Simple C++ exceptions fuzzer

[kripken]

This is a quick and simple fuzzer, but it should generate some interesting patterns. It should also allow for easy reduction of testcases (see comments in the source for the technique).

Example random output:

void func_34() {
  if (getBoolean()) {
    puts("log(17)");
  } else {
    try {
    } catch(...) {
    }
  }
  try {
  } catch(...) {
  }
  if (getBoolean()) {
    try {
      while (getBoolean()) {
        try {
          try {
            while (getBoolean()) {
              continue;
            }
          } catch(...) {
            if (getBoolean()) {
            }
          }
        } catch(...) {
        }
      }
    } catch(...) {
      while (getBoolean()) {
      }
    }
  }
  if (getBoolean()) {
  }
}

This is capable of crashing clang (on WebAssemblyCFGStackify) with -fwasm-exceptions. I assume it's too early to fuzz it?

cc @aheejin @tlively @dschuff

[kripken]

Added a simple reducer which seems to work well. It finds stuff like this:

void func_0() {
  puts("log(1)");
  try {
    try {
      throw 0;
    } catch(...) {
      try {
        while (getBoolean()) {
        }
      } catch(...) {
      }
    }
  } catch(...) {
  }
}

That crashes clang with

clang++: /b/s/w/ir/cache/builder/emscripten-releases/llvm-project/llvm/lib/Target/WebAssembly/WebAssemblyCFGStackify.cpp:1413: unsigned int (anonymous namespace)::WebAssemblyCFGStackify::getDepth(const SmallVectorImpl<const llvm::MachineBasicBlock *> &, const llvm::MachineBasicBlock *): Assertion `Depth < Stack.size() && "Branch destination should be in scope"' failed.

[kripken]

Can also find bugs in binaryen, this crashes with

wasm-emscripten-finalize: src/wasm/wasm-binary.cpp:1933: void wasm::WasmBinaryBuilder::readFunctions(): Assertion `delegateTargetNames.empty()' failed.

void func_0() {
  try {
    puts("log(1)");
  } catch(...) {
    while (getBoolean()) {
      throw 0;
    }
  }
}

I think this might be the rethrow bug that @aheejin mentions in WebAssembly/binaryen#3562 that will be fixed soon.

[aheejin]

Thanks, this is great! I'll check those crashing examples soon.

[stale]

This issue has been automatically marked as stale because there has been no activity in the past year. It will be closed automatically if no further activity occurs in the next 30 days. Feel free to re-open at any time if this issue is still relevant.