Skip to content

Fuzzer: Emit SIMD lane load and store instructions #9206

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tlively wants to merge 1 commit into
base: fuzzer-table-size-grow
Choose a base branch
from
+160 −96
Open

Fuzzer: Emit SIMD lane load and store instructions #9206

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/tools/fuzzing.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -547,6 +547,7 @@ class TranslateToFuzzReader {
Expression* makeSIMDTernary();
Expression* makeSIMDShift();
Expression* makeSIMDLoad();
Expression* makeSIMDLoadStoreLane(Type type);
Expression* makeBulkMemory(Type type);
Expression* makeTableGet(Type type);
Expression* makeTableSet(Type type);
Expand Down
75 changes: 67 additions & 8 deletions src/tools/fuzzing/fuzzing.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3018,6 +3018,7 @@ Expression* TranslateToFuzzReader::_makenone() {
&Self::makeNop,
&Self::makeGlobalSet)
.add(FeatureSet::BulkMemory, &Self::makeBulkMemory)
.add(FeatureSet::SIMD, &Self::makeSIMDLoadStoreLane)

@kripken kripken Oct 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like in general we put all SIMD instructions behind makeSIMD()?

.add(FeatureSet::Atomics, &Self::makeAtomic)
.add(FeatureSet::ReferenceTypes, &Self::makeTableSet)
.add(FeatureSet::ExceptionHandling, &Self::makeTry)
Expand Down Expand Up @@ -3713,6 +3714,12 @@ Expression* TranslateToFuzzReader::makePointer() {
}

Expression* TranslateToFuzzReader::makeNonAtomicLoad(Type type) {
if (type == Type::v128) {
assert(wasm.features.hasSIMD());
if (oneIn(2)) {
return makeSIMDLoadStoreLane(type);

@kripken kripken Oct 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is the main code path to that function not enough?

@tlively tlively Oct 5, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This function can already emit normal SIMD loads when type == Type::v128, so it seems reasonable to let it emit other kinds of SIMD loads as well.

I'm not tied to this, though. Putting SIMDLoadStoreLane only behind makeSIMD also seems reasonable. It will just make it much less likely to be generated, but I guess that's no different from any other SIMD instruction.

I'll make this change.

}
}
auto offset = logify(get());
auto ptr = makePointer();
switch (type.getBasic()) {
Expand Down Expand Up @@ -3773,9 +3780,6 @@ Expression* TranslateToFuzzReader::makeNonAtomicLoad(Type type) {
8, false, offset, pick(1, 2, 4, 8), ptr, type, wasm.memories[0]->name);
}
case Type::v128: {
if (!wasm.features.hasSIMD()) {
return makeTrivial(type);
}
return builder.makeLoad(16,
false,
offset,
Expand Down Expand Up @@ -3841,6 +3845,12 @@ Expression* TranslateToFuzzReader::makeNonAtomicStore(Type type) {
if (type == Type::none) {
type = getStorableType();
}
if (type == Type::v128) {
assert(wasm.features.hasSIMD());
if (oneIn(2)) {
return makeSIMDLoadStoreLane(Type::none);
}
}
auto offset = logify(get());
auto ptr = makePointer();
auto value = make(type);
Expand Down Expand Up @@ -3890,9 +3900,6 @@ Expression* TranslateToFuzzReader::makeNonAtomicStore(Type type) {
8, offset, pick(1, 2, 4, 8), ptr, value, type, wasm.memories[0]->name);
}
case Type::v128: {
if (!wasm.features.hasSIMD()) {
return makeTrivial(type);
}
return builder.makeStore(16,
offset,
pick(1, 2, 4, 8, 16),
Expand Down Expand Up @@ -5416,8 +5423,7 @@ Expression* TranslateToFuzzReader::makeSIMD(Type type) {
if (type != Type::v128) {
return makeSIMDExtract(type);
}
// TODO: Add SIMDLoadStoreLane once it is generally available
switch (upTo(7)) {
switch (upTo(8)) {
case 0:
return makeUnary(Type::v128);
case 1:
Expand All @@ -5432,6 +5438,8 @@ Expression* TranslateToFuzzReader::makeSIMD(Type type) {
return makeSIMDShift();
case 6:
return makeSIMDLoad();
case 7:
return makeSIMDLoadStoreLane(Type::v128);
}
WASM_UNREACHABLE("invalid value");
}
Expand Down Expand Up @@ -5586,6 +5594,9 @@ Expression* TranslateToFuzzReader::makeSIMDShift() {
}

Expression* TranslateToFuzzReader::makeSIMDLoad() {
if (!allowMemory) {
return makeTrivial(Type::v128);
}
SIMDLoadOp op = pick(Load8SplatVec128,
Load16SplatVec128,
Load32SplatVec128,
Expand Down Expand Up @@ -5630,6 +5641,54 @@ Expression* TranslateToFuzzReader::makeSIMDLoad() {
return builder.makeSIMDLoad(op, offset, align, ptr, wasm.memories[0]->name);
}

Expression* TranslateToFuzzReader::makeSIMDLoadStoreLane(Type type) {
if (!allowMemory) {
return makeTrivial(type);
}
SIMDLoadStoreLaneOp op;
if (type == Type::v128) {
op = pick(
Load8LaneVec128, Load16LaneVec128, Load32LaneVec128, Load64LaneVec128);
} else if (type == Type::none) {
op = pick(Store8LaneVec128,
Store16LaneVec128,
Store32LaneVec128,
Store64LaneVec128);
} else {
WASM_UNREACHABLE("unexpected type");
}
Address offset = logify(get());
Address align;
uint8_t lanes;
switch (op) {
case Load8LaneVec128:
case Store8LaneVec128:
align = 1;
lanes = 16;
break;
case Load16LaneVec128:
case Store16LaneVec128:
align = pick(1, 2);
lanes = 8;
break;
case Load32LaneVec128:
case Store32LaneVec128:
align = pick(1, 2, 4);
lanes = 4;
break;
case Load64LaneVec128:
case Store64LaneVec128:
align = pick(1, 2, 4, 8);
lanes = 2;
break;
}
uint8_t index = upTo(lanes);
Expression* ptr = makePointer();
Expression* vec = make(Type::v128);
return builder.makeSIMDLoadStoreLane(
op, offset, align, index, ptr, vec, wasm.memories[0]->name);
}

Expression* TranslateToFuzzReader::makeBulkMemory(Type type) {
assert(wasm.features.hasBulkMemory());
assert(type == Type::none);
Expand Down
180 changes: 92 additions & 88 deletions test/passes/translate-to-fuzz_all-features_metrics_noprint.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,99 +1,103 @@
Metrics
total
[exports] : 81
[funcs] : 167
[exports] : 168
[funcs] : 298
[globals] : 22
[imports] : 11
[memories] : 1
[memory-data] : 31
[table-data] : 38
[table-data] : 92
[tables] : 2
[tags] : 2
[total] : 80243
[vars] : 3568
ArrayCmpxchg : 9
ArrayCopy : 15
ArrayFill : 13
ArrayGet : 327
ArrayLen : 391
ArrayNew : 1667
ArrayNewFixed : 497
ArrayRMW : 8
ArraySet : 47
AtomicCmpxchg : 35
AtomicFence : 44
AtomicNotify : 18
AtomicRMW : 23
Binary : 3454
Block : 5142
BrOn : 523
Break : 656
Call : 789
CallIndirect : 66
CallRef : 158
Const : 11199
ContNew : 166
DataDrop : 5
Drop : 698
ElemDrop : 5
GlobalGet : 4307
GlobalSet : 1519
I31Get : 42
If : 1727
Load : 224
LocalGet : 7812
LocalSet : 3049
Loop : 586
MemoryCopy : 9
MemoryFill : 14
MemoryGrow : 28
MemoryInit : 9
MemorySize : 22
Nop : 436
Pop : 148
RefAs : 7495
RefCast : 627
RefEq : 169
RefFunc : 1415
RefGetDesc : 67
RefI31 : 666
RefIsNull : 38
RefNull : 8739
RefTest : 43
Return : 281
SIMDExtract : 104
SIMDShift : 1
SIMDShuffle : 1
Select : 248
Store : 87
[total] : 96477
[vars] : 4393
ArrayCmpxchg : 10
ArrayCopy : 37
ArrayFill : 29
ArrayGet : 380
ArrayLen : 501
ArrayNew : 1954
ArrayNewFixed : 572
ArrayRMW : 11
ArraySet : 57
AtomicCmpxchg : 18
AtomicFence : 57
AtomicNotify : 25
AtomicRMW : 30
Binary : 4344
Block : 6687
BrOn : 632
Break : 902
Call : 978
CallIndirect : 139
CallRef : 177
Const : 13870
ContBind : 2
ContNew : 193
DataDrop : 8
Drop : 860
ElemDrop : 11
GlobalGet : 5250
GlobalSet : 2117
I31Get : 63
If : 2305
Load : 234
LocalGet : 7883
LocalSet : 3882
Loop : 755
MemoryCopy : 18
MemoryFill : 10
MemoryGrow : 36
MemoryInit : 11
MemorySize : 41
Nop : 586
Pop : 179
RefAs : 8758
RefCast : 711
RefEq : 196
RefFunc : 1675
RefGetDesc : 76
RefI31 : 747
RefIsNull : 62
RefNull : 10485
RefTest : 57
Return : 376
SIMDExtract : 122
SIMDLoad : 2
SIMDLoadStoreLane: 90
SIMDReplace : 1
SIMDShift : 2
SIMDTernary : 1
Select : 310
Store : 100
StringConcat : 1
StringConst : 362
StringEncode : 39
StringEq : 43
StringMeasure : 43
StringConst : 497
StringEncode : 55
StringEq : 50
StringMeasure : 51
StringNew : 6
StringSliceWTF : 2
StringWTF16Get : 52
StructCmpxchg : 38
StructGet : 340
StructNew : 9491
StructRMW : 45
StringSliceWTF : 1
StringWTF16Get : 48
StructCmpxchg : 49
StructGet : 478
StructNew : 10572
StructRMW : 65
StructSet : 54
StructWait : 41
Switch : 6
TableGet : 5
TableGrow : 46
TableSet : 34
TableSize : 48
Throw : 83
ThrowRef : 9
Try : 291
TryTable : 376
TupleExtract : 233
TupleMake : 187
Unary : 1408
Unreachable : 778
WaitqueueNew : 251
WaitqueueNotify: 39
WideIntAddSub : 14
WideIntMul : 10
StructWait : 65
Switch : 2
TableGet : 1
TableGrow : 60
TableSet : 50
TableSize : 61
Throw : 90
ThrowRef : 11
Try : 388
TryTable : 437
TupleExtract : 237
TupleMake : 212
Unary : 1883
Unreachable : 1079
WaitqueueNew : 276
WaitqueueNotify: 43
WideIntAddSub : 11
WideIntMul : 19
Loading