Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wasm-smith: add a "no trapping" mode #266

Closed
fitzgen opened this issue Apr 22, 2021 · 1 comment
Closed

wasm-smith: add a "no trapping" mode #266

fitzgen opened this issue Apr 22, 2021 · 1 comment
Labels
wasm-smith Related to the wasm-smith crate and creating wasm modules for fuzzing

Comments

@fitzgen
Copy link
Member

fitzgen commented Apr 22, 2021

I think we could do this with a post-processing pass, similar to what we do with ensure_termination.

We'd walk over each instruction and potentially insert some code right before it:

  • We would insert a couple instructions to ensure that a division instruction's denominator is never zero
  • We would insert a couple instructions to mask heap addresses to ensure they are within the memory's minimum size
  • Similar for table.get and table.set
  • Similar for trapping floating point conversion instructions
  • Every unreachable would be replaced with code to create dummy result values (ie zeroes) and then br out of the current control frame

We would also have to make sure that active data/elem segments were always in bounds of their memories/tables.

I think that's everything? I might be missing some trapping cases, but I think the approach would work for everything.

cc @alexcrichton

@alexcrichton
Copy link
Member

Done in #769

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
wasm-smith Related to the wasm-smith crate and creating wasm modules for fuzzing
Projects
None yet
Development

No branches or pull requests

2 participants