Add fuzzer integration for gc/mutatis #11290

khagankhan · 2025-07-21T16:56:19Z

Add integration of mutatis wit fuzzer
remove serialize/deserialize for config instead use u64
use serialize/deserialize for fuzz_mutate

fitzgen

Looks good, but there are a handful of small things to address before we merge this. Thanks!

fitzgen · 2025-07-21T18:47:53Z

crates/fuzzing/src/oracles.rs

+/// Fuzz target for table operations that reconstructs config from seed.
+pub fn fuzz_table_ops((config_seed, ops): (u64, generators::table_ops::TableOps)) {
+    let mut buf = [0u8; 1024];
+    let mut rng = rand::rngs::StdRng::seed_from_u64(config_seed);
+
+    for b in buf.iter_mut() {
+        *b = rng.r#gen()
+    }
+
+    let u = Unstructured::new(&buf);
+    let config = generators::Config::arbitrary_take_rest(u)
+        .expect("should be able to generate config from seed");
+
+    let _ = crate::oracles::table_ops(config, ops);
+}
+


We already have an oracle for fuzzing table ops, which is what this function is ultimately calling. This is really just a small adapter for when we need to use Arbitrary to generate a config, and it feels out of place here. The only place we need to actually do that is in the fuzz target itself, so lets just inline it into the fuzz_target! invocation in fuzz/fuzz_targets/table_ops.rs.

Yea makes sense! I guess I just updated the previous function which was in this file

fitzgen · 2025-07-21T18:50:31Z

fuzz/Cargo.toml


 [dependencies]
+mutatis = { workspace = true }
+bincode = "2.0.1"


We should use postcard instead of bincode here, because we already depend on it in the workspace and don't need to worry about auditing or anything.

Suggested change

bincode = "2.0.1"

postcard = { workspace = true }

fitzgen · 2025-07-21T18:51:47Z

fuzz/fuzz_targets/table_ops.rs

+        bincode::decode_from_slice::<(u64, TableOps), _>(data, bincode::config::standard())
+            .map_or_else(|_err| (0, TableOps::default()), |(tuple, _)| tuple);


Slight simplification:

Suggested change

bincode::decode_from_slice::<(u64, TableOps), _>(data, bincode::config::standard())

.map_or_else(|_err| (0, TableOps::default()), |(tuple, _)| tuple);

bincode::decode_from_slice::<(u64, TableOps), _>(data, bincode::config::standard())

.ok()

.unwrap_or_default();

This is nice!

fitzgen · 2025-07-21T18:55:13Z

crates/fuzzing/src/generators/table_ops.rs

+    /// Pops from the vector of the opcodes and returns bool
+    pub fn pop(&mut self) -> bool {
+        self.ops.pop().is_some()
+    }


Nitpicks:

Newline between methods, as elsewhere in the file

"returns bool" is not very descriptive, the doc comment should describe what the boolean result means.

I just wanted it to pass the clippy haha. Thanks!

fitzgen · 2025-07-21T18:55:55Z

crates/fuzzing/Cargo.toml

 wasmtime-test-util = { workspace = true, features = ['wast'] }

 [dependencies]
+bincode = "2.0.1"


postcard here too:

Suggested change

bincode = "2.0.1"

postcard = { workspace = true }

khagan-karimov · 2025-07-21T19:10:11Z

Thanks! Working on them!

github-actions · 2025-07-21T21:46:33Z

Subscribe to Label Action

cc @fitzgen

This issue or pull request has been labeled: "fuzzing"

Thus the following users have been cc'd because of the following labels:

fitzgen: fuzzing

To subscribe or unsubscribe from this label, edit the .github/subscribe-to-label.json configuration file.

Learn more.

fitzgen

Very close!

We should also remove table_ops from the misc fuzz target as part of this PR, as it will be redundant.

With the comment below addressed, this should be good to merge.

Thanks!

fitzgen · 2025-07-25T20:19:20Z

fuzz/fuzz_targets/table_ops.rs

+use wasmtime_fuzzing::generators::table_ops::TableOps;
+use wasmtime_fuzzing::oracles::table_ops;
+
+fuzz_target!(|input: (u64, TableOps)| {


We don't want the fuzz target to take structured types directly, as those get generated via Arbitrary, and we want to do our serialization- and mutation-based thing here.

Instead we should do something like this:

fuzz_target!(|data: &[u8]| { let Ok((seed, ops)) = postcard::from_bytes::<(u64, TableOps)>(data) else { return; } // As before: Make an RNG from the seed, fill the buf with random // data, make an `Unstructured`, call `Config::arbitrary_take_rest`, // and finally invoke `oracles::table_ops(config, ops)`. });

Aside: once this PR lands, we should probably remove the Arbitrary implementation for TableOps as we won't be using it anymore and removing it will make usage footguns like this one disappear.

…l comments

…t gives some dependecy error. Will be addressed later

fitzgen · 2025-07-28T20:48:03Z

@khagankhan it looks like the Cargo.lock is still updating all dependencies. Do you have a tool that is doing that locally?

khagankhan · 2025-07-28T20:51:00Z

I ran them locally and passed. Let us see!!

khagankhan · 2025-07-28T21:04:04Z

@fitzgen Done ✅

fitzgen

Thanks!

alexcrichton · 2025-07-30T15:01:52Z

Would it be possible to re-integrate the table_ops fuzzer back into the main "misc" fuzzer?

fitzgen · 2025-07-30T15:28:52Z

Unfortunately, we can't because it is using mutation-based fuzzing via mutatis now, not generative-based fuzzing via arbitrary. I think that's fine though because it is going to be gaining more GC-specific features and will start exploring new code paths now, rather than just the same paths it has been executing for a long time.

alexcrichton · 2025-07-30T15:56:05Z

Sounds good to me 👍

* Add fuzzer integration for gc/mutatis * Replace bincode with postcard. Inline fuzz_mutate. Address other small comments * Update Cargo.lock after rebase * Update rng.gen to rng.fill to avoid deprecation failure * Remove table_ops from misc. Update fuzz_target. Keep Arbitrary impl it gives some dependecy error. Will be addressed later * Update Cargo.lock to match upstream/main * Regenerate Cargo.lock after rebase and dependency changes * Reset Cargo.lock to upstream/main to preserve cargo-deny compatibility * Update dependencies --------- Co-authored-by: Khagan Karimov <[email protected]>

khagankhan requested review from a team as code owners July 21, 2025 16:56

khagankhan requested review from fitzgen and removed request for a team July 21, 2025 16:56

fitzgen reviewed Jul 21, 2025

View reviewed changes

github-actions bot added the fuzzing Issues related to our fuzzing infrastructure label Jul 21, 2025

khagankhan force-pushed the integrate-gc-fuzzer branch from 07f2601 to 2a725fb Compare July 25, 2025 01:54

fitzgen reviewed Jul 25, 2025

View reviewed changes

khagankhan and others added 6 commits July 28, 2025 19:16

Add fuzzer integration for gc/mutatis

bda5717

Replace bincode with postcard. Inline fuzz_mutate. Address other smal…

6031978

…l comments

Update Cargo.lock after rebase

dc9376c

Update rng.gen to rng.fill to avoid deprecation failure

e2c3c31

Remove table_ops from misc. Update fuzz_target. Keep Arbitrary impl i…

58d9879

…t gives some dependecy error. Will be addressed later

Update Cargo.lock to match upstream/main

b08fe60

khagankhan force-pushed the integrate-gc-fuzzer branch from 2e0cfbf to b08fe60 Compare July 28, 2025 19:18

Khagan Karimov added 2 commits July 28, 2025 19:22

Regenerate Cargo.lock after rebase and dependency changes

f635247

Reset Cargo.lock to upstream/main to preserve cargo-deny compatibility

a132e22

Update dependencies

dabc80d

fitzgen approved these changes Jul 28, 2025

View reviewed changes

fitzgen added this pull request to the merge queue Jul 28, 2025

Merged via the queue into bytecodealliance:main with commit 6047d27 Jul 28, 2025
43 checks passed

		bincode::decode_from_slice::<(u64, TableOps), _>(data, bincode::config::standard())
		.map_or_else(\|_err\| (0, TableOps::default()), \|(tuple, _)\| tuple);

Add fuzzer integration for gc/mutatis #11290

Add fuzzer integration for gc/mutatis #11290

Uh oh!

Conversation

khagankhan commented Jul 21, 2025

Uh oh!

fitzgen left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

khagan-karimov commented Jul 21, 2025

Uh oh!

github-actions bot commented Jul 21, 2025

Subscribe to Label Action

Uh oh!

fitzgen left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fitzgen commented Jul 28, 2025

Uh oh!

khagankhan commented Jul 28, 2025

Uh oh!

khagankhan commented Jul 28, 2025

Uh oh!

fitzgen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alexcrichton commented Jul 30, 2025

Uh oh!

fitzgen commented Jul 30, 2025

Uh oh!

alexcrichton commented Jul 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants