Fuzz various functions in cranelift about wasmtime

[stoklund]

Fuzzing is a great idea. It will definitely find some parser bugs.

I wonder how well it will work for the deeper parts of the compiler. I suspect that the initial verifier pass will reject most of the fuzzer's attempts.

[stoklund]

The llvm-stress program is a different approach to compiler fuzzing. It generates random, but valid LLVM input. I think this approach could be combined with cargo-fuzz to make it more likely to tickle deeper parts of the compiler.

CSMith was very successful at finding compiler bugs by generating random but correct C programs that print the state of their globals before exiting. It works by comparing outputs from programs compiled with different compilers. A similar tool for WebAssembly would be very useful.

[anholt]

The underlying fuzzer is libFuzzer, and it seems to be quite good at drilling down to useful syntax quickly even in the absence of an input corpus. We'll be generating some corpus for our manual testcases, though, so that should make things even easier.

The failure I found sounds like it's actually rust-lang/rust#39882, so we'll have to wait until that's resolved to see value from cargo-fuzz, I think.

[stoklund]

Is it possible to run cargo-fuzz without the sanitizers enabled? Cretonne contains almost no unsafe code, so they are not likely to add much value anyway.

[stoklund]

Maybe add -C overflow-checks=on to a release build for fuzzing.

[bjorn3]

Wasmtime and regalloc.rs are now being fuzzed. Should this be closed?

[fitzgen]

Yeah we have a fairly extensive suite of cargo fuzz targets running in oss-fuzz. While improvements to those are always appreciated, it looks like this issue isn't tracking any particular missing thing anymore.