Queued cranelift-fuzzgen enhancements

[jameysharp]

We got a large batch of new fuzz-bugs from cranelift-fuzzgen (and cranelift-icache) this week. Some of them are bugs we don't want to fix yet because they're just x64 lowerings that aren't implemented yet, or things that we do want to test eventually but haven't built all the testing infrastructure for yet. We're trying to make sure that all the bugs we do want to fix are fully dealt with before we start changing fuzzing input formats and invalidating our current test cases.

Check off these issues once they are addressed by either an already-merged fix, or by a pending PR that we aren't ready to merge yet:

• cranelift-fuzzgen fuzz bug: "assertion failed: (left == right)" #4755
  • fixed by x64: Mask shift amounts for small types #4752
• cranelift-icache fuzzbug: "internal error: entered unreachable code: Invalid OperandSize: 16" #4756
  • fixed by cranelift: Disable i128 divs on fuzzgen #4771
• cranelift-fuzzgen fuzzbug: "index out of bounds: the len is 2 but the index is 2" #4757
  • fixed by Disable funcref generation for fuzz tests with inputs #4797
• cranelift-fuzzgen fuzzbug: "interpreter failed: Error(StepError(UnknownFunction(fn0)))" #4758
  • fixed by Disable funcref generation for fuzz tests with inputs #4797
• cranelift-fuzzgen fuzzbug: "not yet implemented" #4759
  • fixed by cranelift: Avoid lowering VEX instructions with memory encodings #4768
• cranelift-fuzzgen fuzzbug: "Floating-point-exception in cranelift_filetests::function_runner::CompiledFunction::call::h6386b90d4c398abf" #4760
  • fixed by x64: Mask shift amounts for small types #4752
• cranelift-fuzzgen fuzzbug: "Segv on unknown address in cranelift_filetests::function_runner::CompiledFunction::call::ha6b9162cd2e" #4761
  • fixed by x64: Ensure that constants are always 16 bytes for XmmMem #4790
• cranelift-fuzzgen fuzzbug: called Option::unwrap() on a None value #4770
  • fixed by cranelift: Disable i128 divs on fuzzgen #4771

And these are the PRs that we need to merge when we're satisfied with our investigations of the above issues:

• cranelift: Disable i128 divs on fuzzgen #4771
• cranelift: Add LibCalls to the interpreter #4782
• cranelift: Enable i128 shifts on fuzzer #4783 (deferred from x64: Mask shift amounts for small types #4752)
• Disable funcref generation for fuzz tests with inputs #4797

I think we're ready to merge these. @afonso360 and @cfallin, do you agree?

[afonso360]

Yeah, I think we should be good to merge those. I'm really happy that fuzzgen is finding real bugs like #4752 and #4790 🎉

[github-actions]

Subscribe to Label Action

cc @fitzgen

Details

This issue or pull request has been labeled: "fuzzing"

Thus the following users have been cc'd because of the following labels:

• fitzgen: fuzzing

To subscribe or unsubscribe from this label, edit the .github/subscribe-to-label.json configuration file.

Learn more.

[jameysharp]

...I guess I should close this since all the PRs I was tracking are merged now.