Skip to content

New Fuzz Target for Exercising Interface Functions #4307

@fitzgen

Description

@fitzgen

To help make the component model and interface types production ready, we want
to extensively fuzz and exercise Wasmtime's ability to pass interface values
back and forth with Wasm.

This fuzz target should:

  • generate an arbitrary interface type T,
  • generate a Wasm component that
    • imports a host function T -> T, and
    • exports a function T -> T that passes its argument to the import function
      and returns the result of the import function,
  • generate some number of arbitrary values of type T,
  • and for each value:
    • call the Wasm's exported function,
    • when the host function is called, assert that the argument is equal to the
      original value,
    • return the argument from the host function,
    • when the Wasm function returns to the host, assert that the argument is
      equal to the original value,
    • assert that the host function was actually called.

This tests that we can round trip interface values of type T both as arguments
and returns to and from Wasm.

Here is a diagram showing what the fuzz target should do:

+-------------------+                   +------------------+
| Host              |                   | Wasm             |
|                   |   argument        |                  |
|     arbitrary ------------------------------>            |
|     value         |                   |      |           |
|                   |                   |      |           |
|                   |                   |      |           |
|         +-----------------+           |      |           |
|         | host function   |           |      |           |
|         | imported by     |           |      |           |
|         | Wasm            |  argument |      V           |
|         |            <-----------------------            |
|         |           |     |           |                  |
|         | assert    |     |           |                  |
|         | value is  |     |           |                  |
|         | equal     V     |  return   |                  |
|         |            ----------------------->            |
|         |                 |           |      |           |
|         +-----------------+           |      |           |
|                   |                   |      |           |
|                   |          return   |      V           |
|   assert    <--------------------------------            |
|   value is        |                   |                  |
|   equal           |                   |                  |
|                   |                   |                  |
+-------------------+                   +------------------+

Test Case Generator

The test case generator will be responsible for generating

  • the arbitrary interface type T,
  • the Wasm component that takes values of type T, passes them to the imported
    host function, and returns the result of the host function,
  • and instances of type T.

Oracle

There are two versions of the oracle:

  1. a version that uses the dynamic interface types API to pass values to Wasm,
    and
  2. a version that uses the static interface types API to pass values to Wasm.

Dynamic API Oracle

The dynamic API oracle will be paired with the test case generator at runtime
and use Wasmtime's dynamic API for interface type values (doesn't exist at time
of writing; the component equivalent of wasmtime::Val).

Static API Oracle

The static API oracle will use the test case generator at build time to
generate, say, 1000 interface types T to fuzz, and then generate arbitrary
instances of T at runtime. This means that if T is a struct, for example, we
can define a Rust type like

#[derive(InterfaceType)]
struct MyRustType {
    foo: u32,
    bar: String,
}

whose instances can be passed to the Wasm directly via Wasmtime's static API for
interface types. We will generate arbitrary instance of MyRustType at runtime
in this scenario, but not new types T.

(Note that derive(InterfaceType) does not exist at the time of writing.)

Metadata

Metadata

Assignees

No one assigned

    Labels

    fuzzingIssues related to our fuzzing infrastructurewasm-proposal:component-modelIssues related to the WebAssembly Component Model proposal

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions