From 1155d9b53008c83850fb519e8d6634f3ab95c82b Mon Sep 17 00:00:00 2001 From: Alon Zakai Date: Wed, 15 Apr 2026 09:10:06 -0700 Subject: [PATCH 1/7] fix --- scripts/fuzz_opt.py | 38 +++++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 15 deletions(-) diff --git a/scripts/fuzz_opt.py b/scripts/fuzz_opt.py index bf0892be681..1c698a15387 100755 --- a/scripts/fuzz_opt.py +++ b/scripts/fuzz_opt.py @@ -2107,8 +2107,9 @@ def get_relevant_lines(wat): # This reads wasm+js combinations from the test/js_wasm directory, so as new # testcases are added there, this will fuzz them. # -# Note that bugs found by this fuzzer require BINARYEN_TRUST_GIVEN_WASM=1 in the -# env for reduction. TODO: simplify this +# Note that bugs found by this fuzzer require BINARYEN_PIEJS_WASM=1 in the +# env for reduction. TODO: simplify this, and show it when the fuzzer prints out +# the command to reduce. class PreserveImportsExportsJS(TestCaseHandler): frequency = 1 @@ -2116,9 +2117,9 @@ def handle_pair(self, input, before_wasm, after_wasm, opts): try: self.do_handle_pair(input, before_wasm, after_wasm, opts) except Exception as e: - if not os.environ.get('BINARYEN_TRUST_GIVEN_WASM'): - # We errored, and we were not given a wasm file to trust as we - # reduce, so this is the first time we hit an error. Save the + if not os.environ.get('BINARYEN_PIEJS_WASM'): + # We errored, and we were not in the middle of reducing a given + # file, so this is the first time we hit an error. Save the # pre wasm file, the one we began with, as `before_wasm`, so # that the reducer will make us proceed exactly from there. shutil.copyfile(self.pre_wasm, before_wasm) @@ -2172,9 +2173,10 @@ def do_handle_pair(self, input, before_wasm, after_wasm, opts): # If we were given a wasm file, use that instead of all the above. We # do this now, after creating pre_wasm, because we still need to consume # all the randomness normally. - if os.environ.get('BINARYEN_TRUST_GIVEN_WASM'): - print('using given wasm', before_wasm) - pre_wasm = before_wasm + given_wasm = os.environ.get('BINARYEN_PIEJS_WASM') + if given_wasm: + print('using BINARYEN_PIEJS_WASM', given_wasm) + pre_wasm = given_wasm # Pick a vm and run before we optimize the wasm. vms = [ @@ -2913,14 +2915,21 @@ def get_random_opts(): echo "The following value should be >0:" -if [ -z "$BINARYEN_FIRST_WASM" ]; then - # run the command normally - ./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} {seed} {temp_wasm} > o 2> e -else - # BINARYEN_FIRST_WASM was provided so we should actually reduce the *second* +if [ -n "$BINARYEN_FIRST_WASM" ]; then + # BINARYEN_FIRST_WASM was provided, so we should actually reduce the *second* # file. pass the first one in as the main file, and use the env var for the # second. BINARYEN_SECOND_WASM={temp_wasm} ./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} {seed} $BINARYEN_FIRST_WASM > o 2> e +#elif [ -n "$BINARYEN_PIEJS_WASM" ]; then + # BINARYEN_PIEJS_WASM was provided, so we want to give that fuzzer the actual + # file we are reducing. All other fuzzers should *not* be given this file, as + # it may not even be valid for them (that fuzzer uses special js/wasm + # combinations. We therefore provide the temp wasm file to BINARYEN_PIEJS_WASM + # and *not* as a Python argument after the seed. + BINARYEN_PIEJS_WASM={temp_wasm} ./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} {seed} > o 2> e +#else + # run the command normally + ./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} {seed} {temp_wasm} > o 2> e fi echo " " $? @@ -2948,8 +2957,7 @@ def get_random_opts(): # # You may also need to add --timeout 5 or such if the testcase is a slow one. # -# If the testcase handler uses a second wasm file, you may be able to reduce it -# using BINARYEN_SECOND_WASM. +# For reducing Two and PreserveImportsExportsJS, see the comments there. # ''') From f12ebdd2779d9ff6e3ef3bb013681ab0b623e05d Mon Sep 17 00:00:00 2001 From: Alon Zakai Date: Wed, 15 Apr 2026 09:12:35 -0700 Subject: [PATCH 2/7] fix --- scripts/fuzz_opt.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/fuzz_opt.py b/scripts/fuzz_opt.py index 1c698a15387..960906eb658 100755 --- a/scripts/fuzz_opt.py +++ b/scripts/fuzz_opt.py @@ -2920,7 +2920,7 @@ def get_random_opts(): # file. pass the first one in as the main file, and use the env var for the # second. BINARYEN_SECOND_WASM={temp_wasm} ./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} {seed} $BINARYEN_FIRST_WASM > o 2> e -#elif [ -n "$BINARYEN_PIEJS_WASM" ]; then +elif [ -n "$BINARYEN_PIEJS_WASM" ]; then # BINARYEN_PIEJS_WASM was provided, so we want to give that fuzzer the actual # file we are reducing. All other fuzzers should *not* be given this file, as # it may not even be valid for them (that fuzzer uses special js/wasm From 3a3c4bfb3d304b9df37b037687d53a985bc617d5 Mon Sep 17 00:00:00 2001 From: Alon Zakai Date: Wed, 15 Apr 2026 09:17:21 -0700 Subject: [PATCH 3/7] fix --- scripts/fuzz_opt.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/fuzz_opt.py b/scripts/fuzz_opt.py index 960906eb658..dae3aaf2b2a 100755 --- a/scripts/fuzz_opt.py +++ b/scripts/fuzz_opt.py @@ -2927,7 +2927,7 @@ def get_random_opts(): # combinations. We therefore provide the temp wasm file to BINARYEN_PIEJS_WASM # and *not* as a Python argument after the seed. BINARYEN_PIEJS_WASM={temp_wasm} ./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} {seed} > o 2> e -#else +else # run the command normally ./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} {seed} {temp_wasm} > o 2> e fi From 0587c3349d5d53ad3ee207691b280e0df899fece Mon Sep 17 00:00:00 2001 From: Alon Zakai Date: Fri, 17 Apr 2026 08:18:46 -0700 Subject: [PATCH 4/7] clarify --- scripts/fuzz_opt.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/fuzz_opt.py b/scripts/fuzz_opt.py index dae3aaf2b2a..2eb8b5e831f 100755 --- a/scripts/fuzz_opt.py +++ b/scripts/fuzz_opt.py @@ -2152,9 +2152,9 @@ def do_handle_pair(self, input, before_wasm, after_wasm, opts): # Make sure the testcase runs by itself - there should be no invalid # testcases. - original_wasm = 'orig.wasm' - run([in_bin('wasm-opt'), wat_file, '-o', original_wasm] + FEATURE_OPTS) - D8().run_js(js_file, original_wasm) + initial_wasm = 'initial.wasm' + run([in_bin('wasm-opt'), wat_file, '-o', initial_wasm] + FEATURE_OPTS) + D8().run_js(js_file, initial_wasm) # Modify the initial wat to get the pre-optimizations wasm. pre_wasm = abspath('pre.wasm') From 9605250f1534c878d1b184053b06a4623865fae1 Mon Sep 17 00:00:00 2001 From: Alon Zakai Date: Fri, 17 Apr 2026 08:21:09 -0700 Subject: [PATCH 5/7] clarify --- scripts/fuzz_opt.py | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/fuzz_opt.py b/scripts/fuzz_opt.py index 2eb8b5e831f..ab9e1102b4c 100755 --- a/scripts/fuzz_opt.py +++ b/scripts/fuzz_opt.py @@ -2122,6 +2122,7 @@ def handle_pair(self, input, before_wasm, after_wasm, opts): # file, so this is the first time we hit an error. Save the # pre wasm file, the one we began with, as `before_wasm`, so # that the reducer will make us proceed exactly from there. + print(f'copying {self.pre_wasm} to original for reduction: {before_wasm}') shutil.copyfile(self.pre_wasm, before_wasm) raise e From 17cc69070530c35951815eec0a5652052f8ccf3a Mon Sep 17 00:00:00 2001 From: Alon Zakai Date: Fri, 17 Apr 2026 08:24:33 -0700 Subject: [PATCH 6/7] clarify --- scripts/fuzz_opt.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/scripts/fuzz_opt.py b/scripts/fuzz_opt.py index ab9e1102b4c..f98605e63c0 100755 --- a/scripts/fuzz_opt.py +++ b/scripts/fuzz_opt.py @@ -2869,7 +2869,12 @@ def get_random_opts(): # longer working on the original test case but modified one, which # is likely to be called within wasm-reduce script itself, so # original.wasm and reduce.sh should not be overwritten. - if not given_wasm: + # + # We must also consider the case of BINARYEN_PIEJS_WASM as us being + # given a wasm file. We are given one in this case, but only for + # that particular fuzzer, hence it is passed in through an env var + # and not the usual mechanism. + if not given_wasm and not os.environ.get('BINARYEN_PIEJS_WASM'): # We can't do this if a.wasm doesn't exist, which can be the # case if we failed to even generate the wasm. if not os.path.exists('a.wasm'): @@ -2895,6 +2900,7 @@ def get_random_opts(): # the side, so that we can autoreduce using the name "a.wasm" # which we use internally) original_wasm = abspath('original.wasm') + print(f'copying a.wasm to original for reduction: {original_wasm}') shutil.copyfile('a.wasm', original_wasm) # write out a useful reduce.sh auto_init = '' From 5963634c342e4387c492d42be0904fb76f752512 Mon Sep 17 00:00:00 2001 From: Alon Zakai Date: Fri, 17 Apr 2026 09:36:55 -0700 Subject: [PATCH 7/7] typo --- scripts/fuzz_opt.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/fuzz_opt.py b/scripts/fuzz_opt.py index f98605e63c0..66a01d86a1d 100755 --- a/scripts/fuzz_opt.py +++ b/scripts/fuzz_opt.py @@ -2931,7 +2931,7 @@ def get_random_opts(): # BINARYEN_PIEJS_WASM was provided, so we want to give that fuzzer the actual # file we are reducing. All other fuzzers should *not* be given this file, as # it may not even be valid for them (that fuzzer uses special js/wasm - # combinations. We therefore provide the temp wasm file to BINARYEN_PIEJS_WASM + # combinations). We therefore provide the temp wasm file to BINARYEN_PIEJS_WASM # and *not* as a Python argument after the seed. BINARYEN_PIEJS_WASM={temp_wasm} ./scripts/fuzz_opt.py {auto_init} --binaryen-bin {binaryen_bin} {seed} > o 2> e else