bytecodealliance / bytecodealliance/wasmtime

Tracking issue for the Cranelift CLIF-level differential fuzzer

Open
#3,050 7 comments 0 reactions 0 assignees View on GitHub
cranelift fuzzing
Dominant language
Rust
Stars
18.6k
Forks
1.8k
Avg merge
1d 18h
Merged PRs (30d)
126

Description

In #3038 we introduced the initial version of the Cranelift CLIF-level differential fuzzer.

This fuzzer generates CLIF modules that are run on the interpreter and subsequently on the host machine (assuming no traps / invalid memory accesses) comparing the outputs of each run.

Roadmap:
- [x] Initial introduction (#3038)
- [x] Generating test inputs with control flow
- [x] Generate multiple blocks and basic jump instructions (#3094)
- [x] Generate `br_table`'s and other jump table jumps (#3299)
- [ ] Generating memory loads/stores
- [x] Stack
- [x] Interpreter Support (#3187)
- [x] Fuzzer Support (#4438)
- [ ] Heap
- [x] Interpreter Support (#3302)
- [ ] Fuzzer Support
- [ ] Table
- [x] Interpreter Support (#4433)
- [ ] Fuzzer Support
- [ ] Symbols
- [ ] Interpreter Support
- [ ] Fuzzer Support
- [ ] Others
- [ ] Cross endianness loads/stores
- [ ] `notrap` MemFlags
- [ ] `aligned` MemFlags
- [ ] `readonly` MemFlags
- [ ] Generating calls
- [x] Generating LibCall's (#4782)
- [ ] Generating Function Calls
- [ ] Indirect Function Calls
- [ ] Full coverage of arithmetic ops
- [ ] Extend the codegen in the `cranelift-meta` crate to provide a table of acceptable opcodes and types
- [ ] Full coverage of SIMD ops
- [ ] Misc
- [ ] Add `SourceLoc` to instructions
- [ ] Add ValueLabels to instructions

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.