Add support for memory-related bulk-memory instructions (bytecodealliance#24)

This commit adds support for some new instructions:

* `data.drop`
* `memory.init`
* `memory.copy`
* `memory.fill`

This also adds support for passive data and the data count section. A
new `Config::bulk_memory_enabled` boolean, defaulting to `false`, is
added which gates all of this support. Finally the generation of data
segments was moved before the code so we know whether `data.drop` will
be valid by the time we're generating code.

Finally, a new fuzz target was added which validates all possible
modules (generated by `SwarmConfig`) with `wasmparser`.

Author: alexcrichton

.github/workflows/rust.yml

@@ -27,6 +27,14 @@ jobs:
       - run: cargo fuzz build validate --sanitizer none
       - run: cargo fuzz run validate --sanitizer none -- -max_total_time=60
 
+  validate_swarm_fuzz_target:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - run: cargo install cargo-fuzz
+      - run: cargo fuzz build validate-swarm --sanitizer none
+      - run: cargo fuzz run validate-swarm --sanitizer none -- -max_total_time=60
+
   validate_ensure_terminated_fuzz_target:
     runs-on: ubuntu-latest
     steps:

fuzz/Cargo.toml

@@ -25,3 +25,9 @@ name = "validate-ensure-termination"
 path = "fuzz_targets/validate-ensure-termination.rs"
 test = false
 doc = false
+
+[[bin]]
+name = "validate-swarm"
+path = "fuzz_targets/validate-swarm.rs"
+test = false
+doc = false

fuzz/fuzz_targets/validate-swarm.rs

@@ -0,0 +1,20 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use wasm_smith::{Config, ConfiguredModule, SwarmConfig};
+
+fuzz_target!(|m: ConfiguredModule<SwarmConfig>| {
+    let bytes = m.to_bytes();
+
+    let mut validator = wasmparser::Validator::new();
+    validator.wasm_features(wasmparser::WasmFeatures {
+        multi_value: true,
+        bulk_memory: m.config().bulk_memory_enabled(),
+        multi_memory: m.config().max_memories() > 1,
+        ..wasmparser::WasmFeatures::default()
+    });
+    if let Err(e) = validator.validate_all(&bytes) {
+        std::fs::write("test.wasm", bytes).unwrap();
+        panic!("Invalid module: {}", e);
+    }
+});

src/code_builder.rs

@@ -105,6 +105,10 @@ instructions! {
     (Some(i64_store_valid), i64_store_32),
     (Some(have_memory), memory_size),
     (Some(memory_grow_valid), memory_grow),
+    (Some(memory_init_valid), memory_init),
+    (Some(data_drop_valid), data_drop),
+    (Some(memory_copy_valid), memory_copy),
+    (Some(memory_fill_valid), memory_fill),
     // Numeric instructions.
     (None, i32_const),
     (None, i64_const),
@@ -1053,6 +1057,11 @@ fn have_memory_and_offset<C: Config>(
     have_memory(module, builder) && builder.type_on_stack(ValType::I32)
 }
 
+#[inline]
+fn have_data<C: Config>(module: &ConfiguredModule<C>, _: &mut CodeBuilder<C>) -> bool {
+    module.data.len() > 0
+}
+
 fn i32_load<C: Config>(
     u: &mut Unstructured,
     module: &ConfiguredModule<C>,
@@ -1395,6 +1404,80 @@ fn memory_grow<C: Config>(
     Ok(Instruction::MemoryGrow(memory_index(u, builder)?))
 }
 
+#[inline]
+fn memory_init_valid<C: Config>(
+    module: &ConfiguredModule<C>,
+    builder: &mut CodeBuilder<C>,
+) -> bool {
+    have_memory(module, builder)
+        && have_data(module, builder)
+        && module.config.bulk_memory_enabled()
+        && builder.types_on_stack(&[ValType::I32, ValType::I32, ValType::I32])
+}
+
+fn memory_init<C: Config>(
+    u: &mut Unstructured,
+    module: &ConfiguredModule<C>,
+    builder: &mut CodeBuilder<C>,
+) -> Result<Instruction> {
+    let mem = memory_index(u, builder)?;
+    let data = data_index(u, module)?;
+    builder.pop_operands(&[ValType::I32, ValType::I32, ValType::I32]);
+    Ok(Instruction::MemoryInit { mem, data })
+}
+
+#[inline]
+fn memory_fill_valid<C: Config>(
+    module: &ConfiguredModule<C>,
+    builder: &mut CodeBuilder<C>,
+) -> bool {
+    have_memory(module, builder)
+        && module.config.bulk_memory_enabled()
+        && builder.types_on_stack(&[ValType::I32, ValType::I32, ValType::I32])
+}
+
+fn memory_fill<C: Config>(
+    u: &mut Unstructured,
+    _module: &ConfiguredModule<C>,
+    builder: &mut CodeBuilder<C>,
+) -> Result<Instruction> {
+    let mem = memory_index(u, builder)?;
+    builder.pop_operands(&[ValType::I32, ValType::I32, ValType::I32]);
+    Ok(Instruction::MemoryFill(mem))
+}
+
+#[inline]
+fn memory_copy_valid<C: Config>(
+    module: &ConfiguredModule<C>,
+    builder: &mut CodeBuilder<C>,
+) -> bool {
+    memory_fill_valid(module, builder)
+}
+
+fn memory_copy<C: Config>(
+    u: &mut Unstructured,
+    _module: &ConfiguredModule<C>,
+    builder: &mut CodeBuilder<C>,
+) -> Result<Instruction> {
+    let src = memory_index(u, builder)?;
+    let dst = memory_index(u, builder)?;
+    builder.pop_operands(&[ValType::I32, ValType::I32, ValType::I32]);
+    Ok(Instruction::MemoryCopy { dst, src })
+}
+
+#[inline]
+fn data_drop_valid<C: Config>(module: &ConfiguredModule<C>, builder: &mut CodeBuilder<C>) -> bool {
+    have_data(module, builder) && module.config.bulk_memory_enabled()
+}
+
+fn data_drop<C: Config>(
+    u: &mut Unstructured,
+    module: &ConfiguredModule<C>,
+    _builder: &mut CodeBuilder<C>,
+) -> Result<Instruction> {
+    Ok(Instruction::DataDrop(data_index(u, module)?))
+}
+
 fn i32_const<C: Config>(
     u: &mut Unstructured,
     _: &ConfiguredModule<C>,
@@ -2885,3 +2968,13 @@ fn memory_index<C: Config>(u: &mut Unstructured, builder: &mut CodeBuilder<C>) -
         u.int_in_range(0..=builder.allocs.num_memories - 1)
     }
 }
+
+fn data_index<C: Config>(u: &mut Unstructured, module: &ConfiguredModule<C>) -> Result<u32> {
+    let data = module.data.len() as u32;
+    assert!(data > 0);
+    if data == 1 {
+        Ok(0)
+    } else {
+        u.int_in_range(0..=data - 1)
+    }
+}

src/config.rs

@@ -107,6 +107,12 @@ pub trait Config: Arbitrary + Default {
     fn min_uleb_size(&self) -> u8 {
         1
     }
+
+    /// Determines whether the bulk memory proposal is enabled for generating
+    /// insructions. Defaults to `false`.
+    fn bulk_memory_enabled(&self) -> bool {
+        false
+    }
 }
 
 /// The default configuration.
@@ -133,6 +139,7 @@ pub struct SwarmConfig {
     max_instructions: usize,
     max_memories: u32,
     min_uleb_size: u8,
+    bulk_memory_enabled: bool,
 }
 
 impl Arbitrary for SwarmConfig {
@@ -147,8 +154,9 @@ impl Arbitrary for SwarmConfig {
             max_elements: u.int_in_range(0..=MAX_MAXIMUM)?,
             max_data_segments: u.int_in_range(0..=MAX_MAXIMUM)?,
             max_instructions: u.int_in_range(0..=MAX_MAXIMUM)?,
-            max_memories: u.int_in_range(0..=(MAX_MAXIMUM as u32))?,
+            max_memories: u.int_in_range(0..=100)?,
             min_uleb_size: u.int_in_range(0..=5)?,
+            bulk_memory_enabled: u.arbitrary()?,
         })
     }
 }
@@ -193,4 +201,8 @@ impl Config for SwarmConfig {
     fn min_uleb_size(&self) -> u8 {
         self.min_uleb_size
     }
+
+    fn bulk_memory_enabled(&self) -> bool {
+        self.bulk_memory_enabled
+    }
 }

src/encode.rs

@@ -30,6 +30,7 @@ where
         self.encode_exports(&mut bytes);
         self.encode_start(&mut bytes);
         self.encode_elems(&mut bytes);
+        self.encode_data_count(&mut bytes);
         self.encode_code(&mut bytes);
         self.encode_data(&mut bytes);
 
@@ -347,6 +348,28 @@ where
                 bytes.push(0x40);
                 self.encode_u32(bytes, *i);
             }
+            Instruction::MemoryInit { mem, data } => {
+                bytes.push(0xfc);
+                self.encode_u32(bytes, 8);
+                self.encode_u32(bytes, *data);
+                self.encode_u32(bytes, *mem);
+            }
+            Instruction::DataDrop(data) => {
+                bytes.push(0xfc);
+                self.encode_u32(bytes, 9);
+                self.encode_u32(bytes, *data);
+            }
+            Instruction::MemoryCopy { src, dst } => {
+                bytes.push(0xfc);
+                self.encode_u32(bytes, 10);
+                self.encode_u32(bytes, *dst);
+                self.encode_u32(bytes, *src);
+            }
+            Instruction::MemoryFill(mem) => {
+                bytes.push(0xfc);
+                self.encode_u32(bytes, 11);
+                self.encode_u32(bytes, *mem);
+            }
 
             // Numeric instructions.
             Instruction::I32Const(x) => {
@@ -671,6 +694,20 @@ where
         });
     }
 
+    fn encode_data_count(&self, bytes: &mut Vec<u8>) {
+        // Without bulk memory there's no need for a data count section
+        if !self.config.bulk_memory_enabled() {
+            return;
+        }
+        // ... and also if there's no data no need for a data count section
+        if self.data.is_empty() {
+            return;
+        }
+        self.section(bytes, 12, |bytes| {
+            self.encode_u32(bytes, self.data.len() as u32);
+        })
+    }
+
     fn encode_code(&self, bytes: &mut Vec<u8>) {
         if self.code.is_empty() {
             return;
@@ -704,14 +741,28 @@ where
     fn encode_data(&self, bytes: &mut Vec<u8>) {
         self.section(bytes, 11, |bytes| {
             self.encode_vec(bytes, &self.data, |bytes, data| {
-                if data.memory_index == 0 {
-                    self.encode_u32(bytes, 0);
-                } else {
-                    self.encode_u32(bytes, 2);
-                    self.encode_u32(bytes, data.memory_index);
+                match &data.kind {
+                    DataSegmentKind::Active {
+                        memory_index: 0,
+                        offset,
+                    } => {
+                        bytes.push(0x00);
+                        self.encode_instruction(bytes, offset);
+                        self.encode_instruction(bytes, &Instruction::End);
+                    }
+                    DataSegmentKind::Passive => {
+                        bytes.push(0x01);
+                    }
+                    DataSegmentKind::Active {
+                        memory_index,
+                        offset,
+                    } => {
+                        bytes.push(0x02);
+                        self.encode_u32(bytes, *memory_index);
+                        self.encode_instruction(bytes, offset);
+                        self.encode_instruction(bytes, &Instruction::End);
+                    }
                 }
-                self.encode_instruction(bytes, &data.offset);
-                self.encode_instruction(bytes, &Instruction::End);
                 self.encode_vec(bytes, &data.init, |bytes, b| {
                     bytes.push(*b);
                 });

src/lib.rs

@@ -106,6 +106,13 @@ where
     data: Vec<DataSegment>,
 }
 
+impl<C: Config> ConfiguredModule<C> {
+    /// Returns a reference to the internal configuration.
+    pub fn config(&self) -> &C {
+        &self.config
+    }
+}
+
 impl<C: Config> Arbitrary for ConfiguredModule<C> {
     fn arbitrary(u: &mut Unstructured) -> Result<Self> {
         let mut module = ConfiguredModule::<C>::default();
@@ -339,6 +346,10 @@ enum Instruction {
     I64Store32(MemArg),
     MemorySize(u32),
     MemoryGrow(u32),
+    MemoryInit { mem: u32, data: u32 },
+    DataDrop(u32),
+    MemoryCopy { src: u32, dst: u32 },
+    MemoryFill(u32),
 
     // Numeric instructions.
     I32Const(i32),
@@ -485,11 +496,19 @@ enum Instruction {
 
 #[derive(Debug)]
 struct DataSegment {
-    memory_index: u32,
-    offset: Instruction,
+    kind: DataSegmentKind,
     init: Vec<u8>,
 }
 
+#[derive(Debug)]
+enum DataSegmentKind {
+    Passive,
+    Active {
+        memory_index: u32,
+        offset: Instruction,
+    },
+}
+
 impl<C> ConfiguredModule<C>
 where
     C: Config,
@@ -507,8 +526,8 @@ where
         self.arbitrary_exports(u)?;
         self.arbitrary_start(u)?;
         self.arbitrary_elems(u)?;
-        self.arbitrary_code(u, allow_invalid)?;
         self.arbitrary_data(u)?;
+        self.arbitrary_code(u, allow_invalid)?;
         Ok(())
     }
 
@@ -825,8 +844,10 @@ where
     }
 
     fn arbitrary_data(&mut self, u: &mut Unstructured) -> Result<()> {
+        // With bulk-memory we can generate passive data, otherwise if there are
+        // no memories we can't generate any data.
         let memories = self.memories.len() as u32 + self.memory_imports();
-        if memories == 0 {
+        if memories == 0 && !self.config.bulk_memory_enabled() {
             return Ok(());
         }
 
@@ -852,15 +873,23 @@ where
                 }
             }
 
-            let f = u.choose(&choices)?;
-            let offset = f(u)?;
+            // Passive data can only be generated if bulk memory is enabled.
+            // Otherwise if there are no memories we *only* generate passive
+            // data. Finally if all conditions are met we use an input byte to
+            // determine if it should be passive or active.
+            let kind = if self.config.bulk_memory_enabled() && (memories == 0 || u.arbitrary()?) {
+                DataSegmentKind::Passive
+            } else {
+                let f = u.choose(&choices)?;
+                let offset = f(u)?;
+                let memory_index = u.int_in_range(0..=memories - 1)?;
+                DataSegmentKind::Active {
+                    offset,
+                    memory_index,
+                }
+            };
             let init = u.arbitrary()?;
-            let memory_index = u.int_in_range(0..=memories - 1)?;
-            self.data.push(DataSegment {
-                memory_index,
-                offset,
-                init,
-            });
+            self.data.push(DataSegment { kind, init });
             Ok(())
         })
     }