Skip to content

Fix JS tag fuzzing: throw the same in JS and the binaryen interpreter #7286

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 10, 2025

Conversation

kripken
Copy link
Member

@kripken kripken commented Feb 10, 2025

We do not compare exceptions in binaryen (not in the optimizer, where we
assume we can reorder traps, and not in the fuzzer, where we assume VMs
may have different text for them). But, since we have try-catch in wasm,
we can actually end up comparing them, by catching the exception and
logging the output. For that reason, we need to throw exactly the same
JS exception in #7283, which this fixes.

(I fuzzed #7283 for a few hours, and it found this error right after I landed the PR 😄 )

@kripken kripken requested a review from aheejin February 10, 2025 22:04
Copy link
Member

@aheejin aheejin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where do we compare and check whether those values are the same?

@kripken
Copy link
Member Author

kripken commented Feb 10, 2025

The fuzzer may end up comparing them when it compares the output of VMs. It can run in d8 and binaryen, get the logs, and diff those. And if we return the caught exceptions, their contents are in those logs (like any return value).

@kripken kripken merged commit 7198f0e into WebAssembly:main Feb 10, 2025
14 checks passed
@kripken kripken deleted the fix.jstag.fuzz branch February 10, 2025 23:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants