fuzzying 2M+ consistent crash with this same instruction

Fuzzer Statistics

Fuzzer state: Fuzzing (with MultiEngine)
Uptime: 0d 7h 49m 23s
Total Samples: 200468
Interesting Samples Found: 14780
Last Interesting Sample: 0d 0h 0m 54s
Valid Samples Found: 100005
Corpus Size: 14778 (global average: 14756)
Correctness Rate: 49.89% (overall: 49.89%)
Timeout Rate: 7.57% (overall: 6.95%)
Crashes Found: 34
Timeouts Hit: 13936
Coverage: 27.74%
Avg. program size: 74.62
Avg. corpus program size: 32.78
Avg. program execution time: 131ms
Connected nodes: 9
Execs / Second: 65.30
Fuzzer Overhead: 11.01%
Minimization Overhead: 63.13%
Total Execs: 2564620

[ExplorationMutator] Frequencies of outcomes:
[ExplorationMutator] Success : 56.56%
[ExplorationMutator] Cannot instrument input : 0.00%
[ExplorationMutator] Instrumented program crashed : 0.00%
[ExplorationMutator] Instrumented program failed : 33.22%
[ExplorationMutator] Instrumented program timed out: 10.22%
[ExplorationMutator] No results received : 0.00%
[ExplorationMutator] Unexpected Error : 0.00%
[ExplorationMutator] Average number of inserted explore operations: 14.00
[ExplorationMutator] Frequencies of generated operations:
[ExplorationMutator] CONSTRUCT_METHOD : 9.81%
[ExplorationMutator] TEST_IS_NAN : 0.02%
[ExplorationMutator] SIGNED_RIGHT_SHIFT : 1.41%
[ExplorationMutator] COMPARE_LESS_THAN : 0.12%
[ExplorationMutator] CONSTRUCT : 5.64%
[ExplorationMutator] SUB : 2.02%
[ExplorationMutator] CALL_METHOD : 21.82%
[ExplorationMutator] COMPARE_STRICT_EQUAL : 0.32%
[ExplorationMutator] SYMBOL_REGISTRATION : 1.55%
[ExplorationMutator] LEFT_SHIFT : 0.53%
[ExplorationMutator] COMPARE_LESS_THAN_OR_EQUAL : 0.15%
[ExplorationMutator] INC : 1.40%
[ExplorationMutator] DIV : 0.77%
[ExplorationMutator] GET_PROPERTY : 9.18%
[ExplorationMutator] COMPARE_GREATER_THAN_OR_EQUAL : 0.14%
[ExplorationMutator] UNSIGNED_RIGHT_SHIFT : 1.58%
[ExplorationMutator] CALL_FUNCTION : 2.52%
[ExplorationMutator] LOGICAL_AND : 0.90%
[ExplorationMutator] BITWISE_OR : 0.65%
[ExplorationMutator] DEC : 2.17%
[ExplorationMutator] BITWISE_NOT : 0.54%
[ExplorationMutator] NEG : 1.10%
[ExplorationMutator] MOD : 0.58%
[ExplorationMutator] ADD : 1.54%
[ExplorationMutator] LOGICAL_NOT : 0.86%
[ExplorationMutator] COMPARE_STRICT_NOT_EQUAL : 0.52%
[ExplorationMutator] DELETE_PROPERTY : 0.00%
[ExplorationMutator] LOGICAL_OR : 0.78%
[ExplorationMutator] COMPARE_NOT_EQUAL : 0.30%
[ExplorationMutator] BITWISE_AND : 0.88%
[ExplorationMutator] MUL : 0.73%
[ExplorationMutator] NULL_COALESCE : 9.86%
[ExplorationMutator] TEST_IS_FINITE : 0.01%
[ExplorationMutator] COMPARE_EQUAL : 0.32%
[ExplorationMutator] COMPARE_GREATER_THAN : 0.30%
[ExplorationMutator] BITWISE_XOR : 0.72%
[ExplorationMutator] SET_PROPERTY : 18.25%
[95850103:Fuzzer] Code generator DisposableObjectLiteralBeginGenerator might be broken. Correctness rate is only 2.49%% after 201 generated samples
[95850103:Fuzzer] Code generator DisposableObjectLiteralComputedMethodBeg might be broken. Correctness rate is only 2.49%% after 201 generated samples
[95850103:Fuzzer] Code generator DisposableObjectLiteralComputedMethodEnd might be broken. Correctness rate is only 2.49%% after 201 generated samples
[95850103:Fuzzer] Code generator DisposableObjectLiteralEndGenerator might be broken. Correctness rate is only 2.49%% after 201 generated samples
[95850103:Fuzzer] Code generator DisposableClassDefinitionBeginGenerator might be broken. Correctness rate is only 1.12%% after 535 generated samples
[95850103:Fuzzer] Code generator DisposableClassInstanceComputedMethodBeg might be broken. Correctness rate is only 1.12%% after 535 generated samples
[95850103:Fuzzer] Code generator DisposableClassInstanceComputedMethodEnd might be broken. Correctness rate is only 1.12%% after 535 generated samples
[95850103:Fuzzer] Code generator DisposableClassDefinitionEndGenerator might be broken. Correctness rate is only 1.12%% after 535 generated samples
[95850103:Fuzzer] Code generator DisposableClassDefinitionBeginGenerator might be broken. Correctness rate is only 0.42%% after 476 generated samples
[95850103:Fuzzer] Code generator DisposableClassInstanceComputedMethodBeg might be broken. Correctness rate is only 0.42%% after 476 generated samples
[95850103:Fuzzer] Code generator DisposableClassInstanceComputedMethodEnd might be broken. Correctness rate is only 0.42%% after 476 generated samples
[95850103:Fuzzer] Code generator DisposableClassDefinitionEndGenerator might be broken. Correctness rate is only 0.42%% after 476 generated samples
[95850103:Fuzzer] Code generator PrivatePropertyRetrievalGenerator might have too restrictive dynamic requirements. Its successful invocation rate is only 0.26%% after 385 invocations
[95850103:Fuzzer] Code generator PrivatePropertyAssignmentGenerator might have too restrictive dynamic requirements. Its successful invocation rate is only 0.00%% after 374 invocations
[95850103:Fuzzer] Code generator PrivatePropertyUpdateGenerator might have too restrictive dynamic requirements. Its successful invocation rate is only 0.56%% after 179 invocations
[95850103:Fuzzer] Code generator PrivateMethodCallGenerator might have too restrictive dynamic requirements. Its successful invocation rate is only 7.69%% after 234 invocations
[95850103:Fuzzer] Code generator WasmReturnCallDirectGenerator might have too restrictive dynamic requirements. Its successful invocation rate is only 2.08%% after 288 invocations
[95850103:Fuzzer] Code generator WasmReturnCallIndirectGenerator might have too restrictive dynamic requirements. Its successful invocation rate is only 4.86%% after 144 invocations
Fuzzilli/JSTyper.swift:498: Fatal error: missing type definition link for type .wasmRef(null Index 0 Func[[.wasmSimd128] => [.wasmRef(null Index 0 Func), .wasmf64, .wasmRef(null Index 0 Struct), .wasmi64]]), desc UnownedWasmTypeDescription(description: Optional(0 Func[[.wasmSimd128] => [.wasmRef(null Index 0 Func), .wasmf64, .wasmRef(null Index 0 Struct), .wasmi64]]))

💣 Program crashed: Illegal instruction at 0x00007396120e2628

Platform: x86_64 Linux (Ubuntu 24.04.4 LTS)

Thread 11 crashed:

0 0x00007396120e2628 assertionFailure(:_:file:line🎏) + 264 in libswiftCore.so
1 ProgramBuilder.WasmFunction.generateRandomWasmVar(ofType:) + 1041 in FuzzilliCli at /home/turnerhackz1/Desktop/fuzzilli-main/Sources/Fuzzilli/Base/ProgramBuilder.swift:5103:72

5101│ case .Index(_):
5102│ if type.wasmReferenceType?.nullability ?? false {
5103│ return self.wasmRefNull(typeDef: b.jsTyper.getWasmTypeDef(for: type))
│ ▲
5104│ }
5105│ case .none:

2 ProgramBuilder.WasmFunction.findOrGenerateWasmVar(ofType:) in FuzzilliCli at Sources/Fuzzilli/Base/ProgramBuilder.swift:5114:60

5112│
5113│ public func findOrGenerateWasmVar(ofType type: ILType) -> Variable {
5114│ if let result = b.randomVariable(ofType: type) ?? generateRandomWasmVar(ofType: type) {
│ ▲
5115│ return result
5116│ }

3 closure #16 in variable initialization expression of WasmCodeGenerators + 582 in FuzzilliCli at /home/turnerhackz1/Desktop/fuzzilli-main/Sources/Fuzzilli/CodeGen/WasmCodeGenerators.swift:241:39

239│ for field in typeDesc.fields {
240│ let fieldType = field.type.unpacked()
241│ let fieldValue = function.findOrGenerateWasmVar(ofType: fieldType)
│ ▲
242│ initial_fields.append(fieldValue)
243│ }

4 GeneratorAdapter1Arg.run(in:with:) in FuzzilliCli at /home/turnerhackz1/Desktop/fuzzilli-main/Sources/Fuzzilli/CodeGen/CodeGenerator.swift:36:9

34│     func run(in b: ProgramBuilder, with inputs: [Variable]) {
35│         assert(inputs.count == 1)
36│         f(b, inputs[0])                                               
  │         ▲
37│     }
38│ }

5 GeneratorStub.run(in:with:) + 107 in FuzzilliCli at /home/turnerhackz1/Desktop/fuzzilli-main/Sources/Fuzzilli/CodeGen/CodeGenerator.swift:330:17

328│ public func run(in b: ProgramBuilder, with inputs: [Variable]) -> Int {
329│ let codeSizeBeforeGeneration = b.indexOfNextInstruction()
330│ adapter.run(in: b, with: inputs)
│ ▲
331│ self.invoked()
332│ let codeSizeAfterGeneration = b.indexOfNextInstruction()

6 ProgramBuilder.run(_:) + 1272 in FuzzilliCli at /home/turnerhackz1/Desktop/fuzzilli-main/Sources/Fuzzilli/Base/ProgramBuilder.swift:2571:50

2569│ }
2570│ }
2571│ let numGeneratedInstructions = generator.run(in: self, with: inputs)
│ ▲
2572│ trace("Code generator finished")
2573│

7 ProgramBuilder.complete(generator:withBudget:) + 4488 in FuzzilliCli at /home/turnerhackz1/Desktop/fuzzilli-main/Sources/Fuzzilli/Base/ProgramBuilder.swift:2376:47

2374│
2375│ // This runs the first part of the generator.
2376│ numberOfGeneratedInstructions += self.run(generator.head)
│ ▲
2377│
2378│ // If this generator says it provides a context, it must do so, it cannot fail because we would not be able to continue with the rest of the generator.

8 ProgramBuilder.build(n:by:) + 731 in FuzzilliCli at /home/turnerhackz1/Desktop/fuzzilli-main/Sources/Fuzzilli/Base/ProgramBuilder.swift:2143:25

2141│
2142│ // TODO: think about this and if we want to split this so that we get more CodeGenerators on the same level?
2143│ let _ = complete(generator: generator!, withBudget: remainingBudget / splitFactor)
│ ▲
2144│
2145│ case .splicing:

9 CodeGenMutator.mutate(::) + 444 in FuzzilliCli at /home/turnerhackz1/Desktop/fuzzilli-main/Sources/Fuzzilli/Mutators/CodeGenMutator.swift:56:15

54│             b.adopt(instr)
55│             assert(b.numberOfVisibleVariables >= minVisibleVariables)
56│             b.build(n: defaultCodeGenerationAmount, by: .generating)  
  │               ▲
57│         }
58│     }

10 closure #1 in BaseInstructionMutator.mutate(_:using:for:) + 662 in FuzzilliCli at /home/turnerhackz1/Desktop/fuzzilli-main/Sources/Fuzzilli/Mutators/BaseInstructionMutator.swift:48:21

46│             for instr in program.code {
47│                 if toMutate.contains(instr.index) {
48│                     mutate(instr, b)                                  
  │                     ▲
49│                 } else {
50│                     b.adopt(instr)

11 specialized ProgramBuilder.adopting(_:) in FuzzilliCli at Sources/Fuzzilli/Base/ProgramBuilder.swift:1560:9

1558│ public func adopting(_ block: () -> Void) {
1559│ beginAdoption()
1560│ block()
│ ▲
1561│ endAdoption()
1562│ }

12 BaseInstructionMutator.mutate(_:using:for:) + 664 in FuzzilliCli at /home/turnerhackz1/Desktop/fuzzilli-main/Sources/Fuzzilli/Mutators/BaseInstructionMutator.swift:45:11

43│         }
44│ 
45│         b.adopting {                                                  
  │           ▲
46│             for instr in program.code {
47│                 if toMutate.contains(instr.index) {

13 Mutator.mutate(_:for:) in FuzzilliCli at Sources/Fuzzilli/Mutators/Mutator.swift:26:23

24│         let b = fuzzer.makeBuilder(forMutating: program)
25│         b.traceHeader("Mutating \(program.id) with \(name)")
26│         let program = mutate(program, using: b, for: fuzzer)          
  │                       ▲
27│         program?.contributors.insert(self)
28│         return program

14 MutationEngine.fuzzOne(_:) + 911 in FuzzilliCli at /home/turnerhackz1/Desktop/fuzzilli-main/Sources/Fuzzilli/Engines/MutationEngine.swift:56:41

54│             var mutatedProgram: Program? = nil
55│             for _ in 0..<maxAttempts {
56│                 if let result = mutator.mutate(parent, for: fuzzer) { 
  │                                         ▲
57│                     // Success!
58│                     result.contributors.formUnion(parent.contributors)

15 MultiEngine.fuzzOne(_:) + 51 in FuzzilliCli at /home/turnerhackz1/Desktop/fuzzilli-main/Sources/Fuzzilli/Engines/MultiEngine.swift:50:22

48│ 
49│     public override func fuzzOne(_ group: DispatchGroup) {
50│         activeEngine.fuzzOne(group)                                   
  │                      ▲
51│         currentIteration += 1
52│         if currentIteration % iterationsPerEngine == 0 {

16 Fuzzer.fuzzOne() + 363 in FuzzilliCli at /home/turnerhackz1/Desktop/fuzzilli-main/Sources/Fuzzilli/Fuzzer.swift:1086:20

1084│ case .fuzzing:
1085│ iterations += 1
1086│ engine.fuzzOne(fuzzGroup)
│ ▲
1087│ }
1088│

17 0x00006339879e00b9 thunk for @escaping @callee_guaranteed () -> () + 24 in FuzzilliCli
...

Backtrace took 7.41s

Illegal instruction (core dumped)

Start with Sources/Fuzzilli/Base/ProgramBuilder.swift around line 5103 and trace the missing type definition lookup reported by JSTyper.swift:498. Read the WasmCodeGenerators.swift call at line 241 and reproduce the crash under the same Wasm fuzzing path; done means this input no longer triggers the fatal assertion.