[EH] Fuzzer: Add WebAssembly.JSTag fuzzing #7283
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
aheejin
reviewed
Feb 7, 2025
|
Yes, once we import it into wasm, it is just another in the list of tags, which means it will get catches, throws, etc. |
|
The fuzzer just found a bug here in fact, I pushed a fix. I forgot to use the imported tag in execution-results, so the binaryen interpreter was not catching JS exceptions when it used that tag (which differs from v8, so the fuzzer errored). |
aheejin
approved these changes
Feb 8, 2025
src/tools/execution-results.h
Outdated
| @@ -173,8 +181,11 @@ struct LoggingExternalInterface : public ShellExternalInterface { | |||
| } | |||
|
|
|||
| void throwEmptyException() { | |||
There was a problem hiding this comment.
If the intention of this method is to throw a JS exception, how about naming it throwJSException or something to be clear?
|
The fuzzer noticed that duplicate tags can cause issues due to the interpreter using tag names, see I pushed a workaround. |
aheejin
approved these changes
Feb 10, 2025
kripken
added a commit
that referenced
this pull request
Feb 10, 2025
…#7286) We do not compare exceptions in binaryen (not in the optimizer, where we assume we can reorder traps, and not in the fuzzer, where we assume VMs may have different text for them). But, since we have try-catch in wasm, we can actually end up comparing them, by catching the exception and logging the output. For that reason, we need to throw exactly the same JS exception in #7283, which this fixes.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This JS API represents the tag of JS exceptions. Import it into the wasm
so that wasm can catch and throw JS exceptions.
Rename the previous "jsTag", which means "wasm tag created in JS" to
"wasmTag" to avoid confusion.