translate-to-fuzz must always generate a valid module Aborted (core dumped)

[fitzgen]

I have found that wasm-opt -ttf will assert that it generates valid wasm modules, but that it sometimes fails this assertion:

$ hexdump "/tmp/.tmppjFvqn"
0000000 b428 2818 1d77 51ce bf5d 1978 9a9c 3c4a
0000010 62c7 fcc0 9b0d 9c6c 6a23 8b2b 051e 2b62
0000020 9a42 27bb 3aac b79d 36d2 f4e4 2dec c341
0000030 e139 21be 86bc e08b 67de 73ad 61f6 67a9
0000040

$ "wasm-opt" "/tmp/.tmppjFvqn" "-o" "/tmp/.tmp2ECuZU" "--enable-threads" "--enable-bulk-memory" "--enable-simd" "-ttf" "--emit-text" "--disable-sign-ext"
[wasm-validator error in function $func_5] unexpected false: all used features should be allowed, on 
[i64] (i64.extend16_s
 [i64] (i64.const -3783)
)
(module
 (type $FUNCSIG$i (func (result i32)))
 (type $FUNCSIG$vi (func (param i32)))
 (type $FUNCSIG$vj (func (param i64)))
 (type $FUNCSIG$vf (func (param f32)))
 (type $FUNCSIG$vd (func (param f64)))
 (type $FUNCSIG$jiViVV (func (param i32 v128 i32 v128 v128) (result i64)))
 (import "fuzzing-support" "log-i32" (func $log-i32 (param i32)))
 (import "fuzzing-support" "log-i64" (func $log-i64 (param i64)))
 (import "fuzzing-support" "log-f32" (func $log-f32 (param f32)))
 (import "fuzzing-support" "log-f64" (func $log-f64 (param f64)))
 (memory $0 1 1)
 (data passive "\ac\14\e0\c4\'")
 (table $0 0 funcref)
 (global $global$0 (mut i32) (i32.const 224))
 (global $global$1 (mut f32) (f32.const -4294967296))
 (global $global$2 (mut f32) (f32.const -18654))
 (global $hangLimit (mut i32) (i32.const 10))
 (export "hashMemory" (func $hashMemory))
 (export "func_5" (func $func_5))
 (export "hangLimitInitializer" (func $hangLimitInitializer))
 (func $hashMemory (; 4 ;) (type $FUNCSIG$i) (result i32)
  (local $0 i32)
  (local.set $0
   (i32.const 5381)
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=1
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=2
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=3
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=4
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=5
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=6
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=7
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=8
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=9
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=10
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=11
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=12
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=13
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=14
     (i32.const 0)
    )
   )
  )
  (local.set $0
   (i32.xor
    (i32.add
     (i32.shl
      (local.get $0)
      (i32.const 5)
     )
     (local.get $0)
    )
    (i32.load8_u offset=15
     (i32.const 0)
    )
   )
  )
  (local.get $0)
 )
 (func $func_5 (; 5 ;) (type $FUNCSIG$jiViVV) (param $0 i32) (param $1 v128) (param $2 i32) (param $3 v128) (param $4 v128) (result i64)
  (local $5 i64)
  (local $6 v128)
  (local $7 f32)
  (local $8 f32)
  (local $9 i64)
  (block
   (if
    (i32.eqz
     (global.get $hangLimit)
    )
    (return
     (i64.const 8)
    )
   )
   (global.set $hangLimit
    (i32.sub
     (global.get $hangLimit)
     (i32.const 1)
    )
   )
  )
  (i64.extend16_s
   (i64.const -3783)
  )
 )
 (func $hangLimitInitializer (; 6 ;)
  (global.set $hangLimit
   (i32.const 10)
  )
 )
)
translate-to-fuzz must always generate a valid moduleAborted (core dumped)

[kripken]

Thanks for the bug report!

Is there a quick command to turn that hexdump into binary? From some searching I see that xxd -r would reverse an xxd dump but it doesn't work on hexdump output it seems.

[fitzgen]

Is there a quick command to turn that hexdump into binary? From some searching I see that xxd -r would reverse an xxd dump but it doesn't work on hexdump output it seems.

I'm not sure :-/ I originally cated it, but that output was pretty useless since it wasn't escaped.

---

I think this is related to passing the --disable-sign-ext flag. I can't seem to reproduce without that.

[kripken]

Hmm, can you attach the binary here directly? Or does github not allow arbitrary binaries?

Yeah, could be something with the sign ext feature is wrong. Like maybe we emit code for it even when disabled. scripts/fuzz_opt.py should check all flag combos now, though, so I'm puzzled - but maybe we're missing something in the fuzzer too :)

[fitzgen]

Ok, here you go: seed.txt

[kripken]

Great, thanks @fitzgen!

Ok, this command is enough to show the problem:

bin/wasm-opt seed.txt --enable-threads --enable-bulk-memory --enable-simd -ttf

I guess that's why the fuzzer didn't notice it - need all three of those flags together (!) to hit it.

Proposed fix in #2258