[wasm][fuzzer] Restructure and fix bugs in wasm-compile

Changes:
- GenerateInitExpr should emit a function reference to a function that
  is known to exist when funcref is expected.
- Add functions by signature index to the WasmModuleBuilder, so we avoid
  signature canonicalization, which currently does not work for wasm-gc.
- Remove printing of recursive groups in the WasmModuleBuilder. Instead,
  restrict type definitions to only refer to previous types.
- Some local restructuring of code, comments.

Bug: chromium:1296162
Change-Id: I5abd9bf8ec21ef6a51f00bc960b78519f2ec94f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3452433Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79054}

src/wasm/wasm-module-builder.cc

@@ -585,8 +585,7 @@ void WriteInitializerExpression(ZoneBuffer* buffer, const WasmInitExpr& init,
 }
 }  // namespace
 
-void WasmModuleBuilder::WriteTo(ZoneBuffer* buffer,
-                                bool emit_recursive_group) const {
+void WasmModuleBuilder::WriteTo(ZoneBuffer* buffer) const {
   // == Emit magic =============================================================
   buffer->write_u32(kWasmMagic);
   buffer->write_u32(kWasmVersion);
@@ -594,13 +593,6 @@ void WasmModuleBuilder::WriteTo(ZoneBuffer* buffer,
   // == Emit types =============================================================
   if (types_.size() > 0) {
     size_t start = EmitSection(kTypeSectionCode, buffer);
-
-    if (emit_recursive_group) {
-      // Wrap all types in a recursive group.
-      buffer->write_size(1);
-      buffer->write_u8(kWasmRecursiveTypeGroupCode);
-    }
-
     buffer->write_size(types_.size());
 
     // TODO(7748): Add support for recursive groups.

src/wasm/wasm-module-builder.h

@@ -360,10 +360,7 @@ class V8_EXPORT_PRIVATE WasmModuleBuilder : public ZoneObject {
   void SetHasSharedMemory();
 
   // Writing methods.
-  // If {emit_recursive_group}, wrap all type definitions in a wasm-gc recursive
-  // group.
-  // TODO(7748): Support custom recursive groups.
-  void WriteTo(ZoneBuffer* buffer, bool emit_recursive_group = false) const;
+  void WriteTo(ZoneBuffer* buffer) const;
   void WriteAsmJsOffsetTable(ZoneBuffer* buffer) const;
 
   Zone* zone() { return zone_; }

test/fuzzer/wasm-fuzzer-common.cc

@@ -193,16 +193,43 @@ void InterpretAndExecuteModule(i::Isolate* isolate,
 }
 
 namespace {
+
 struct PrintSig {
   const size_t num;
   const std::function<ValueType(size_t)> getter;
 };
+
 PrintSig PrintParameters(const FunctionSig* sig) {
   return {sig->parameter_count(), [=](size_t i) { return sig->GetParam(i); }};
 }
+
 PrintSig PrintReturns(const FunctionSig* sig) {
   return {sig->return_count(), [=](size_t i) { return sig->GetReturn(i); }};
 }
+
+std::string HeapTypeToConstantName(HeapType heap_type) {
+  switch (heap_type.representation()) {
+    case HeapType::kFunc:
+      return "kWasmFuncRef";
+    case HeapType::kExtern:
+      return "kWasmExternRef";
+    case HeapType::kEq:
+      return "kWasmEqRef";
+    case HeapType::kI31:
+      return "kWasmI31Ref";
+    case HeapType::kData:
+      return "kWasmDataRef";
+    case HeapType::kArray:
+      return "kWasmArrayRef";
+    case HeapType::kAny:
+      return "kWasmAnyRef";
+    case HeapType::kBottom:
+      UNREACHABLE();
+    default:
+      return std::to_string(heap_type.ref_index());
+  }
+}
+
 std::string ValueTypeToConstantName(ValueType type) {
   switch (type.kind()) {
     case kI8:
@@ -229,61 +256,21 @@ std::string ValueTypeToConstantName(ValueType type) {
           return "kWasmEqRef";
         case HeapType::kAny:
           return "kWasmAnyRef";
-        case HeapType::kData:
-          return "wasmOptRefType(kWasmDataRef)";
-        case HeapType::kArray:
-          return "wasmOptRefType(kWasmArrayRef)";
-        case HeapType::kI31:
-          return "wasmOptRefType(kWasmI31Ref)";
         case HeapType::kBottom:
-        default:
-          return "wasmOptRefType(" + std::to_string(type.ref_index()) + ")";
-      }
-    case kRef:
-      switch (type.heap_representation()) {
-        case HeapType::kExtern:
-          return "wasmRefType(kWasmExternRef)";
-        case HeapType::kFunc:
-          return "wasmRefType(kWasmFuncRef)";
-        case HeapType::kEq:
-          return "wasmRefType(kWasmEqRef)";
-        case HeapType::kAny:
-          return "wasmRefType(kWasmAnyRef)";
+          UNREACHABLE();
         case HeapType::kData:
-          return "wasmRefType(kWasmDataRef)";
         case HeapType::kArray:
-          return "wasmRefType(kWasmArrayRef)";
         case HeapType::kI31:
-          return "wasmRefType(kWasmI31Ref)";
-        case HeapType::kBottom:
         default:
-          return "wasmRefType(" + std::to_string(type.ref_index()) + ")";
+          return "wasmOptRefType(" + HeapTypeToConstantName(type.heap_type()) +
+                 ")";
       }
-    default:
-      UNREACHABLE();
-  }
-}
-
-std::string HeapTypeToConstantName(HeapType heap_type) {
-  switch (heap_type.representation()) {
-    case HeapType::kFunc:
-      return "kWasmFuncRef";
-    case HeapType::kExtern:
-      return "kWasmExternRef";
-    case HeapType::kEq:
-      return "kWasmEqRef";
-    case HeapType::kI31:
-      return "kWasmI31Ref";
-    case HeapType::kData:
-      return "kWasmDataRef";
-    case HeapType::kArray:
-      return "kWasmArrayRef";
-    case HeapType::kAny:
-      return "kWasmAnyRef";
-    case HeapType::kBottom:
+    case kRef:
+      return "wasmRefType(" + HeapTypeToConstantName(type.heap_type()) + ")";
+    case kRtt:
+    case kVoid:
+    case kBottom:
       UNREACHABLE();
-    default:
-      return std::to_string(heap_type.ref_index());
   }
 }
 
@@ -587,28 +574,6 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
         "\n"
         "const builder = new WasmModuleBuilder();\n";
 
-  if (module->has_memory) {
-    os << "builder.addMemory(" << module->initial_pages;
-    if (module->has_maximum_pages) {
-      os << ", " << module->maximum_pages;
-    } else {
-      os << ", undefined";
-    }
-    os << ", " << (module->mem_export ? "true" : "false");
-    if (module->has_shared_memory) {
-      os << ", true";
-    }
-    os << ");\n";
-  }
-
-  for (WasmGlobal& global : module->globals) {
-    os << "builder.addGlobal(" << ValueTypeToConstantName(global.type) << ", "
-       << global.mutability << ", ";
-    DecodeAndAppendInitExpr(os, &zone, module, wire_bytes, global.init,
-                            global.type);
-    os << ");\n";
-  }
-
   for (int i = 0; i < static_cast<int>(module->types.size()); i++) {
     if (module->has_struct(i)) {
       const StructType* struct_type = module->types[i].struct_type;
@@ -634,6 +599,28 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
     }
   }
 
+  if (module->has_memory) {
+    os << "builder.addMemory(" << module->initial_pages;
+    if (module->has_maximum_pages) {
+      os << ", " << module->maximum_pages;
+    } else {
+      os << ", undefined";
+    }
+    os << ", " << (module->mem_export ? "true" : "false");
+    if (module->has_shared_memory) {
+      os << ", true";
+    }
+    os << ");\n";
+  }
+
+  for (WasmGlobal& global : module->globals) {
+    os << "builder.addGlobal(" << ValueTypeToConstantName(global.type) << ", "
+       << global.mutability << ", ";
+    DecodeAndAppendInitExpr(os, &zone, module, wire_bytes, global.init,
+                            global.type);
+    os << ");\n";
+  }
+
   Zone tmp_zone(isolate->allocator(), ZONE_NAME);
 
   // TODO(9495): Add support for tables with explicit initializers.