[wasm] Support call_ref

leonbett · v8-internal-scoped@luci-project-accounts.iam.gserviceaccount.com · commit 77806f1deafe · 2026-06-01T07:10:44.000-07:00
This CL adds support for the call_ref instruction. Bug: 474940922 Change-Id: If708e70dc9fcdd2f53f218f85e93c3d807a5ab9a Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9330021 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by: Matthias Liedtke <mliedtke@google.com>
diff --git a/Sources/Fuzzilli/Base/ProgramBuilder.swift b/Sources/Fuzzilli/Base/ProgramBuilder.swift
@@ -4783,6 +4783,22 @@ public class ProgramBuilder {
                 ).outputs)
         }
 
+        @discardableResult
+        public func wasmCallRef(
+            functionRef: Variable, functionArgs: [Variable]
+        ) -> [Variable] {
+            let signatureDef = b.getWasmTypeDef(for: b.type(of: functionRef))
+            let signature = b.type(of: signatureDef).wasmFunctionSignatureDefSignature
+            return Array(
+                b.emit(
+                    WasmCallRef(
+                        parameterCount: signature.parameterTypes.count,
+                        outputCount: signature.outputTypes.count),
+                    withInputs: functionArgs + [functionRef],
+                    types: signature.parameterTypes + [.wasmFuncRef()]
+                ).outputs)
+        }
+
         public func wasmReturnCallDirect(function: Variable, functionArgs: [Variable]) {
             let signature = b.type(of: function).wasmFunctionDefSignature!
             assert(
diff --git a/Sources/Fuzzilli/CodeGen/CodeGeneratorWeights.swift b/Sources/Fuzzilli/CodeGen/CodeGeneratorWeights.swift
@@ -363,6 +363,7 @@ public let codeGeneratorWeights = [
     "WasmJsCallGenerator":                      30,
     "WasmCallIndirectGenerator":                5,
     "WasmCallDirectGenerator":                  10,
+    "WasmCallRefGenerator":                     10,
     "WasmReturnCallDirectGenerator":            10,
     "WasmReturnCallIndirectGenerator":          10,
 
diff --git a/Sources/Fuzzilli/CodeGen/WasmCodeGenerators.swift b/Sources/Fuzzilli/CodeGen/WasmCodeGenerators.swift
@@ -1021,6 +1021,26 @@ public let WasmCodeGenerators: [CodeGenerator] = [
         function.wasmCallDirect(function: functionVar, functionArgs: functionArgs)
     },
 
+    CodeGenerator(
+        "WasmCallRefGenerator", inContext: .single(.wasmFunction),
+        inputs: .required(.wasmFunctionDef())
+    ) { b, functionVar in
+        let function = b.currentWasmModule.currentWasmFunction
+        let functionRef =
+            b.findVariable {
+                let varType = b.type(of: $0)
+                return varType.Is(.wasmFuncRef())
+                    && varType.Is(.wasmRef(.Index(), nullability: false))
+            } ?? function.wasmRefFunc(functionVar)
+
+        let signatureDef = b.getWasmTypeDef(for: b.type(of: functionRef))
+        let signature = b.type(of: signatureDef).wasmFunctionSignatureDefSignature
+
+        let functionArgs = b.randomWasmArguments(forWasmSignature: signature, generate: true)
+        guard let functionArgs else { return }
+        function.wasmCallRef(functionRef: functionRef, functionArgs: functionArgs)
+    },
+
     CodeGenerator("WasmReturnCallDirectGenerator", inContext: .single(.wasmFunction)) {
         b in
         let function = b.currentWasmModule.currentWasmFunction
diff --git a/Sources/Fuzzilli/FuzzIL/Instruction.swift b/Sources/Fuzzilli/FuzzIL/Instruction.swift
@@ -1484,6 +1484,11 @@ extension Instruction: ProtobufConvertible {
                     $0.parameterCount = Int32(op.parameterCount)
                     $0.outputCount = Int32(op.numOutputs)
                 }
+            case .wasmCallRef(let op):
+                $0.wasmCallRef = Fuzzilli_Protobuf_WasmCallRef.with {
+                    $0.parameterCount = Int32(op.parameterCount)
+                    $0.outputCount = Int32(op.numOutputs)
+                }
             case .wasmReturnCallDirect(let op):
                 $0.wasmReturnCallDirect = Fuzzilli_Protobuf_WasmReturnCallDirect.with {
                     $0.parameterCount = Int32(op.parameterCount)
@@ -2733,6 +2738,9 @@ extension Instruction: ProtobufConvertible {
         case .wasmCallDirect(let p):
             op = WasmCallDirect(
                 parameterCount: Int(p.parameterCount), outputCount: Int(p.outputCount))
+        case .wasmCallRef(let p):
+            op = WasmCallRef(
+                parameterCount: Int(p.parameterCount), outputCount: Int(p.outputCount))
         case .wasmReturnCallDirect(let p):
             op = WasmReturnCallDirect(parameterCount: Int(p.parameterCount))
         case .wasmReturnCallIndirect(let p):
diff --git a/Sources/Fuzzilli/FuzzIL/JSTyper.swift b/Sources/Fuzzilli/FuzzIL/JSTyper.swift
@@ -1070,6 +1070,13 @@ public struct JSTyper: Analyzer {
                 for (output, outputType) in zip(instr.outputs, signature.outputTypes) {
                     setType(of: output, to: outputType)
                 }
+            case .wasmCallRef(_):
+                let functionRef = instr.inputs.last!
+                let typeDesc = getTypeDescription(of: functionRef) as! WasmSignatureTypeDescription
+                let signature = typeDesc.signature
+                for (output, outputType) in zip(instr.outputs, signature.outputTypes) {
+                    setType(of: output, to: outputType)
+                }
             // Functions that can be called through a table are also already added by the wasmDefineTable instruction.
             // No need to analyze this and add them to the DynamicObjectGroupManager.
             case .wasmArrayNewFixed(_),
diff --git a/Sources/Fuzzilli/FuzzIL/Opcodes.swift b/Sources/Fuzzilli/FuzzIL/Opcodes.swift
@@ -381,4 +381,5 @@ enum Opcode {
     case wasmBranchOnCastFail(WasmBranchOnCastFail)
     case wasmRefFunc(WasmRefFunc)
     case wasmRefAsNonNull(WasmRefAsNonNull)
+    case wasmCallRef(WasmCallRef)
 }
diff --git a/Sources/Fuzzilli/FuzzIL/WasmOperations.swift b/Sources/Fuzzilli/FuzzIL/WasmOperations.swift
@@ -1012,6 +1012,19 @@ final class WasmCallDirect: WasmOperation {
     var parameterCount: Int { numInputs - 1 }
 }
 
+final class WasmCallRef: WasmOperation {
+    override var opcode: Opcode { .wasmCallRef(self) }
+
+    init(parameterCount: Int, outputCount: Int) {
+        // The inputs are the function reference and the function arguments.
+        super.init(
+            numInputs: 1 + parameterCount, numOutputs: outputCount, requiredContext: [.wasmFunction]
+        )
+    }
+
+    var parameterCount: Int { numInputs - 1 }
+}
+
 final class WasmReturnCallDirect: WasmOperation {
     override var opcode: Opcode { .wasmReturnCallDirect(self) }
 
diff --git a/Sources/Fuzzilli/Lifting/FuzzILLifter.swift b/Sources/Fuzzilli/Lifting/FuzzILLifter.swift
@@ -1219,6 +1219,15 @@ public class FuzzILLifter: Lifter {
                 w.emit("\(outputs) <- WasmCallDirect \(inputs)")
             }
 
+        case .wasmCallRef(_):
+            let inputs = instr.inputs.map(lift).joined(separator: ", ")
+            if instr.outputs.isEmpty {
+                w.emit("WasmCallRef \(inputs)")
+            } else {
+                let outputs = instr.outputs.map(lift).joined(separator: ", ")
+                w.emit("\(outputs) <- WasmCallRef \(inputs)")
+            }
+
         case .wasmReturnCallDirect(_):
             let inputs = instr.inputs.map(lift).joined(separator: ", ")
             w.emit("WasmReturnCallDirect \(inputs)")
diff --git a/Sources/Fuzzilli/Lifting/JavaScriptLifter.swift b/Sources/Fuzzilli/Lifting/JavaScriptLifter.swift
@@ -1911,6 +1911,7 @@ public class JavaScriptLifter: Lifter {
                 .wasmTableGrow(_),
                 .wasmCallIndirect(_),
                 .wasmCallDirect(_),
+                .wasmCallRef(_),
                 .wasmReturnCallDirect(_),
                 .wasmReturnCallIndirect(_),
                 .wasmMemoryLoad(_),
diff --git a/Sources/Fuzzilli/Lifting/WasmLifter.swift b/Sources/Fuzzilli/Lifting/WasmLifter.swift
@@ -1950,6 +1950,11 @@ public class WasmLifter {
             let functionRef = wasmInstruction.input(0)
             return Data([0x10])
                 + Leb128.unsignedEncode(try resolveIdx(ofType: .function, for: functionRef))
+        case .wasmCallRef(_):
+            let functionRef = wasmInstruction.inputs.last!
+            let typeDesc = typer.getTypeDescription(of: functionRef)
+            let sigIndex = typeDescToIndex[typeDesc]!
+            return Data([0x14]) + Leb128.unsignedEncode(sigIndex)
         case .wasmReturnCallDirect(_):
             let functionRef = wasmInstruction.input(0)
             return Data([0x12])
diff --git a/Sources/Fuzzilli/Mutators/OperationMutator.swift b/Sources/Fuzzilli/Mutators/OperationMutator.swift
@@ -792,6 +792,7 @@ public class OperationMutator: BaseInstructionMutator {
             .wasmTableSet(_),
             .wasmCallIndirect(_),
             .wasmCallDirect(_),
+            .wasmCallRef(_),
             .wasmReturnCallDirect(_),
             .wasmReturnCallIndirect(_),
             .wasmi32EqualZero(_),
diff --git a/Sources/Fuzzilli/Protobuf/operations.pb.swift b/Sources/Fuzzilli/Protobuf/operations.pb.swift
@@ -5148,6 +5148,20 @@ public struct Fuzzilli_Protobuf_WasmCallDirect: Sendable {
   public init() {}
 }
 
+public struct Fuzzilli_Protobuf_WasmCallRef: Sendable {
+  // SwiftProtobuf.Message conformance is added in an extension below. See the
+  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
+  // methods supported on all messages.
+
+  public var parameterCount: Int32 = 0
+
+  public var outputCount: Int32 = 0
+
+  public var unknownFields = SwiftProtobuf.UnknownStorage()
+
+  public init() {}
+}
+
 public struct Fuzzilli_Protobuf_WasmReturnCallDirect: Sendable {
   // SwiftProtobuf.Message conformance is added in an extension below. See the
   // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
@@ -13691,6 +13705,41 @@ extension Fuzzilli_Protobuf_WasmCallDirect: SwiftProtobuf.Message, SwiftProtobuf
   }
 }
 
+extension Fuzzilli_Protobuf_WasmCallRef: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
+  public static let protoMessageName: String = _protobuf_package + ".WasmCallRef"
+  public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}parameterCount\0\u{1}outputCount\0")
+
+  public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
+    while let fieldNumber = try decoder.nextFieldNumber() {
+      // The use of inline closures is to circumvent an issue where the compiler
+      // allocates stack space for every case branch when no optimizations are
+      // enabled. https://github.com/apple/swift-protobuf/issues/1034
+      switch fieldNumber {
+      case 1: try { try decoder.decodeSingularInt32Field(value: &self.parameterCount) }()
+      case 2: try { try decoder.decodeSingularInt32Field(value: &self.outputCount) }()
+      default: break
+      }
+    }
+  }
+
+  public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
+    if self.parameterCount != 0 {
+      try visitor.visitSingularInt32Field(value: self.parameterCount, fieldNumber: 1)
+    }
+    if self.outputCount != 0 {
+      try visitor.visitSingularInt32Field(value: self.outputCount, fieldNumber: 2)
+    }
+    try unknownFields.traverse(visitor: &visitor)
+  }
+
+  public static func ==(lhs: Fuzzilli_Protobuf_WasmCallRef, rhs: Fuzzilli_Protobuf_WasmCallRef) -> Bool {
+    if lhs.parameterCount != rhs.parameterCount {return false}
+    if lhs.outputCount != rhs.outputCount {return false}
+    if lhs.unknownFields != rhs.unknownFields {return false}
+    return true
+  }
+}
+
 extension Fuzzilli_Protobuf_WasmReturnCallDirect: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
   public static let protoMessageName: String = _protobuf_package + ".WasmReturnCallDirect"
   public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}parameterCount\0")
diff --git a/Sources/Fuzzilli/Protobuf/operations.proto b/Sources/Fuzzilli/Protobuf/operations.proto
@@ -1158,6 +1158,11 @@ message WasmCallDirect {
   int32 outputCount = 2;
 }
 
+message WasmCallRef {
+  int32 parameterCount = 1;
+  int32 outputCount = 2;
+}
+
 message WasmReturnCallDirect {
   int32 parameterCount = 1;
 }
diff --git a/Sources/Fuzzilli/Protobuf/program.pb.swift b/Sources/Fuzzilli/Protobuf/program.pb.swift
diff --git a/Sources/Fuzzilli/Protobuf/program.proto b/Sources/Fuzzilli/Protobuf/program.proto
@@ -377,6 +377,7 @@ message Instruction {
         WasmBranchOnCastFail wasmBranchOnCastFail = 351;
         WasmRefFunc wasmRefFunc = 352;
         WasmRefAsNonNull wasmRefAsNonNull = 353;
+        WasmCallRef wasmCallRef = 354;
     }
 }
 
diff --git a/Tests/FuzzilliTests/WasmTests.swift b/Tests/FuzzilliTests/WasmTests.swift
@@ -6443,24 +6443,26 @@ class WasmGCTests: XCTestCase {
         let b = fuzzer.makeBuilder()
 
         let module = b.buildWasmModule { wasmModule in
-            let f1 = wasmModule.addWasmFunction(with: [] => [.wasmi32]) { function, label, args in
-                return [function.consti32(42)]
+            let f1 = wasmModule.addWasmFunction(with: [.wasmi32] => [.wasmi32]) {
+                function, label, args in
+                return [function.wasmi32BinOp(args[0], function.consti32(1), binOpKind: .Add)]
             }
-            wasmModule.addWasmFunction(with: [] => [.wasmi32]) { function, label, args in
+            wasmModule.addWasmFunction(with: [.wasmi32] => [.wasmi32]) { function, label, args in
                 let ref = function.wasmRefFunc(f1)
-                // TODO(bettscheider): Once implemented, use `function.wasmCallRef(ref)` here.
-                return [function.wasmRefIsNull(ref)]
+                let callResult = function.wasmCallRef(functionRef: ref, functionArgs: args)[0]
+                return [callResult]
             }
         }
 
         let exports = module.loadExports()
         let outputFunc = b.createNamedVariable(forBuiltin: "output")
-        let wasmOut = b.callMethod(module.getExportedMethod(at: 1), on: exports, withArgs: [])
+        let wasmOut = b.callMethod(
+            module.getExportedMethod(at: 1), on: exports, withArgs: [b.loadInt(41)])
         b.callFunction(outputFunc, withArgs: [wasmOut])
 
         let prog = b.finalize()
         let jsProg = fuzzer.lifter.lift(prog, withOptions: [.includeComments])
-        testForOutput(program: jsProg, runner: runner, outputString: "0\n")
+        testForOutput(program: jsProg, runner: runner, outputString: "42\n")
     }
 
     func testRefNullIndexTypes() throws {

Original file line number	Diff line number	Diff line change
`@@ -381,4 +381,5 @@ enum Opcode {`
`381`	`381`	`case wasmBranchOnCastFail(WasmBranchOnCastFail)`
`382`	`382`	`case wasmRefFunc(WasmRefFunc)`
`383`	`383`	`case wasmRefAsNonNull(WasmRefAsNonNull)`
	`384`	`+ case wasmCallRef(WasmCallRef)`
`384`	`385`	`}`