Add table-related API coverage to the public API fuzzer (#13440)

fitzgen · web-flow · commit 5fb6a94277bd · 2026-05-21T20:44:15.000Z
diff --git a/crates/fuzzing/src/generators/api.rs b/crates/fuzzing/src/generators/api.rs
@@ -58,6 +58,16 @@ struct Swarm {
     global_ty: bool,
     global_drop: bool,
     get_global_export: bool,
+    table_type_new: bool,
+    table_type_drop: bool,
+    table_new: bool,
+    table_get: bool,
+    table_set: bool,
+    table_grow: bool,
+    table_size: bool,
+    table_ty: bool,
+    table_drop: bool,
+    get_table_export: bool,
 }
 
 /// A call to one of Wasmtime's public APIs.
@@ -120,6 +130,44 @@ pub enum ApiCall {
         instance: usize,
         nth: usize,
     },
+    TableTypeNew {
+        id: usize,
+        nullable: bool,
+    },
+    TableTypeDrop {
+        id: usize,
+    },
+    TableNew {
+        id: usize,
+        table_ty: usize,
+        store: usize,
+    },
+    TableGet {
+        table: usize,
+        idx: u64,
+    },
+    TableSet {
+        table: usize,
+        idx: u64,
+    },
+    TableGrow {
+        table: usize,
+        delta: u32,
+    },
+    TableSize {
+        table: usize,
+    },
+    TableTy {
+        table: usize,
+    },
+    TableDrop {
+        id: usize,
+    },
+    GetTableExport {
+        id: usize,
+        instance: usize,
+        nth: usize,
+    },
 }
 use ApiCall::*;
 
@@ -143,6 +191,13 @@ struct Scope {
     /// associated `store_id`.
     globals: BTreeMap<usize, usize>, // global_id -> store_id
 
+    /// Table types that are currently live.
+    table_types: BTreeSet<usize>,
+
+    /// Tables that are currently live. Maps from `table_id` to the table's
+    /// associated `store_id`.
+    tables: BTreeMap<usize, usize>, // table_id -> store_id
+
     config: Config,
 }
 
@@ -176,6 +231,8 @@ impl<'a> Arbitrary<'a> for ApiCalls {
             instances: BTreeMap::default(),
             global_types: BTreeSet::default(),
             globals: BTreeMap::default(),
+            table_types: BTreeSet::default(),
+            tables: BTreeMap::default(),
             config: config.clone(),
         };
 
@@ -213,6 +270,7 @@ impl<'a> Arbitrary<'a> for ApiCalls {
                     scope.stores.remove(&id);
                     scope.instances.retain(|_, store_id| *store_id != id);
                     scope.globals.retain(|_, store_id| *store_id != id);
+                    scope.tables.retain(|_, store_id| *store_id != id);
                     Ok(StoreDrop { id })
                 });
             }
@@ -334,6 +392,94 @@ impl<'a> Arbitrary<'a> for ApiCalls {
                     Ok(GetGlobalExport { id, instance, nth })
                 });
             }
+            if swarm.table_type_new {
+                choices.push(|input, scope| {
+                    let id = scope.next_id();
+                    let nullable = bool::arbitrary(input)?;
+                    scope.table_types.insert(id);
+                    Ok(TableTypeNew { id, nullable })
+                });
+            }
+            if swarm.table_type_drop && !scope.table_types.is_empty() {
+                choices.push(|input, scope| {
+                    let types: Vec<_> = scope.table_types.iter().collect();
+                    let id = **input.choose(&types)?;
+                    scope.table_types.remove(&id);
+                    Ok(TableTypeDrop { id })
+                });
+            }
+            if swarm.table_new && !scope.table_types.is_empty() && !scope.stores.is_empty() {
+                choices.push(|input, scope| {
+                    let types: Vec<_> = scope.table_types.iter().collect();
+                    let table_ty = **input.choose(&types)?;
+                    let stores: Vec<_> = scope.stores.iter().collect();
+                    let store = **input.choose(&stores)?;
+                    let id = scope.next_id();
+                    scope.tables.insert(id, store);
+                    Ok(TableNew {
+                        id,
+                        table_ty,
+                        store,
+                    })
+                });
+            }
+            if swarm.table_get && !scope.tables.is_empty() {
+                choices.push(|input, scope| {
+                    let tables: Vec<_> = scope.tables.keys().collect();
+                    let table = **input.choose(&tables)?;
+                    let idx = u64::arbitrary(input)?;
+                    Ok(TableGet { table, idx })
+                });
+            }
+            if swarm.table_set && !scope.tables.is_empty() {
+                choices.push(|input, scope| {
+                    let tables: Vec<_> = scope.tables.keys().collect();
+                    let table = **input.choose(&tables)?;
+                    let idx = u64::arbitrary(input)?;
+                    Ok(TableSet { table, idx })
+                });
+            }
+            if swarm.table_grow && !scope.tables.is_empty() {
+                choices.push(|input, scope| {
+                    let tables: Vec<_> = scope.tables.keys().collect();
+                    let table = **input.choose(&tables)?;
+                    let delta = u32::arbitrary(input)?;
+                    Ok(TableGrow { table, delta })
+                });
+            }
+            if swarm.table_size && !scope.tables.is_empty() {
+                choices.push(|input, scope| {
+                    let tables: Vec<_> = scope.tables.keys().collect();
+                    let table = **input.choose(&tables)?;
+                    Ok(TableSize { table })
+                });
+            }
+            if swarm.table_ty && !scope.tables.is_empty() {
+                choices.push(|input, scope| {
+                    let tables: Vec<_> = scope.tables.keys().collect();
+                    let table = **input.choose(&tables)?;
+                    Ok(TableTy { table })
+                });
+            }
+            if swarm.table_drop && !scope.tables.is_empty() {
+                choices.push(|input, scope| {
+                    let tables: Vec<_> = scope.tables.keys().collect();
+                    let id = **input.choose(&tables)?;
+                    scope.tables.remove(&id);
+                    Ok(TableDrop { id })
+                });
+            }
+            if swarm.get_table_export && !scope.instances.is_empty() {
+                choices.push(|input, scope| {
+                    let instances: Vec<_> = scope.instances.keys().collect();
+                    let instance = **input.choose(&instances)?;
+                    let nth = usize::arbitrary(input)?;
+                    let id = scope.next_id();
+                    let store = *scope.instances.get(&instance).unwrap();
+                    scope.tables.insert(id, store);
+                    Ok(GetTableExport { id, instance, nth })
+                });
+            }
 
             if choices.is_empty() {
                 break;
diff --git a/crates/fuzzing/src/oracles/api.rs b/crates/fuzzing/src/oracles/api.rs
@@ -17,6 +17,8 @@ pub fn make_api_calls(api: ApiCalls) {
     let mut instances: HashMap<usize, (Instance, usize)> = Default::default();
     let mut global_types: HashMap<usize, GlobalType> = Default::default();
     let mut globals: HashMap<usize, (Global, usize)> = Default::default();
+    let mut table_types: HashMap<usize, TableType> = Default::default();
+    let mut tables: HashMap<usize, (Table, usize)> = Default::default();
 
     for call in api.calls {
         match call {
@@ -32,6 +34,7 @@ pub fn make_api_calls(api: ApiCalls) {
                 log::trace!("dropping store {id}");
                 instances.retain(|_, (_, store_id)| *store_id != id);
                 globals.retain(|_, (_, store_id)| *store_id != id);
+                tables.retain(|_, (_, store_id)| *store_id != id);
                 stores.remove(&id);
             }
 
@@ -223,6 +226,138 @@ pub fn make_api_calls(api: ApiCalls) {
                 }
                 globals.insert(id, (gs[nth % gs.len()], store_id));
             }
+
+            ApiCall::TableTypeNew { id, nullable } => {
+                log::trace!("creating table type {id}");
+                let element = RefType::new(nullable, HeapType::Func);
+                let old = table_types.insert(id, TableType::new(element, 0, None));
+                assert!(old.is_none());
+            }
+
+            ApiCall::TableTypeDrop { id } => {
+                log::trace!("dropping table type {id}");
+                table_types.remove(&id);
+            }
+
+            ApiCall::TableNew {
+                id,
+                table_ty,
+                store,
+            } => {
+                log::trace!("creating table {id} with type {table_ty} in store {store}");
+                let tt = match table_types.get(&table_ty) {
+                    Some(t) => t.clone(),
+                    None => continue,
+                };
+                let st = match stores.get_mut(&store) {
+                    Some(s) => s,
+                    None => continue,
+                };
+                match tt.default_value(&mut *st) {
+                    Ok(t) => {
+                        tables.insert(id, (t, store));
+                    }
+                    Err(_) => continue,
+                }
+            }
+
+            ApiCall::TableGet { table, idx } => {
+                log::trace!("getting table {table} at index {idx}");
+                let (t, store_id) = match tables.get(&table) {
+                    Some(&x) => x,
+                    None => continue,
+                };
+                let st = match stores.get_mut(&store_id) {
+                    Some(s) => s,
+                    None => continue,
+                };
+                let _ = t.get(&mut *st, idx);
+            }
+
+            ApiCall::TableSet { table, idx } => {
+                log::trace!("setting table {table} at index {idx}");
+                let (t, store_id) = match tables.get(&table) {
+                    Some(&x) => x,
+                    None => continue,
+                };
+                let st = match stores.get_mut(&store_id) {
+                    Some(s) => s,
+                    None => continue,
+                };
+                let ty = t.ty(&*st);
+                let val: ValType = ty.element().clone().into();
+                if let Some(init) = val.default_value() {
+                    let _ = t.set(&mut *st, idx, init.ref_().unwrap());
+                }
+            }
+
+            ApiCall::TableGrow { table, delta } => {
+                log::trace!("growing table {table} by {delta}");
+                let (t, store_id) = match tables.get(&table) {
+                    Some(&x) => x,
+                    None => continue,
+                };
+                let st = match stores.get_mut(&store_id) {
+                    Some(s) => s,
+                    None => continue,
+                };
+                let ty = t.ty(&*st);
+                let val: ValType = ty.element().clone().into();
+                if let Some(init) = val.default_value() {
+                    let _ = t.grow(&mut *st, delta.into(), init.ref_().unwrap());
+                }
+            }
+
+            ApiCall::TableSize { table } => {
+                log::trace!("getting size of table {table}");
+                let (t, store_id) = match tables.get(&table) {
+                    Some(&x) => x,
+                    None => continue,
+                };
+                let st = match stores.get(&store_id) {
+                    Some(s) => s,
+                    None => continue,
+                };
+                let _ = t.size(st);
+            }
+
+            ApiCall::TableTy { table } => {
+                log::trace!("checking type of table {table}");
+                let (t, store_id) = match tables.get(&table) {
+                    Some(&x) => x,
+                    None => continue,
+                };
+                let st = match stores.get(&store_id) {
+                    Some(s) => s,
+                    None => continue,
+                };
+                let _ = t.ty(st);
+            }
+
+            ApiCall::TableDrop { id } => {
+                log::trace!("dropping table {id}");
+                tables.remove(&id);
+            }
+
+            ApiCall::GetTableExport { id, instance, nth } => {
+                log::trace!("getting {nth}th table export of instance {instance} as {id}");
+                let (inst, store_id) = match instances.get(&instance) {
+                    Some(&x) => x,
+                    None => continue,
+                };
+                let st = match stores.get_mut(&store_id) {
+                    Some(s) => s,
+                    None => continue,
+                };
+                let ts = inst
+                    .exports(&mut *st)
+                    .filter_map(|e| e.into_table())
+                    .collect::<Vec<_>>();
+                if ts.is_empty() {
+                    continue;
+                }
+                tables.insert(id, (ts[nth % ts.len()], store_id));
+            }
         }
     }
 }
