Skip to content

Fuzz wide arithmetic instructions#8661

Merged
stevenfontanella merged 8 commits into
mainfrom
wide-arithmetic-fuzzer
May 27, 2026
Merged

Fuzz wide arithmetic instructions#8661
stevenfontanella merged 8 commits into
mainfrom
wide-arithmetic-fuzzer

Conversation

@stevenfontanella
Copy link
Copy Markdown
Member

@stevenfontanella stevenfontanella commented Apr 29, 2026

Part of #8544. Continued in #8781.

Drive-by fix: ensure that tuples aren't generated with a size larger than TUPLE_MAX_SIZE:

-  size_t maxElements = 2 + upTo(fuzzParams->MAX_TUPLE_SIZE - 1);
+  size_t maxElements = 2 + upTo(fuzzParams->MAX_TUPLE_SIZE - 2);

After increasing the seed file size, the wide arithmetic instructions were generated (ctrl + f "wideint"), but fails in CI due to #8770. For now I leave the seed file unchanged without showing that the wide arithmetic instructions are generated in the golden file.

Also generated a new seed for test/lit/fuzz-import.wast since it was failing after these changes, seemingly due to bad luck (which the test file mentions is a possibility).

Base automatically changed from wide-arithmetic-mul to main May 4, 2026 18:17
@stevenfontanella stevenfontanella force-pushed the wide-arithmetic-fuzzer branch 2 times, most recently from 9e05b99 to de26241 Compare May 4, 2026 22:56
@stevenfontanella stevenfontanella changed the title Fuzzer Fuzz wide arithmetic instructions May 4, 2026
@stevenfontanella stevenfontanella force-pushed the wide-arithmetic-fuzzer branch 2 times, most recently from bbdf5da to ab7f200 Compare May 22, 2026 18:33
@stevenfontanella stevenfontanella force-pushed the wide-arithmetic-fuzzer branch from ab7f200 to c0a9e8f Compare May 22, 2026 23:32
@stevenfontanella stevenfontanella marked this pull request as ready for review May 23, 2026 19:03
@stevenfontanella stevenfontanella requested a review from a team as a code owner May 23, 2026 19:03
@stevenfontanella stevenfontanella requested review from kripken and removed request for a team May 23, 2026 19:03
Copy link
Copy Markdown
Member

@kripken kripken left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm % comments

Comment thread src/tools/fuzzing/fuzzing.cpp Outdated
if (type == Types::getI64Pair()) {
options.add(FeatureSet::WideArithmetic,
WeightedOption{&Self::makeWideIntAddSub, VeryImportant},
WeightedOption{&Self::makeWideIntMul, VeryImportant});
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why VeryImportant?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed the code a bit to skew the probabilities differently. After increasing the seed file size I see these statistics:

 ...
 SIMDLoad       : 1       
 SIMDReplace    : 2       
 SIMDShuffle    : 1       
 SIMDTernary    : 2       
 TupleExtract   : 113     
 TupleMake      : 150
 WideIntAddSub  : 1

(I can't check in the increased seed size because of #8770) It's still a lower proportion of wide arithmetic instructions than I'd like (WideIntMul doesn't appear at all). I'm a little confused on why this is because the correct type is generated for 50% of tuples:

if (wasm.features.hasWideArithmetic() && oneIn(2)) {
return Types::getI64Pair();
}
. Then if the type matches, 50% of the time a wide arithmetic instruction is generated:
if (type == Types::getI64Pair() && oneIn(2)) {
options.add(FeatureSet::WideArithmetic, &Self::makeWideIntExpression);
. So I would expect wide arithmetic instructions to appear 1/3 as often as TupleMake (25% versus 75%).

One possible reason for the difference is that TupleMake can appear in constant expressions and wide arithmetic can't. Maybe in practice a large number of tuple types appear in constant expressions rather than function bodies? Anyway the proportion of wide arithmetic instructions is comparable to some existing SIMD instructions, so I'm ok with it as-is. I'm curious if you have any thoughts in any case.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good question - I dont know. It might be worth seeing if this is a fluke on this data, and if not, looking at stack traces or debug prints to see why this happens. I'm surprised by it.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added some logging and I found that the vast majority of tuple.make instructions come from makeConst, e.g. with 171 TupleMakes generated, 165 came from makeConst and 6 did not (I guess these came from makeConcrete or something similar). With these proportions it makes sense that we'd see very few wide arithmetic instructions.

Based on this, I think we should have a follow-up fix to increase the odds of non-const expressions compared to const expressions.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interesting, thanks for looking into this!

It is possible makeConst is called from makeTrivial - we end up emitting only constants past some depth (to avoid using all the random data immediately). Not sure offhand how best to adjust that, if so.

Comment thread src/tools/fuzzing/fuzzing.cpp
@stevenfontanella
Copy link
Copy Markdown
Member Author

Tried to give wide arithmetic instructions more probability by including them in constant expressions, but I realized that they're not actually constant expressions. Let me send another update.

@stevenfontanella
Copy link
Copy Markdown
Member Author

Tried to give wide arithmetic instructions more probability by including them in constant expressions, but I realized that they're not actually constant expressions. Let me send another update.

Done.

Comment thread src/tools/fuzzing/fuzzing.cpp Outdated
Comment thread src/tools/fuzzing/fuzzing.cpp Outdated
@stevenfontanella
Copy link
Copy Markdown
Member Author

Will continue this and test the fuzzer in #8781.

@stevenfontanella stevenfontanella enabled auto-merge (squash) May 27, 2026 20:05
@stevenfontanella stevenfontanella merged commit ac6c001 into main May 27, 2026
16 checks passed
@stevenfontanella stevenfontanella deleted the wide-arithmetic-fuzzer branch May 27, 2026 20:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants