Skip to content

New fuzzer: PreserveImportsExportsJS#8592

Open
kripken wants to merge 42 commits intoWebAssembly:mainfrom
kripken:fuzz.preserve.js
Open

New fuzzer: PreserveImportsExportsJS#8592
kripken wants to merge 42 commits intoWebAssembly:mainfrom
kripken:fuzz.preserve.js

Conversation

@kripken
Copy link
Copy Markdown
Member

@kripken kripken commented Apr 10, 2026

This starts from wasm+js testcases and then modifies the wasm in a way that
preserves imports and exports, so the wasm+js can still be run. This is very
different from our usual approach of starting with only wasm, then bashing it
into the shape that our general js code can handle.

The main benefit here is testing of more interesting wasm+js interactions,
specifically for the JS Interop proposal. Three wasm+js combinations are
added in this PR that test features from that proposal.

@kripken kripken requested a review from a team as a code owner April 10, 2026 20:23
@kripken kripken requested review from aheejin and removed request for a team April 10, 2026 20:23
Comment on lines +149 to +152
(drop)
(return (i32.const 1))
)
(drop)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might as well just let the returns implicitly drop the stack. This is already happening in the inner block.

Suggested change
(drop)
(return (i32.const 1))
)
(drop)
(return (i32.const 1))
)

Comment on lines +151 to +154
(drop (br_on_cast_desc_eq_fail $fail (ref $A) (ref $B) (local.get $a) (local.get $desc)))
(return (i32.const 1))
)
(drop)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

More unnecessary drops.

Suggested change
(drop (br_on_cast_desc_eq_fail $fail (ref $A) (ref $B) (local.get $a) (local.get $desc)))
(return (i32.const 1))
)
(drop)
(br_on_cast_desc_eq_fail $fail (ref $A) (ref $B) (local.get $a) (local.get $desc))
(return (i32.const 1))
)

# Note that bugs found by this fuzzer require BINARYEN_TRUST_GIVEN_WASM=1 in the
# env for reduction. TODO: simplify this
class PreserveImportsExportsJS(TestCaseHandler):
frequency = 1
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we do this less frequently given how few starting configurations it has?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants