

Bug: v8:7570
Change-Id: I3aa776edb45839d7d38836e131df45732c685310
Reviewed-on: https://chromium-review.googlesource.com/1021810
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52758}
2018-04-24 13:55:18 +00:00
Clemens Hammacher
3c3e76a304 [wasm] [fuzzer] Generate sequences of kWasmStmt
We were generating sequences of instructions for generating i32, i64,
f32 and f64 values, but not for generating an instruction without a
result value. This CL adds that.

R=ahaas@chromium.org

Change-Id: I5c17d4182dfc6a827c7cdaa611ba7941b9c5d12f
Reviewed-on: https://chromium-review.googlesource.com/897790
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51058}
2018-02-02 11:26:06 +00:00
Clemens Hammacher
1f1fa410df [wasm] [fuzzer] Add globals
This adds support for set_global and get_global.

R=ahaas@chromium.org

Change-Id: I08bfa3c23080f473616970e9894cfb6e55a4f76d
Reviewed-on: https://chromium-review.googlesource.com/890744
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50963}
2018-01-30 15:14:59 +00:00
Clemens Hammacher
ad3033ea85 [wasm] [fuzzer] Generate if blocks
Turns out we never generated if blocks or if-else blocks so far.

R=ahaas@chromium.org

Change-Id: I942dbc614b5b489094f5b029a70c40b336d09fa4
Reviewed-on: https://chromium-review.googlesource.com/890451
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50961}
2018-01-30 13:22:19 +00:00
Clemens Hammacher
3e43bbb544 [wasm] [fuzzer] Also generate br_if
The wasm compile fuzzer generated {br} instructions, but no {br_if} so
far. This CL adds that.

R=ahaas@chromium.org

Change-Id: Ib5e47a26d96e88498104e0d57b9a49b74b7356eb
Reviewed-on: https://chromium-review.googlesource.com/890450
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50950}
2018-01-30 10:32:46 +00:00
Clemens Hammacher
63aaa83370 [wasm][fuzzer] Allow tee_local and set_local
set_local was implemented before, but not added to any list of
alternatives. tee_local is now additionally implemented and added.

R=ahaas@chromium.org

Change-Id: I51f0b35c7b507e8af06efd1f9baac30790f28a3b
Reviewed-on: https://chromium-review.googlesource.com/860460
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50505}
2018-01-11 13:56:34 +00:00
Clemens Hammacher
4b107b9ec9 [wasm][fuzzer] Add locals
This adds support for get_local and set_local to the wasm compile
fuzzer. Each function will have between 0 and 32 locals of random type.
For set_local, we generate a value of the respective type and store it
in the local. For get_local, we load any local and convert it to the
wanted type.
Note that with get_local, we now also check that parameters are passed
correctly between functions.

Drive-by: Fix parameters passed to the main function (was [1,2,3] for
the interpreter, but [1,1,1] for compiled code).

R=ahaas@chromium.org, eholk@chromium.org

Change-Id: I38e85fe25b1fb4ac298fa81ec8e33711294e78bb
Reviewed-on: https://chromium-review.googlesource.com/847535
Reviewed-by: Eric Holk <eholk@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50355}
2018-01-04 10:42:42 +00:00
Clemens Hammacher
58c82bdaa9 [wasm] [fuzzer] Add support for calls
The wasm compile fuzzer now generates up to four functions with
different signatures, and generates calls between them.

R=ahaas@chromium.org
CC=eholk@chromium.org

Change-Id: I94903a80c78f8463dc1dee91ccf3be33c431e25a
Reviewed-on: https://chromium-review.googlesource.com/839860
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50274}
2017-12-21 15:09:53 +00:00
Clemens Hammacher
5da204c87c [wasm] [fuzzer] Avoid reuse of input data
I just fixed an annoying bug where I accidentally used DataRange more
than once, leading to endless recursion.
This CL avoids that by forbidding copying of DataRange. Instead, it's
mostly passed by reference now.

R=ahaas@chromium.org
CC=eholk@chromium.org

Change-Id: I3925548951645d13823ff42d9d833bde76d6cca6
Reviewed-on: https://chromium-review.googlesource.com/839762
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50273}
2017-12-21 15:01:33 +00:00
Clemens Hammacher
f0d9686848 [wasm] [fuzzer] Add the drop opcode
Adds support for emitting the drop opcode in the wasm compile fuzzer.

R=ahaas@chromium.org
CC=eholk@chromium.org

Change-Id: Idb6f07f3f50ffda472107bd6276221e803c37152
Reviewed-on: https://chromium-review.googlesource.com/839760
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50267}
2017-12-21 14:27:03 +00:00
Clemens Hammacher
b46cc820ba [wasm] compile fuzzer: Also generate loops
Beside blocks, do also generate loops.
Also, generalize generation of breaks such that they can happen
anywhere, even outside of a block or loop.

R=eholk@chromium.org

Change-Id: Ib2f8c75913e97f331ec105fd87fc882bc5c04864
Reviewed-on: https://chromium-review.googlesource.com/771610
Reviewed-by: Eric Holk <eholk@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49392}
2017-11-15 17:44:05 +00:00
Eric Holk
52b0b901bf [wasm fuzzer] fix i64.store generation error
This was meant to be included in https://crrev.com/c/757129 but got missed
somehow. The fuzzer was generating i64.store instructions with an i32 value
argument instead of i64 like it should be.

Bug: 
Change-Id: I5b5bcdb22b2ac3abe872e7ff0ab0019b5ecb9c98
Reviewed-on: https://chromium-review.googlesource.com/759148
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49270}
2017-11-09 13:20:25 +00:00
Eric Holk
ea08828bb3 [wasm fuzzer] Require AST fuzzer modules to validate
The Wasm AST-based fuzzer is supposed to create valid modules by
construction. This change adds a CHECK to enforce this property.

Additionally, this change exposed several cases where we were not generating
valid modules before:
  * Block types did not match up correctly
  * Memory operations could have invalid alignments
  * Storing an i64 could generate an i32 argument incorrectly.
This CL includes fixes for these issues as well.

Bug: 
Change-Id: I1aef5532bc880367ec46dc6e79b2d4dbacf2f84b
Reviewed-on: https://chromium-review.googlesource.com/757129
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49241}
2017-11-08 21:29:40 +00:00
Clemens Hammacher
54d68665f2 [wasm] [fuzzer] [cleanup] Reuse helper method
We already have a helper method for generating a sequence of values.
Reuse this instead of reimplementing the same thing two more times.

R=ahaas@chromium.org
CC=eholk@chromium.org

Change-Id: Ifbbe1324173951156c1ec9bba84fd1aa4bcb2adb
Reviewed-on: https://chromium-review.googlesource.com/758365
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49216}
2017-11-08 10:57:53 +00:00
Eric Holk
41bd98e703 [wasm fuzzer] generate grow_memory instructions
Change-Id: Ib9bbcc22afbfc4d143e0eb65b1399f118bbc1e36
Reviewed-on: https://chromium-review.googlesource.com/754334
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49202}
2017-11-07 18:07:21 +00:00
Clemens Hammacher
0dbc81307b [wasm] Clean up and speed up compile fuzzer
Instead of calling a number of member functions which return lambdas
which are then wrapped in std::functions, just use the member functions
directly. This allows to make the arrays with the alternatives constexpr
instead of dynamically filling it on each call.

R=eholk@chromium.org, ahaas@chromium.org

Change-Id: Id1256f442f411eb291941911b25de24a985a9b34
Reviewed-on: https://chromium-review.googlesource.com/753722
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49146}
2017-11-06 16:14:15 +00:00
Eric Holk
d1d48cce66 [wasm fuzzers] Add memory ops
This CL adds support for memory operations to the AST-based Wasm compile
fuzzer. We've had several bugs in this area, so additional fuzz coverage should
help detect these sooner.

Change-Id: I28b5b95f1fc28939db764efe78de6d56bc61263c
Reviewed-on: https://chromium-review.googlesource.com/742383
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49144}
2017-11-06 15:34:06 +00:00
Clemens Hammacher
dbddb56359 [wasm] Limit recursion depth in compile fuzzer
Fix a stack overflow in the wasm_compile_fuzzer by limiting the
recursion depth to 64. At this depth, we always just generate a
constant expression.

R=eholk@chromium.org, ahaas@chromium.org

Bug: chromium:747348
Change-Id: I236c1e07b8cb2b6c9181c549e850eca34fac6ec6
Reviewed-on: https://chromium-review.googlesource.com/753329
Reviewed-by: Eric Holk <eholk@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49134}
2017-11-06 10:27:13 +00:00