[wasm] Add WasmRefEq operation and generator

Adds support for ref.eq instruction to be generated

Bug: 474940922
Change-Id: I7b88ceffed5252878132406da30a570be01f13ad
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8933276
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Doga Yüksel <dyuksel@google.com>

Author: Doga Yüksel

Sources/Fuzzilli/Base/ProgramBuilder.swift

@@ -4374,6 +4374,12 @@ public class ProgramBuilder {
             return b.emit(WasmRefIsNull(), withInputs: [ref], types: [.wasmGenericRef]).output
         }
 
+        @discardableResult
+        // TODO(pawkra): Support shared references.
+        public func wasmRefEq(_ lhs: Variable, _ rhs: Variable) -> Variable {
+            return b.emit(WasmRefEq(), withInputs: [lhs, rhs], types: [.wasmEqRef(), .wasmEqRef()]).output
+        }
+
         @discardableResult
         public func wasmRefI31(_ number: Variable, shared: Bool = false) -> Variable {
             return b.emit(WasmRefI31(isShared: shared), withInputs: [number], types: [.wasmi32]).output

Sources/Fuzzilli/CodeGen/CodeGeneratorWeights.swift

@@ -371,6 +371,7 @@ public let codeGeneratorWeights = [
     "WasmStructSetGenerator":                   5,
     "WasmRefNullGenerator":                     5,
     "WasmRefIsNullGenerator":                   5,
+    "WasmRefEqGenerator":                       5,
     "WasmRefI31Generator":                      5,
     "WasmI31GetGenerator":                      5,
     "WasmAnyConvertExternGenerator":            5,

Sources/Fuzzilli/CodeGen/WasmCodeGenerators.swift

@@ -312,6 +312,14 @@ public let WasmCodeGenerators: [CodeGenerator] = [
         b.currentWasmModule.currentWasmFunction.wasmRefIsNull(ref)
     },
 
+    CodeGenerator(
+        "WasmRefEqGenerator", inContext: .single(.wasmFunction),
+        inputs: .required(.wasmEqRef(), .wasmEqRef()),
+        produces: [.wasmi32]
+    ) { b, lhs, rhs in
+        b.currentWasmModule.currentWasmFunction.wasmRefEq(lhs, rhs)
+    },
+
     // TODO(pawkra): add shared variant.
     CodeGenerator("WasmRefI31Generator", inContext: .single(.wasmFunction), inputs: .required(.wasmi32)) { b, value in
         b.currentWasmModule.currentWasmFunction.wasmRefI31(value, shared: false)

Sources/Fuzzilli/FuzzIL/Instruction.swift

@@ -1617,6 +1617,8 @@ extension Instruction: ProtobufConvertible {
                 }
             case .wasmRefIsNull(_):
                 $0.wasmRefIsNull = Fuzzilli_Protobuf_WasmRefIsNull()
+            case .wasmRefEq(_):
+                $0.wasmRefEq = Fuzzilli_Protobuf_WasmRefEq()
             case .wasmRefI31(let op):
                 $0.wasmRefI31 = Fuzzilli_Protobuf_WasmRefI31.with {
                     $0.isShared = op.isShared
@@ -2599,6 +2601,8 @@ extension Instruction: ProtobufConvertible {
             op = p.hasType ? WasmRefNull(type: WasmTypeEnumToILType(p.type)) : WasmRefNull(type: nil)
         case .wasmRefIsNull(_):
             op = WasmRefIsNull()
+        case .wasmRefEq(_):
+            op = WasmRefEq()
         case .wasmRefI31(let p):
             op = WasmRefI31(isShared: p.isShared)
         case .wasmI31Get(let p):

Sources/Fuzzilli/FuzzIL/JSTyper.swift

@@ -915,6 +915,8 @@ public struct JSTyper: Analyzer {
                 }
             case .wasmRefIsNull(_):
                 setType(of: instr.output, to: .wasmi32)
+            case .wasmRefEq(_):
+                setType(of: instr.output, to: .wasmi32)
             case .wasmRefI31(let op):
                 setType(of: instr.output, to: .wasmRefI31(shared: op.isShared))
             case .wasmI31Get(_):

Sources/Fuzzilli/FuzzIL/Opcodes.swift

@@ -365,4 +365,5 @@ enum Opcode {
     case createNamedAsyncDisposableVariable(CreateNamedAsyncDisposableVariable)
     case wasmDefineAdHocSignatureType(WasmDefineAdHocSignatureType)
     case wasmStructNew(WasmStructNew)
+    case wasmRefEq(WasmRefEq)
 }

Sources/Fuzzilli/FuzzIL/WasmOperations.swift

@@ -2283,6 +2283,14 @@ class WasmRefIsNull: WasmOperation {
     }
 }
 
+class WasmRefEq: WasmOperation {
+    override var opcode: Opcode { .wasmRefEq(self) }
+
+    init() {
+        super.init(numInputs: 2, numOutputs: 1, requiredContext: [.wasmFunction])
+    }
+}
+
 class WasmRefI31: WasmOperation {
     override var opcode: Opcode { .wasmRefI31(self) }
     let isShared: Bool

Sources/Fuzzilli/Lifting/FuzzILLifter.swift

@@ -1330,6 +1330,9 @@ public class FuzzILLifter: Lifter {
         case .wasmRefIsNull(_):
             w.emit("\(output()) <- WasmRefIsNull \(input(0))")
 
+        case .wasmRefEq(_):
+            w.emit("\(output()) <- WasmRefEq \(input(0)) \(input(1))")
+
         case .wasmRefI31(_):
             w.emit("\(output()) <- WasmRefI31 \(input(0))")
 

Sources/Fuzzilli/Lifting/JavaScriptLifter.swift

@@ -1789,6 +1789,7 @@ public class JavaScriptLifter: Lifter {
                  .wasmStructSet(_),
                  .wasmRefNull(_),
                  .wasmRefIsNull(_),
+                 .wasmRefEq(_),
                  .wasmRefI31(_),
                  .wasmI31Get(_),
                  .wasmAnyConvertExtern(_),

Sources/Fuzzilli/Lifting/WasmLifter.swift

@@ -2185,6 +2185,8 @@ public class WasmLifter {
             return try Data([0xD0]) + encodeHeapType(typer.type(of: wasmInstruction.output))
         case .wasmRefIsNull(_):
             return Data([0xD1])
+        case .wasmRefEq(_):
+            return Data([0xD3])
         case .wasmRefI31(let op):
             return Data([Prefix.GC.rawValue, op.isShared ? 0x1F : 0x1C])
         case .wasmI31Get(let op):