Skip to content

Commit

Permalink
Skip fuzz run after encountering the first non-determinism (#1262)
Browse files Browse the repository at this point in the history
* fix fuzz run after first non-determinism

The problem is that now multiple function could be run. If one function displays non-deterministic behavior between Wasmi and the other oracle, following function calls can be influenced by this via global state, for example global variable state. Thus a run needs to stop immediately after encountering non-determinism.

* update comment
  • Loading branch information
Robbepop authored Oct 27, 2024
1 parent c184357 commit 2a10f04
Showing 1 changed file with 5 additions and 13 deletions.
18 changes: 5 additions & 13 deletions fuzz/fuzz_targets/differential.rs
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,6 @@ fuzz_target!(|seed: &[u8]| {
let exports = wasmi_oracle.exports();
let mut params = Vec::new();
// True as long as differential execution is deterministic between both oracles.
let mut deterministic = true;
for (name, func_type) in exports.funcs() {
params.clear();
params.extend(
Expand All @@ -52,18 +51,17 @@ fuzz_target!(|seed: &[u8]| {
let params = &params[..];
let result_wasmi = wasmi_oracle.call(name, params);
let result_oracle = chosen_oracle.call(name, params);
// Note: If either of the oracles returns a non-deterministic error we ignore it
// to avoid having to deal with non-deterministic behavior between oracles.
// Note: If either of the oracles returns a non-deterministic error we skip the
// entire fuzz run since following function executions could be affected by
// this non-determinism due to shared global state, such as global variables.
if let Err(wasmi_err) = &result_wasmi {
if wasmi_err.is_non_deterministic() {
deterministic = false;
continue;
return;
}
}
if let Err(oracle_err) = &result_oracle {
if oracle_err.is_non_deterministic() {
deterministic = false;
continue;
return;
}
}
let wasmi_name = wasmi_oracle.name();
Expand Down Expand Up @@ -129,12 +127,6 @@ fuzz_target!(|seed: &[u8]| {
}
}
}
if !deterministic {
// We bail out and do not check global state since potential non-determinism
// has been detected previously which could have led to non-deterministic changes
// to Wasm global state.
return;
}
for name in exports.globals() {
let wasmi_val = wasmi_oracle.get_global(name);
let oracle_val = chosen_oracle.get_global(name);
Expand Down

0 comments on commit 2a10f04

Please sign in to comment.