fitzgen requested alexcrichton for a review on PR #8742.
fitzgen opened PR #8742 from fitzgen:fuzz-bounds-checks to bytecodealliance:main.
fitzgen requested wasmtime-fuzz-reviewers for a review on PR #8742.
fitzgen updated PR #8742.
alexcrichton submitted PR review:
Nice! Any particular motivation for this or just curious to see how it fares?
alexcrichton submitted PR review:
Nice! Any particular motivation for this or just curious to see how it fares?
alexcrichton created PR review comment:
Do you think it's worth doing this in the text format instead of expanding out all the wasm-encoder bits?
alexcrichton created PR review comment:
Mind adding a memory64 knob to this as well? Also mind adding some docs for what each field member is? For example at a glance I'm not sure what
growthis.
alexcrichton created PR review comment:
Also could this grow a fully general
WasmtimeConfig? It would be good to test various compilation settings, Winch, the pooling allocator, etc.
alexcrichton created PR review comment:
Does this mean that memories are going to grow an arbitrary 32-bit amount of bytes? If so should that be capped here to stay within limits on oss-fuzz?
github-actions[bot] commented on PR #8742:
Subscribe to Label Action
cc @fitzgen
<details>
This issue or pull request has been labeled: "fuzzing"Thus the following users have been cc'd because of the following labels:
- fitzgen: fuzzing
To subscribe or unsubscribe from this label, edit the <code>.github/subscribe-to-label.json</code> configuration file.
Learn more.
</details>
fitzgen commented on PR #8742:
Any particular motivation for this or just curious to see how it fares?
I started writing this for my implementation of the custom-page-sizes proposal, but figured I'd split it out and land it first to keep PRs small.
fitzgen submitted PR review.
fitzgen created PR review comment:
Ha, I originally had that and rewrote it into the text format to get a little bit better throughput for the fuzzer. I can add a comment giving an overview of the generated module or something to make readability a bit better at a glance though.
fitzgen edited PR review comment.
fitzgen submitted PR review.
fitzgen created PR review comment:
Good idea, will do.
fitzgen created PR review comment:
An arbitrary 32-bit number of pages. I figured we could just allow and ignore growth failure, but will that run afoul of oss-fuzz?
fitzgen submitted PR review.
alexcrichton submitted PR review.
alexcrichton created PR review comment:
I think so yeah, but not always. Oss-fuzz/libfuzzer I think override malloc and mainly look at the heap size through that but IIRC it also occasionally looks through vm stats and looks for things like
mmap, so we could allocate 1G here and blow the limits on oss-fuzz when it gets around to detecting that. Given that I think we'll only want growths which are guaranteed to either succeed for fail given our memory limits.
fitzgen requested cfallin for a review on PR #8742.
fitzgen updated PR #8742.
fitzgen requested wasmtime-compiler-reviewers for a review on PR #8742.
cfallin submitted PR review.
cfallin submitted PR review.
cfallin created PR review comment:
Should this be
1rather than8? Otherwise this iteration range is empty...
alexcrichton submitted PR review.
alexcrichton created PR review comment:
This can use
input.config.to_store()which should also handle things like epochs/fuel configuration I believe.
fitzgen submitted PR review.
fitzgen created PR review comment:
Unfortunately, we can't use that since we are setting extra config settings based on the arbitrary heap image, but we don't have access to the config/engine if we use that method.
fitzgen updated PR #8742.
fitzgen has enabled auto merge for PR #8742.
fitzgen merged PR #8742.
Last updated: Dec 13 2025 at 19:03 UTC