[wasm] remove confusing ProgramBuilder.addWasmFunction overload

Since wasm functions support implicit fall-through of values and
multiple return values, the old overload is not supposed to be used as
it inserts random magic to provide input values for the EndWasmFunction
operation.

Change-Id: Ib9579a70812325db2dbe41d3881057eb5776c3d4
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8465496
Reviewed-by: Manos Koukoutos <manoskouk@google.com>
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

Author: Liedtke

Sources/Fuzzilli/Base/ProgramBuilder.swift

@@ -3840,17 +3840,6 @@ public class ProgramBuilder {
         }
 
         // TODO: distinguish between exported and non-exported functions
-        @discardableResult
-        public func addWasmFunction(with signature: WasmSignature, _ body: (WasmFunction, [Variable]) -> ()) -> Variable {
-            let instr = b.emit(BeginWasmFunction(signature: signature))
-            // Ignore the label in this overload.
-            body(currentWasmFunction, Array(instr.innerOutputs.dropFirst()))
-            // TODO(mliedtke): Ideally we'd replace all overloads of this function to the new one
-            // expecting explicit return values.
-            let results = signature.outputTypes.map {b.randomVariable(ofType: $0) ?? currentWasmFunction.generateRandomWasmVar(ofType: $0)!}
-            return b.emit(EndWasmFunction(signature: signature), withInputs: results).output
-        }
-
         @discardableResult
         public func addWasmFunction(with signature: WasmSignature, _ body: (WasmFunction, Variable, [Variable]) -> [Variable]) -> Variable {
             let instr = b.emit(BeginWasmFunction(signature: signature))

Sources/Fuzzilli/CodeGen/ProgramTemplates.swift

@@ -105,7 +105,7 @@ public let ProgramTemplates = [
         let wrapped = b.wrapSuspending(function: f!)
 
         let m = b.buildWasmModule { mod in
-            mod.addWasmFunction(with: [] => []) { fbuilder, _  in
+            mod.addWasmFunction(with: [] => []) { fbuilder, _, _  in
                 // This will create a bunch of locals, which should create large (>4KB) frames.
                 if probability(0.02) {
                     for _ in 0..<1000 {
@@ -120,6 +120,7 @@ public let ProgramTemplates = [
                     fbuilder.wasmJsCall(function: wrapped, withArgs: args, withWasmSignature: wasmSignature)
                 }
                 b.build(n: 4)
+                return []
             }
             if probability(0.2) {
                 b.build(n: 20)
@@ -156,7 +157,7 @@ public let ProgramTemplates = [
         let module = b.buildWasmModule { wasmModule in
             // Wasm function that throws a tag, catches a tag (the same or a different one) to
             // rethrow it again (or another exnref if present).
-            wasmModule.addWasmFunction(with: [] => []) { function, args in
+            wasmModule.addWasmFunction(with: [] => []) { function, label, args in
                 b.build(n: 10)
                 let caughtValues = function.wasmBuildBlockWithResults(with: [] => catchBlockOutputTypes, args: []) { catchRefLabel, _ in
                     // TODO(mliedtke): We should probably allow mutations of try_tables to make
@@ -173,6 +174,7 @@ public let ProgramTemplates = [
                 }
                 b.build(n: 10)
                 function.wasmBuildThrowRef(exception: b.randomVariable(ofType: .wasmExnRef)!)
+                return []
             }
         }
 

Sources/Fuzzilli/FuzzIL/TypeSystem.swift

@@ -1914,8 +1914,8 @@ public struct Signature: Hashable, CustomStringConvertible {
 }
 
 public struct WasmSignature: Hashable, CustomStringConvertible {
-    let parameterTypes: [ILType]
-    let outputTypes: [ILType]
+    public let parameterTypes: [ILType]
+    public let outputTypes: [ILType]
 
     init(expects parameters: [ILType], returns returnTypes: [ILType]) {
         self.parameterTypes = parameters

Sources/FuzzilliCli/Profiles/V8Profile.swift

@@ -499,16 +499,17 @@ fileprivate let WasmFastCallFuzzer = WasmProgramTemplate("WasmFastCallFuzzer") {
     let m = b.buildWasmModule { m in
         let allWasmTypes: WeightedList<ILType> = WeightedList([(.wasmi32, 1), (.wasmi64, 1), (.wasmf32, 1), (.wasmf64, 1), (.wasmExternRef, 1), (.wasmFuncRef, 1)])
         let wasmSignature = ProgramBuilder.convertJsSignatureToWasmSignature(wrappedSig, availableTypes: allWasmTypes)
-        m.addWasmFunction(with: wasmSignature) {fbuilder, _  in
+        m.addWasmFunction(with: wasmSignature) {fbuilder, _, _  in
             let args = b.randomWasmArguments(forWasmSignature: wasmSignature)
             if let args {
                 let maybeRet = fbuilder.wasmJsCall(function: wrapped, withArgs: args, withWasmSignature: wasmSignature)
                 if let ret = maybeRet {
-                  fbuilder.wasmReturn(ret)
+                  return [ret]
                 }
             } else {
                 logger.error("Arguments should have been generated")
             }
+            return wasmSignature.outputTypes.map(fbuilder.findOrGenerateWasmVar)
         }
     }
 

Tests/FuzzilliTests/JSTyperTests.swift

@@ -1226,7 +1226,7 @@ class JSTyperTests: XCTestCase {
         let b = fuzzer.makeBuilder()
 
         b.buildWasmModule { m in
-            m.addWasmFunction(with: [] => []) { f, _ in
+            m.addWasmFunction(with: [] => []) { f, _, _ in
                 let ci32 = f.consti32(1337)
                 let ci64 = f.consti64(1338)
                 let cf32 = f.constf32(13.37)
@@ -1240,6 +1240,7 @@ class JSTyperTests: XCTestCase {
                 XCTAssertTrue(b.type(of: ci64).Is(.wasmPrimitive))
                 XCTAssertTrue(b.type(of: cf32).Is(.wasmPrimitive))
                 XCTAssertTrue(b.type(of: cf64).Is(.wasmPrimitive))
+                return []
             }
         }
     }
@@ -1546,7 +1547,7 @@ class JSTyperTests: XCTestCase {
             wasmModule.addTag(parameterTypes: [.wasmi32])
 
             // Function zero
-            wasmModule.addWasmFunction(with: [] => []) { function, _ in
+            wasmModule.addWasmFunction(with: [] => []) { function, _, _ in
                 // This forces an import of the wasmGlobalf64, second global
                 function.wasmLoadGlobal(globalVariable: wasmGlobalf64)
                 // This forces an import and a re-export of the jsTag.
@@ -1556,6 +1557,7 @@ class JSTyperTests: XCTestCase {
                     }
                 }
                 function.wasmUnreachable()
+                return []
             }
 
             // Function one

Tests/FuzzilliTests/LifterTest.swift

@@ -3239,8 +3239,9 @@ class LifterTests: XCTestCase {
         b.reassign(table, to: table)
 
         b.buildWasmModule { m in
-            m.addWasmFunction(with: [] => []) { f, _ in
+            m.addWasmFunction(with: [] => []) { f, _, _ in
                 f.wasmCallIndirect(signature: [] => [], table: table, functionArgs: [], tableIndex: f.consti64(0))
+                return []
             }
         }
 

Tests/FuzzilliTests/MinimizerTest.swift

@@ -2035,11 +2035,12 @@ class MinimizerTests: XCTestCase {
             }
 
             b.buildWasmModule { wasmModule in
-                wasmModule.addWasmFunction(with: [] => []) { function, _ in
+                wasmModule.addWasmFunction(with: [] => []) { function, _, _ in
                     let constOne = function.consti32(1)
                     evaluator.nextInstructionIsImportant(in: b)
                     function.wasmArrayNewDefault(arrayType: typeGroupB[1], size: constOne)
                     function.wasmArrayNewDefault(arrayType: typeGroupB[0], size: constOne)
+                    return []
                 }
             }
         }
@@ -2055,9 +2056,10 @@ class MinimizerTests: XCTestCase {
             }
 
             b.buildWasmModule { wasmModule in
-                wasmModule.addWasmFunction(with: [] => []) { function, _ in
+                wasmModule.addWasmFunction(with: [] => []) { function, _, _ in
                     let constOne = function.consti32(1)
                     function.wasmArrayNewDefault(arrayType: typeGroupB[0], size: constOne)
+                    return []
                 }
             }
         }

Tests/FuzzilliTests/WasmAtomicsTests.swift

@@ -147,40 +147,44 @@ class WasmAtomicsTests: XCTestCase {
             // Load operations
 
             for memory in [unsharedMemory, sharedMemory] {
-                wasmModule.addWasmFunction(with: [] => []) { f, _ in
+                wasmModule.addWasmFunction(with: [] => []) { f, _, _ in
                     let address = f.consti32(1) // Unaligned for 4-byte access
                     // This should trap.
                     f.wasmAtomicLoad(memory: memory, address: address, loadType: .i32Load, offset: 0)
+                    return []
                 }
             }
 
             // memory64
             for memory in [unsharedMemory, sharedMemory] {
-                wasmModule.addWasmFunction(with: [] => []) { f, _ in
+                wasmModule.addWasmFunction(with: [] => []) { f, _, _ in
                     let address = f.consti32(4) // Unaligned for 8-byte access
                     // This should trap.
                     f.wasmAtomicLoad(memory: memory, address: address, loadType: .i64Load, offset: 0)
+                    return []
                 }
             }
 
             // Store operations
 
             for memory in [unsharedMemory, sharedMemory] {
-                wasmModule.addWasmFunction(with: [] => []) { f, _ in
+                wasmModule.addWasmFunction(with: [] => []) { f, _, _ in
                     let address = f.consti32(2) // Unaligned for 4-byte access
                     // This should trap.
                     let value = f.consti32(0x1337)
                     f.wasmAtomicStore(memory: memory, address: address, value: value, storeType: .i32Store, offset: 0)
+                    return []
                 }
             }
 
             // memory64
             for memory in [unsharedMemory, sharedMemory] {
-                wasmModule.addWasmFunction(with: [] => []) { f, _ in
+                wasmModule.addWasmFunction(with: [] => []) { f, _, _ in
                     let address = f.consti32(7) // Unaligned for 8-byte access
                     // This should trap.
                     let value = f.consti64(0xDEADBEEF)
                     f.wasmAtomicStore(memory: memory, address: address, value: value, storeType: .i64Store, offset: 0)
+                    return []
                 }
             }
         }