Fuzz wide arithmetic instructions

src/tools/fuzzing.h

@@ -477,6 +477,9 @@ class TranslateToFuzzReader {
   Expression* makeGlobalGet(Type type);
   Expression* makeGlobalSet(Type type);
   Expression* makeTupleMake(Type type);
+  Expression* makeWideIntAddSub(Type type);
+  Expression* makeWideIntMul(Type type);
+  Expression* makeWideIntExpression(Type type);
   Expression* makeTupleExtract(Type type);
   Expression* makePointer();
   Expression* makeNonAtomicLoad(Type type);
@@ -493,7 +496,18 @@ class TranslateToFuzzReader {
   // able to emit a literal Const, like say if the type is a function reference
   // then we may emit a RefFunc, but also we may have other requirements, like
   // we may add a GC cast to fixup the type.
-  Expression* makeConst(Type type);
+  Expression* makeConst(Type type, bool isGlobalInitializer = false);
+
+  // Emit a constant expression for a given type, as best we can. We may not be
+  // able to emit a literal Const, like say if the type is a function reference
+  // then we may emit a RefFunc, but also we may have other requirements, like
+  // we may add a GC cast to fixup the type.
+  //
+  // This variant of `makeConst` is here so we can reference it as a pointer to
+  // a class method in _makeConcrete.
+  Expression* makeConstForNonGlobal(Type type) {
+    return makeConst(type, false);
+  }
 
   // Generate reference values. One function handles basic types, and the other
   // compound ones.

src/tools/fuzzing/fuzzing.cpp

@@ -722,7 +722,7 @@ void TranslateToFuzzReader::setupGlobals() {
         // Remove import info from imported globals, and give them a simple
         // initializer.
         global->module = global->base = Name();
-        global->init = makeConst(global->type);
+        global->init = makeConst(global->type, /*isGlobalInitializer=*/true);
       }
     } else {
       // If the initialization used an imported global that we made
@@ -733,7 +733,8 @@ void TranslateToFuzzReader::setupGlobals() {
         auto gets = FindAll<GlobalGet>(global->init);
         for (auto& get : gets.list) {
           if (!wasm.getGlobal(get->name)->imported()) {
-            global->init = makeConst(global->type);
+            global->init =
+              makeConst(global->type, /*isGlobalInitializer=*/true);
             break;
           }
         }
@@ -780,7 +781,7 @@ void TranslateToFuzzReader::setupGlobals() {
         // For now we disallow anything but tuple.make at the top level of tuple
         // globals (see details in wasm-binary.cpp). In the future we may allow
         // global.get or other things here.
-        global->init = makeConst(global->type);
+        global->init = makeConst(global->type, /*isGlobalInitializer=*/true);
         assert(global->init->is<TupleMake>());
       }
       if (!FindAll<RefAs>(global->init).list.empty() ||
@@ -794,7 +795,7 @@ void TranslateToFuzzReader::setupGlobals() {
         // Likewise, if we see cont.new, we must switch as well. That can happen
         // if a nested struct we create has a continuation field, for example.
         global->type = getMVPType();
-        global->init = makeConst(global->type);
+        global->init = makeConst(global->type, /*isGlobalInitializer=*/true);
       }
     }
 
@@ -2761,7 +2762,7 @@ Expression* TranslateToFuzzReader::_makeConcrete(Type type) {
               WeightedOption{&Self::makeLocalGet, VeryImportant},
               WeightedOption{&Self::makeLocalSet, VeryImportant},
               WeightedOption{&Self::makeGlobalGet, Important},
-              WeightedOption{&Self::makeConst, Important});
+              WeightedOption{&Self::makeConstForNonGlobal, Important});
   if (canMakeControlFlow) {
     options
       .add(FeatureSet::MVP,
@@ -2813,7 +2814,11 @@ Expression* TranslateToFuzzReader::_makeConcrete(Type type) {
                 &Self::makeStringGet);
   }
   if (type.isTuple()) {
-    options.add(FeatureSet::Multivalue, &Self::makeTupleMake);
+    if (type == Types::getI64Pair() && oneIn(2)) {
+      options.add(FeatureSet::WideArithmetic, &Self::makeWideIntExpression);
+    } else {
+      options.add(FeatureSet::Multivalue, &Self::makeTupleMake);
+    }
   }
   if (type.isRef()) {
     auto heapType = type.getHeapType();
@@ -3496,6 +3501,30 @@ Expression* TranslateToFuzzReader::makeTupleMake(Type type) {
   return builder.makeTupleMake(std::move(elements));
 }
 
+Expression* TranslateToFuzzReader::makeWideIntAddSub(Type type) {
+  assert(wasm.features.hasWideArithmetic());
+  assert(type == Types::getI64Pair());
+  auto op = oneIn(2) ? AddInt128 : SubInt128;
+  auto* leftLow = make(Type::i64);
+  auto* leftHigh = make(Type::i64);
+  auto* rightLow = make(Type::i64);
+  auto* rightHigh = make(Type::i64);
+  return builder.makeWideIntAddSub(op, leftLow, leftHigh, rightLow, rightHigh);
+}
+
+Expression* TranslateToFuzzReader::makeWideIntMul(Type type) {
+  assert(wasm.features.hasWideArithmetic());
+  assert(type == Types::getI64Pair());
+  auto op = oneIn(2) ? MulWideSInt64 : MulWideUInt64;
+  auto* left = make(Type::i64);
+  auto* right = make(Type::i64);
+  return builder.makeWideIntMul(op, left, right);
+}
+
+Expression* TranslateToFuzzReader::makeWideIntExpression(Type type) {
+  return oneIn(2) ? makeWideIntAddSub(type) : makeWideIntMul(type);
+}
+
 Expression* TranslateToFuzzReader::makeTupleExtract(Type type) {
   // Tuples can require locals in binary format conversions.
   if (!type.isDefaultable()) {
@@ -4075,7 +4104,8 @@ Expression* TranslateToFuzzReader::makeRefFuncConst(Type type) {
   return builder.makeRefFunc(func->name);
 }
 
-Expression* TranslateToFuzzReader::makeConst(Type type) {
+Expression* TranslateToFuzzReader::makeConst(Type type,
+                                             bool isGlobalInitializer) {
   if (type.isRef()) {
     assert(wasm.features.hasReferenceTypes());
     // With a low chance, just emit a null if that is valid.
@@ -4090,10 +4120,13 @@ Expression* TranslateToFuzzReader::makeConst(Type type) {
     } else {
       return makeCompoundRef(type);
     }
+  } else if (type == Types::getI64Pair() && oneIn(2) && !isGlobalInitializer &&
+             wasm.features.hasWideArithmetic()) {
+    return makeWideIntExpression(type);
   } else if (type.isTuple()) {
     std::vector<Expression*> operands;
     for (const auto& t : type) {
-      operands.push_back(makeConst(t));
+      operands.push_back(makeConst(t, isGlobalInitializer));
     }
     return builder.makeTupleMake(std::move(operands));
   } else {
@@ -6426,9 +6459,13 @@ Type TranslateToFuzzReader::getMVPType() {
 }
 
 Type TranslateToFuzzReader::getTupleType() {
+  if (wasm.features.hasWideArithmetic() && oneIn(2)) {
+    return Types::getI64Pair();
+  }
+
   std::vector<Type> elements;
-  size_t maxElements = 2 + upTo(fuzzParams->MAX_TUPLE_SIZE - 1);
-  for (size_t i = 0; i < maxElements; ++i) {
+  size_t numElements = 2 + upTo(fuzzParams->MAX_TUPLE_SIZE - 2);
+  for (size_t i = 0; i < numElements; ++i) {
     auto type = getSingleConcreteType();
     // Don't add a non-defaultable type into a tuple, as currently we can't
     // spill them into locals (that would require a "let").

src/tools/fuzzing/heap-types.cpp

@@ -422,7 +422,7 @@ struct HeapTypeGeneratorImpl {
   }
 
   Type generateTupleType(Shareability share) {
-    std::vector<Type> types(2 + rand.upTo(params.MAX_TUPLE_SIZE - 1));
+    std::vector<Type> types(2 + rand.upTo(params.MAX_TUPLE_SIZE - 2));
     for (auto& type : types) {
       type = generateSingleType(share);
     }

src/tools/fuzzing/parameters.cpp

@@ -26,7 +26,7 @@ void FuzzParams::setDefaults() {
 
   MAX_GLOBALS = 30;
 
-  MAX_TUPLE_SIZE = 6;
+  MAX_TUPLE_SIZE = 7;
 
   MAX_STRUCT_SIZE = 6;
 

test/passes/translate-to-fuzz_all-features_metrics_noprint.txt

@@ -1,55 +1,51 @@
 Metrics
 total
- [exports]      : 10      
- [funcs]        : 5       
+ [exports]      : 11      
+ [funcs]        : 13      
  [globals]      : 2       
- [imports]      : 13      
+ [imports]      : 12      
  [memories]     : 1       
  [memory-data]  : 16      
- [table-data]   : 2       
+ [table-data]   : 4       
  [tables]       : 2       
- [tags]         : 3       
- [total]        : 704     
- [vars]         : 26      
- ArrayNewFixed  : 6       
- AtomicFence    : 3       
- Binary         : 30      
- Block          : 130     
- BrOn           : 6       
- Break          : 23      
- Call           : 30      
+ [tags]         : 2       
+ [total]        : 610     
+ [vars]         : 49      
+ ArrayNewFixed  : 3       
+ AtomicCmpxchg  : 1       
+ AtomicFence    : 1       
+ Binary         : 38      
+ Block          : 111     
+ BrOn           : 1       
+ Break          : 10      
+ Call           : 18      
+ CallIndirect   : 3       
  CallRef        : 2       
- Const          : 103     
- Drop           : 10      
- GlobalGet      : 44      
- GlobalSet      : 42      
- I31Get         : 3       
- If             : 39      
+ Const          : 106     
+ Drop           : 9       
+ GlobalGet      : 49      
+ GlobalSet      : 48      
+ If             : 33      
  Load           : 6       
- LocalGet       : 25      
- LocalSet       : 27      
- Loop           : 16      
- MemoryInit     : 1       
- Nop            : 7       
- Pop            : 6       
- RefEq          : 1       
- RefFunc        : 11      
- RefI31         : 10      
- RefNull        : 10      
- RefTest        : 7       
+ LocalGet       : 21      
+ LocalSet       : 18      
+ Loop           : 11      
+ Nop            : 12      
+ Pop            : 4       
+ RefEq          : 2       
+ RefFunc        : 7       
+ RefI31         : 8       
+ RefNull        : 2       
  Return         : 3       
- Select         : 1       
- Store          : 2       
- StringConst    : 7       
- StringEq       : 1       
+ SIMDExtract    : 3       
+ Select         : 3       
+ Store          : 3       
+ StringConst    : 3       
  StringMeasure  : 2       
- StringWTF16Get : 2       
- StructNew      : 8       
- TableSet       : 2       
- Throw          : 2       
- Try            : 6       
- TryTable       : 6       
- TupleExtract   : 3       
- TupleMake      : 5       
- Unary          : 35      
- Unreachable    : 21      
+ StringWTF16Get : 1       
+ StructNew      : 5       
+ TableSet       : 1       
+ Try            : 4       
+ TryTable       : 2       
+ Unary          : 32      
+ Unreachable    : 24