Skip to content

Commit c0a63f1

Browse files
mi-acv8-internal-scoped@luci-project-accounts.iam.gserviceaccount.com
mi-ac
authored and
v8-internal-scoped@luci-project-accounts.iam.gserviceaccount.com
committed
Revert changes to WasmDefineArrayType and WasmDefineStructType
Revert "[wasm] Add superType input to WasmDefineArrayType" This reverts commit 3a03d76. Revert "[wasm] Add superType input to WasmDefineStructType" This reverts commit 5ce4c59. Also bump protobuf version. Bug: 524213342, 517707090 Change-Id: I0d10c4d9123292dd184281de0f0c02a12a199f13 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9425034 Reviewed-by: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
1 parent 77031cc commit c0a63f1

14 files changed

Lines changed: 35 additions & 356 deletions

‎Sources/Fuzzilli/Base/ProgramBuilder.swift‎

Lines changed: 5 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -6553,75 +6553,21 @@ public class ProgramBuilder {
65536553
}
65546554

65556555
@discardableResult
6556-
func wasmDefineArrayType(
6557-
elementType: ILType, mutability: Bool, indexType: Variable? = nil,
6558-
superType: Variable? = nil
6559-
)
6556+
func wasmDefineArrayType(elementType: ILType, mutability: Bool, indexType: Variable? = nil)
65606557
-> Variable
65616558
{
6562-
var inputs: [Variable] = []
6563-
if let superType {
6564-
let superTypeDesc = type(of: superType).wasmTypeDefinition?.description
6565-
assert(
6566-
superTypeDesc != .selfReference, "Supertype cannot be a forward or self-reference")
6567-
guard let superArrayType = superTypeDesc as? WasmArrayTypeDescription else {
6568-
fatalError("Supertype of an array must be an array type")
6569-
}
6570-
if superArrayType.mutability {
6571-
assert(mutability)
6572-
assert(elementType == superArrayType.elementType)
6573-
} else {
6574-
assert(!mutability)
6575-
assert(superArrayType.elementType.subsumes(elementType))
6576-
}
6577-
6578-
inputs.append(superType)
6579-
}
6580-
if let indexType {
6581-
inputs.append(indexType)
6582-
}
6559+
let inputs = indexType != nil ? [indexType!] : []
65836560
return emit(
6584-
WasmDefineArrayType(
6585-
elementType: elementType, mutability: mutability, hasSuperType: superType != nil),
6561+
WasmDefineArrayType(elementType: elementType, mutability: mutability),
65866562
withInputs: inputs
65876563
).output
65886564
}
65896565

65906566
@discardableResult
6591-
func wasmDefineStructType(
6592-
fields: [WasmStructTypeDescription.Field], indexTypes: [Variable],
6593-
superType: Variable? = nil
6594-
)
6567+
func wasmDefineStructType(fields: [WasmStructTypeDescription.Field], indexTypes: [Variable])
65956568
-> Variable
65966569
{
6597-
var inputs: [Variable] = []
6598-
if let superType {
6599-
let superTypeDesc = type(of: superType).wasmTypeDefinition?.description
6600-
assert(
6601-
superTypeDesc != .selfReference, "Supertype cannot be a forward or self-reference")
6602-
guard let superStructType = superTypeDesc as? WasmStructTypeDescription else {
6603-
fatalError("Supertype of a struct must be a struct type")
6604-
}
6605-
6606-
assert(fields.count >= superStructType.fields.count)
6607-
for (superField, subField) in zip(superStructType.fields, fields) {
6608-
if superField.mutability {
6609-
assert(subField.mutability)
6610-
assert(subField.type == superField.type)
6611-
} else {
6612-
assert(!subField.mutability)
6613-
assert(superField.type.subsumes(subField.type))
6614-
}
6615-
}
6616-
6617-
inputs.append(superType)
6618-
}
6619-
6620-
inputs += indexTypes
6621-
6622-
return emit(
6623-
WasmDefineStructType(fields: fields, hasSuperType: superType != nil), withInputs: inputs
6624-
).output
6570+
return emit(WasmDefineStructType(fields: fields), withInputs: indexTypes).output
66256571
}
66266572

66276573
@discardableResult

‎Sources/Fuzzilli/FuzzIL/Instruction.swift‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1737,7 +1737,6 @@ extension Instruction: ProtobufConvertible {
17371737
$0.wasmDefineArrayType = Fuzzilli_Protobuf_WasmDefineArrayType.with {
17381738
$0.elementType = ILTypeToWasmTypeEnum(op.elementType)
17391739
$0.mutability = op.mutability
1740-
$0.hasSuperType_p = op.hasSuperType
17411740
}
17421741
case .wasmDefineStructType(let op):
17431742
$0.wasmDefineStructType = Fuzzilli_Protobuf_WasmDefineStructType.with {
@@ -1747,7 +1746,6 @@ extension Instruction: ProtobufConvertible {
17471746
$0.mutability = field.mutability
17481747
}
17491748
}
1750-
$0.hasSuperType_p = op.hasSuperType
17511749
}
17521750
case .wasmDefineForwardOrSelfReference(_):
17531751
$0.wasmDefineForwardOrSelfReference =
@@ -2901,8 +2899,7 @@ extension Instruction: ProtobufConvertible {
29012899
op = WasmEndTypeGroup(typesCount: inouts.count / 2)
29022900
case .wasmDefineArrayType(let p):
29032901
op = WasmDefineArrayType(
2904-
elementType: WasmTypeEnumToILType(p.elementType), mutability: p.mutability,
2905-
hasSuperType: p.hasSuperType_p)
2902+
elementType: WasmTypeEnumToILType(p.elementType), mutability: p.mutability)
29062903
case .wasmDefineSignatureType(let p):
29072904
op = WasmDefineSignatureType(
29082905
signature: p.parameterTypes.map(WasmTypeEnumToILType)
@@ -2920,8 +2917,7 @@ extension Instruction: ProtobufConvertible {
29202917
fields: p.fields.map { field in
29212918
return WasmDefineStructType.Field(
29222919
type: WasmTypeEnumToILType(field.type), mutability: field.mutability)
2923-
},
2924-
hasSuperType: p.hasSuperType_p)
2920+
})
29252921
case .wasmDefineForwardOrSelfReference(_):
29262922
op = WasmDefineForwardOrSelfReference()
29272923
case .wasmResolveForwardReference(_):

‎Sources/Fuzzilli/FuzzIL/JSTyper.swift‎

Lines changed: 8 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -576,8 +576,7 @@ public struct JSTyper: Analyzer {
576576
}
577577

578578
mutating func addArrayType(
579-
def: Variable, elementType: ILType, mutability: Bool, elementRef: Variable? = nil,
580-
concreteHeapSupertype: WasmTypeDescription? = nil
579+
def: Variable, elementType: ILType, mutability: Bool, elementRef: Variable? = nil
581580
) {
582581
assert(isWithinTypeGroup)
583582
let tgIndex = typeGroups.count - 1
@@ -623,14 +622,12 @@ public struct JSTyper: Analyzer {
623622
description: WasmArrayTypeDescription(
624623
elementType: resolvedElementType,
625624
mutability: mutability,
626-
typeGroupIndex: tgIndex,
627-
concreteHeapSupertype: concreteHeapSupertype)))
625+
typeGroupIndex: tgIndex)))
628626
typeGroups[typeGroups.count - 1].append(def)
629627
}
630628

631629
mutating func addStructType(
632-
def: Variable, fieldsWithRefs: [(WasmStructTypeDescription.Field, Variable?)],
633-
concreteHeapSupertype: WasmTypeDescription? = nil
630+
def: Variable, fieldsWithRefs: [(WasmStructTypeDescription.Field, Variable?)]
634631
) {
635632
let tgIndex = typeGroups.count - 1
636633
let resolvedFields = fieldsWithRefs.enumerated().map { (fieldIndex, fieldWithInput) in
@@ -670,8 +667,7 @@ public struct JSTyper: Analyzer {
670667
def,
671668
.wasmTypeDef(
672669
description: WasmStructTypeDescription(
673-
fields: resolvedFields, typeGroupIndex: tgIndex,
674-
concreteHeapSupertype: concreteHeapSupertype)))
670+
fields: resolvedFields, typeGroupIndex: tgIndex)))
675671
typeGroups[typeGroups.count - 1].append(def)
676672
}
677673

@@ -2608,17 +2604,13 @@ public struct JSTyper: Analyzer {
26082604
addSignatureType(def: instr.output, signature: op.signature, inputs: instr.inputs)
26092605

26102606
case .wasmDefineArrayType(let op):
2611-
let elementRef = op.elementType.requiredInputCount() == 1 ? instr.inputs.last! : nil
2612-
let concreteHeapSupertype =
2613-
op.hasSuperType ? getTypeDescription(of: instr.inputs.first!) : nil
2607+
let elementRef = op.elementType.requiredInputCount() == 1 ? instr.input(0) : nil
26142608
addArrayType(
26152609
def: instr.output, elementType: op.elementType, mutability: op.mutability,
2616-
elementRef: elementRef, concreteHeapSupertype: concreteHeapSupertype)
2610+
elementRef: elementRef)
26172611

26182612
case .wasmDefineStructType(let op):
2619-
let concreteHeapSupertype =
2620-
op.hasSuperType ? getTypeDescription(of: instr.inputs.first!) : nil
2621-
var inputIndex = op.hasSuperType ? 1 : 0
2613+
var inputIndex = 0
26222614
let fieldsWithRefs: [(WasmStructTypeDescription.Field, Variable?)] = op.fields.map {
26232615
field in
26242616
if field.type.requiredInputCount() == 0 {
@@ -2630,9 +2622,7 @@ public struct JSTyper: Analyzer {
26302622
}
26312623
}
26322624
assert(inputIndex == instr.inputs.count)
2633-
addStructType(
2634-
def: instr.output, fieldsWithRefs: fieldsWithRefs,
2635-
concreteHeapSupertype: concreteHeapSupertype)
2625+
addStructType(def: instr.output, fieldsWithRefs: fieldsWithRefs)
26362626

26372627
case .wasmDefineForwardOrSelfReference(_):
26382628
set(instr.output, .wasmSelfReference())

‎Sources/Fuzzilli/FuzzIL/JsOperations.swift‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2823,15 +2823,12 @@ class WasmDefineArrayType: WasmTypeOperation {
28232823
override var opcode: Opcode { .wasmDefineArrayType(self) }
28242824
let elementType: ILType
28252825
let mutability: Bool
2826-
let hasSuperType: Bool
28272826

2828-
init(elementType: ILType, mutability: Bool, hasSuperType: Bool = false) {
2827+
init(elementType: ILType, mutability: Bool) {
28292828
self.elementType = elementType
28302829
self.mutability = mutability
2831-
self.hasSuperType = hasSuperType
2832-
let numInputs = (hasSuperType ? 1 : 0) + elementType.requiredInputCount()
28332830
super.init(
2834-
numInputs: numInputs, numOutputs: 1,
2831+
numInputs: elementType.requiredInputCount(), numOutputs: 1,
28352832
requiredContext: [.wasmTypeGroup])
28362833
}
28372834
}
@@ -2842,14 +2839,10 @@ class WasmDefineStructType: WasmTypeOperation {
28422839
typealias Field = WasmStructTypeDescription.Field
28432840

28442841
let fields: [Field]
2845-
let hasSuperType: Bool
28462842

2847-
init(fields: [Field], hasSuperType: Bool = false) {
2843+
init(fields: [Field]) {
28482844
self.fields = fields
2849-
self.hasSuperType = hasSuperType
2850-
let numInputs =
2851-
(hasSuperType ? 1 : 0)
2852-
+ fields.map { $0.type.requiredInputCount() }.reduce(0) { $0 + $1 }
2845+
let numInputs = fields.map { $0.type.requiredInputCount() }.reduce(0) { $0 + $1 }
28532846
super.init(numInputs: numInputs, numOutputs: 1, requiredContext: [.wasmTypeGroup])
28542847
}
28552848
}

‎Sources/Fuzzilli/FuzzIL/Program.swift‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ public final class Program: CustomStringConvertible {
4848

4949
/// The current version of the FuzzIL/Protobuf schema.
5050
/// This version should be bumped whenever a breaking change is made to the protobuf format.
51-
public static let protobufVersion: UInt32 = 3
51+
public static let protobufVersion: UInt32 = 4
5252

5353
/// Constructs an empty program.
5454
public init(isBundle: Bool) {

‎Sources/Fuzzilli/FuzzIL/TypeSystem.swift‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2742,17 +2742,13 @@ class WasmArrayTypeDescription: WasmTypeDescription {
27422742
var elementType: ILType
27432743
let mutability: Bool
27442744

2745-
init(
2746-
elementType: ILType, mutability: Bool, typeGroupIndex: Int,
2747-
concreteHeapSupertype: WasmTypeDescription? = nil
2748-
) {
2745+
init(elementType: ILType, mutability: Bool, typeGroupIndex: Int) {
27492746
self.elementType = elementType
27502747
self.mutability = mutability
27512748
// TODO(pawkra): support shared variant.
27522749
super.init(
27532750
typeGroupIndex: typeGroupIndex,
2754-
abstractHeapSupertype: HeapTypeInfo.init(.WasmArray, shared: false),
2755-
concreteHeapSupertype: concreteHeapSupertype)
2751+
abstractHeapSupertype: HeapTypeInfo.init(.WasmArray, shared: false))
27562752
}
27572753

27582754
override func format(abbreviate: Bool) -> String {
@@ -2781,15 +2777,12 @@ class WasmStructTypeDescription: WasmTypeDescription {
27812777

27822778
let fields: [Field]
27832779

2784-
init(
2785-
fields: [Field], typeGroupIndex: Int, concreteHeapSupertype: WasmTypeDescription? = nil
2786-
) {
2780+
init(fields: [Field], typeGroupIndex: Int) {
27872781
self.fields = fields
27882782
// TODO(pawkra): support shared variant.
27892783
super.init(
27902784
typeGroupIndex: typeGroupIndex,
2791-
abstractHeapSupertype: HeapTypeInfo.init(.WasmStruct, shared: false),
2792-
concreteHeapSupertype: concreteHeapSupertype
2785+
abstractHeapSupertype: HeapTypeInfo.init(.WasmStruct, shared: false)
27932786
)
27942787
}
27952788

‎Sources/Fuzzilli/Lifting/FuzzILLifter.swift‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1635,21 +1635,16 @@ public class FuzzILLifter: Lifter {
16351635
w.emit("\(output()) <- WasmDefineAdHocModuleSignatureType(\(op.signature)) [\(inputs)]")
16361636

16371637
case .wasmDefineArrayType(let op):
1638-
let superTypeInput = op.hasSuperType ? " superType=\(lift(instr.inputs.first!))" : ""
1639-
let typeInput =
1640-
op.elementType.requiredInputCount() == 1 ? " \(lift(instr.inputs.last!))" : ""
1638+
let typeInput = op.elementType.requiredInputCount() == 1 ? " \(input(0))" : ""
16411639
w.emit(
1642-
"\(output()) <- WasmDefineArrayType \(op.elementType) mutability=\(op.mutability)\(superTypeInput)\(typeInput)"
1640+
"\(output()) <- WasmDefineArrayType \(op.elementType) mutability=\(op.mutability)\(typeInput)"
16431641
)
16441642

16451643
case .wasmDefineStructType(let op):
16461644
let fields = op.fields.map { "\($0.type) mutability=\($0.mutability)" }.joined(
16471645
separator: ", ")
1648-
let superTypeInput = op.hasSuperType ? " superType=\(lift(instr.inputs.first!))" : ""
1649-
let structInputs = (op.hasSuperType ? instr.inputs.dropFirst() : instr.inputs).map(lift)
1650-
.joined(separator: ", ")
1651-
w.emit(
1652-
"\(output()) <- WasmDefineStructType(\(fields))\(superTypeInput) [\(structInputs)]")
1646+
let inputs = instr.inputs.map(lift).joined(separator: ", ")
1647+
w.emit("\(output()) <- WasmDefineStructType(\(fields)) [\(inputs)]")
16531648

16541649
case .wasmDefineForwardOrSelfReference(_):
16551650
w.emit("\(output()) <- WasmDefineForwardOrSelfReference")

‎Sources/Fuzzilli/Lifting/WasmLifter.swift‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -605,13 +605,6 @@ public class WasmLifter {
605605
}
606606

607607
private func buildTypeEntry(for desc: WasmTypeDescription, data: inout Data) throws {
608-
// TODO(bettscheider): Support [0x4F, 0x01], "final with super type".
609-
if let supertype = desc.concreteHeapSupertype {
610-
data += [0x50, 0x01] // Non-final, with super type
611-
data += try encodeWasmGCType(supertype)
612-
} else if desc is WasmArrayTypeDescription || desc is WasmStructTypeDescription {
613-
data += [0x50, 0x00] // Non-final, no super type
614-
}
615608
if let arrayDesc = desc as? WasmArrayTypeDescription {
616609
data += [0x5E]
617610
data += try encodeType(arrayDesc.elementType)

‎Sources/Fuzzilli/Minimization/InstructionSimplifier.swift‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ struct InstructionSimplifier: Reducer {
2020
simplifyGuardedInstructions(with: helper)
2121
simplifySingleInstructions(with: helper)
2222
simplifyMultiInstructions(with: helper)
23-
simplifyWasmInstructions(with: helper)
2423
}
2524

2625
func simplifyFunctionDefinitions(with helper: MinimizationHelper) {
@@ -250,17 +249,4 @@ struct InstructionSimplifier: Reducer {
250249
helper.testAndCommit(newCode)
251250
}
252251
}
253-
254-
func simplifyWasmInstructions(with helper: MinimizationHelper) {
255-
for instr in helper.code {
256-
if let op = instr.op as? WasmDefineArrayType, op.hasSuperType {
257-
let newOp = WasmDefineArrayType(
258-
elementType: op.elementType, mutability: op.mutability, hasSuperType: false)
259-
let newInouts = instr.inputs.dropFirst() + instr.outputs
260-
helper.tryReplacing(
261-
instructionAt: instr.index,
262-
with: Instruction(newOp, inouts: Array(newInouts)))
263-
}
264-
}
265-
}
266252
}

0 commit comments

Comments
 (0)