1 //! Generate a Wasm module and the configuration for generating it. 2 3 use arbitrary::{Arbitrary, Unstructured}; 4 5 /// Default module-level configuration for fuzzing Wasmtime. 6 /// 7 /// Internally this uses `wasm-smith`'s own `Config` but we further refine 8 /// the defaults here as well. 9 #[derive(Debug, Clone)] 10 #[expect(missing_docs, reason = "self-describing fields")] 11 pub struct ModuleConfig { 12 pub config: wasm_smith::Config, 13 14 // These knobs aren't exposed in `wasm-smith` at this time but are exposed 15 // in our `*.wast` testing so keep knobs here so they can be read during 16 // config-to-`wasmtime::Config` translation. 17 pub function_references_enabled: bool, 18 pub component_model_async: bool, 19 pub component_model_async_builtins: bool, 20 pub component_model_async_stackful: bool, 21 pub legacy_exceptions: bool, 22 } 23 24 impl<'a> Arbitrary<'a> for ModuleConfig { 25 fn arbitrary(u: &mut Unstructured<'a>) -> arbitrary::Result<ModuleConfig> { 26 let mut config = wasm_smith::Config::arbitrary(u)?; 27 28 // This list is intended to be the definitive source of truth for 29 // what's at least possible to fuzz within Wasmtime. This is a 30 // combination of features in `wasm-smith` where some proposals are 31 // on-by-default (as determined by fuzz input) and others are 32 // off-by-default (as they aren't stage4+). Wasmtime will default-fuzz 33 // proposals that a pre-stage-4 to test our own implementation. Wasmtime 34 // might also unconditionally disable proposals that it doesn't 35 // implement yet which are stage4+. This is intended to be an exhaustive 36 // list of all the wasm proposals that `wasm-smith` supports and the 37 // fuzzing status within Wasmtime too. 38 let _ = config.multi_value_enabled; 39 let _ = config.saturating_float_to_int_enabled; 40 let _ = config.sign_extension_ops_enabled; 41 let _ = config.bulk_memory_enabled; 42 let _ = config.reference_types_enabled; 43 let _ = config.simd_enabled; 44 let _ = config.relaxed_simd_enabled; 45 let _ = config.tail_call_enabled; 46 let _ = config.extended_const_enabled; 47 let _ = config.gc_enabled; 48 config.exceptions_enabled = false; 49 config.custom_page_sizes_enabled = u.arbitrary()?; 50 config.wide_arithmetic_enabled = u.arbitrary()?; 51 config.memory64_enabled = u.ratio(1, 20)?; 52 config.threads_enabled = u.ratio(1, 20)?; 53 // Allow multi-memory but make it unlikely 54 if u.ratio(1, 20)? { 55 config.max_memories = config.max_memories.max(2); 56 } else { 57 config.max_memories = 1; 58 } 59 // ... NB: if you add something above this line please be sure to update 60 // `docs/stability-wasm-proposals.md` 61 62 // We get better differential execution when we disallow traps, so we'll 63 // do that most of the time. 64 config.disallow_traps = u.ratio(9, 10)?; 65 66 Ok(ModuleConfig { 67 component_model_async: false, 68 component_model_async_builtins: false, 69 component_model_async_stackful: false, 70 legacy_exceptions: false, 71 function_references_enabled: config.gc_enabled, 72 config, 73 }) 74 } 75 } 76 77 impl ModuleConfig { 78 /// Uses this configuration and the supplied source of data to generate a 79 /// Wasm module. 80 /// 81 /// If a `default_fuel` is provided, the resulting module will be configured 82 /// to ensure termination; as doing so will add an additional global to the 83 /// module, the pooling allocator, if configured, must also have its globals 84 /// limit updated. 85 pub fn generate( 86 &self, 87 input: &mut Unstructured<'_>, 88 default_fuel: Option<u32>, 89 ) -> arbitrary::Result<wasm_smith::Module> { 90 let mut module = wasm_smith::Module::new(self.config.clone(), input)?; 91 92 if let Some(default_fuel) = default_fuel { 93 module.ensure_termination(default_fuel).unwrap(); 94 } 95 96 Ok(module) 97 } 98 } 99