[wasm] Allow abstract heap types in more places

Bug: 445356784
Change-Id: I488149208dcda6e632ff1fc36d7c959978c3d470
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9078876
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Manos Koukoutos <manoskouk@google.com>

Author: Liedtke

Sources/Fuzzilli/Base/ProgramBuilder.swift

@@ -4610,19 +4610,16 @@ public class ProgramBuilder {
 
         let fields = (0..<Int.random(in: 0...10)).map { _ in
             var type: ILType
-            if let elementType = randomVariable(ofType: .wasmTypeDef()),
-                probability(0.25)
-            {
-                // TODO(mliedtke): Allow non-nullable reference types. Right now we can't do this as
-                // the WasmStructNewGenerator might then fail to generate a struct.
-                let nullability = true
+            // TODO(mliedtke): Allow non-nullable reference types. Right now we can't do this as
+            // the WasmStructNewGenerator might then fail to generate a struct.
+            let nullability = true
+            if let elementType = randomVariable(ofType: .wasmTypeDef()), probability(0.25) {
                 indexTypes.append(elementType)
                 type = .wasmRef(.Index(), nullability: nullability)
             } else {
-                // TODO(mliedtke): Extend list with abstract heap types.
                 type = chooseUniform(from: [
                     .wasmPackedI8, .wasmPackedI16, .wasmi32, .wasmi64, .wasmf32, .wasmf64, .wasmSimd128,
-                ])
+                ] + WasmAbstractHeapType.allCases.map {ILType.wasmRef($0, nullability: nullability)})
             }
             return WasmStructTypeDescription.Field(
                 type: type, mutability: probability(0.75))
@@ -4705,8 +4702,9 @@ public class ProgramBuilder {
                 indexTypes.append(elementType)
                 return ILType.wasmRef(.Index(), nullability: nullability)
             } else {
-                // TODO(mliedtke): Extend list with abstract heap types.
-                return chooseUniform(from: [.wasmi32, .wasmi64, .wasmf32, .wasmf64, .wasmSimd128])
+                let nullability = !allowNonNullable || probability(0.5)
+                return chooseUniform(from: [.wasmi32, .wasmi64, .wasmf32, .wasmf64, .wasmSimd128]
+                    + WasmAbstractHeapType.allCases.map {ILType.wasmRef($0, nullability: nullability)})
             }
         }
         let signature = (0..<parameterCount).map {_ in chooseType()}

Sources/Fuzzilli/CodeGen/WasmCodeGenerators.swift

@@ -2005,11 +2005,11 @@ fileprivate let wasmArrayTypeGenerator = GeneratorStub(
             elementType: .wasmRef(.Index(), nullability: nullability),
             mutability: mutability, indexType: elementType)
     } else {
-        // TODO(mliedtke): Extend list with abstract heap types.
         b.wasmDefineArrayType(
             elementType: chooseUniform(from: [
                 .wasmPackedI8, .wasmPackedI16, .wasmi32, .wasmi64, .wasmf32, .wasmf64, .wasmSimd128,
-            ]), mutability: mutability)
+            ] + WasmAbstractHeapType.allCases.map {ILType.wasmRef($0, nullability: Bool.random())}),
+            mutability: mutability)
     }
 }