Add struct subtypes

crates/fuzzing/src/generators/gc_ops/mod.rs

@@ -3,6 +3,7 @@
 pub mod limits;
 pub mod mutator;
 pub mod ops;
+pub mod scc;
 pub mod types;
 
 #[cfg(test)]

crates/fuzzing/src/generators/gc_ops/mutator.rs

@@ -4,13 +4,14 @@ use crate::generators::gc_ops::ops::{GcOp, GcOps};
 use crate::generators::gc_ops::types::{RecGroupId, TypeId};
 use mutatis::{Candidates, Context, DefaultMutate, Generate, Mutate, Result as MutResult};
 use smallvec::SmallVec;
+use std::collections::BTreeMap;
 
 /// A mutator for the gc ops.
 #[derive(Debug)]
 pub struct GcOpsMutator;
 
 impl GcOpsMutator {
-    // Define a mutation that adds an operation to the ops list.
+    /// Define a mutation that adds an operation to the ops list.
     fn add_operation(&mut self, c: &mut Candidates<'_>, ops: &mut GcOps) -> mutatis::Result<()> {
         if c.shrink() {
             return Ok(());
@@ -26,7 +27,7 @@ impl GcOpsMutator {
         Ok(())
     }
 
-    // Define a mutation that removes an operation from the ops list.
+    /// Define a mutation that removes an operation from the ops list.
     fn remove_operation(&mut self, c: &mut Candidates<'_>, ops: &mut GcOps) -> mutatis::Result<()> {
         if ops.ops.is_empty() {
             return Ok(());
@@ -40,7 +41,7 @@ impl GcOpsMutator {
         Ok(())
     }
 
-    // Define a mutation that adds an empty struct type to an existing (rec ...) group.
+    /// Define a mutation that adds an empty struct type to an existing (rec ...) group.
     fn add_new_struct_type_to_rec_group(
         &mut self,
         c: &mut Candidates<'_>,
@@ -59,15 +60,23 @@ impl GcOpsMutator {
                 .copied()
                 .expect("rec_groups not empty");
             let new_tid = ops.types.fresh_type_id(ctx.rng());
-            ops.types.insert_empty_struct(new_tid, group_id);
+            let is_final = (ctx.rng().gen_u32() % 4) == 0;
+            let keys: Vec<TypeId> = ops.types.type_defs.keys().copied().collect();
+            let supertype = if keys.is_empty() {
+                None
+            } else {
+                ctx.rng().choose(&keys).copied()
+            };
+            ops.types
+                .insert_empty_struct(new_tid, group_id, is_final, supertype);
             log::debug!("Added empty struct type {new_tid:?} to rec group {group_id:?}");
             Ok(())
         })?;
         Ok(())
     }
 
-    // Define a mutation that removes a struct type from an existing (rec ...).
-    // It may result in empty rec groups. Empty rec groups are allowed.
+    /// Define a mutation that removes a struct type from an existing (rec ...).
+    /// It may result in empty rec groups. Empty rec groups are allowed.
     fn remove_struct_type_from_rec_group(
         &mut self,
         c: &mut Candidates<'_>,
@@ -82,14 +91,15 @@ impl GcOpsMutator {
                 .choose(ops.types.type_defs.keys())
                 .copied()
                 .expect("type_defs not empty");
+
             ops.types.type_defs.remove(&tid);
             log::debug!("Removed struct type {tid:?}");
             Ok(())
         })?;
         Ok(())
     }
 
-    // Define a mutation that moves a struct type within an existing rec group.
+    /// Define a mutation that moves a struct type within an existing rec group.
     fn move_struct_type_within_rec_group(
         &mut self,
         c: &mut Candidates<'_>,
@@ -154,9 +164,9 @@ impl GcOpsMutator {
         Ok(())
     }
 
-    // Define a mutation that moves a struct type from one (rec ...) group to another.
-    // It will be a different rec group with high probability but it may try
-    // to move it to the same rec group.
+    /// Define a mutation that moves a struct type from one (rec ...) group to another.
+    /// It will be a different rec group with high probability but it may try
+    /// to move it to the same rec group.
     fn move_struct_type_between_rec_groups(
         &mut self,
         c: &mut Candidates<'_>,
@@ -184,7 +194,7 @@ impl GcOpsMutator {
         Ok(())
     }
 
-    // Define a mutation that duplicates a (rec ...) group.
+    /// Define a mutation that duplicates a (rec ...) group.
     fn duplicate_rec_group(
         &mut self,
         c: &mut Candidates<'_>,
@@ -197,45 +207,54 @@ impl GcOpsMutator {
         {
             return Ok(());
         }
+
         c.mutation(|ctx| {
-            let source_gid = ctx
+            let source_gid = *ctx
                 .rng()
                 .choose(&ops.types.rec_groups)
-                .copied()
                 .expect("rec_groups not empty");
 
+            // Collect (TypeId, is_final, supertype) for members of the source group.
+            let mut members: SmallVec<[(TypeId, bool, Option<TypeId>); 32]> = SmallVec::new();
+            for (tid, def) in ops.types.type_defs.iter() {
+                if def.rec_group == source_gid {
+                    members.push((*tid, def.is_final, def.supertype));
+                }
+            }
+
             // Create a new rec group.
             let new_gid = ops.types.fresh_rec_group_id(ctx.rng());
             ops.types.insert_rec_group(new_gid);
 
-            let count = ops
-                .types
-                .type_defs
-                .values()
-                .filter(|def| def.rec_group == source_gid)
-                .count();
-
-            // Skip empty rec groups.
-            if count == 0 {
-                return Ok(());
+            // Allocate fresh type ids for each member.
+            // We need to correctly match the supertypes in the new group as well.
+            // We keep track of the old type ids to new type ids in a map.
+            let mut old_to_new: BTreeMap<TypeId, TypeId> = BTreeMap::new();
+            for (old_tid, _, _) in &members {
+                old_to_new.insert(*old_tid, ops.types.fresh_type_id(ctx.rng()));
             }
 
-            // Since our structs are empty, we can just insert them into the new rec group.
-            // We will update mutators while adding new features to the fuzzer.
-            for _ in 0..count {
+            // Insert duplicated defs, rewriting intra-group supertype edges to the cloned ids.
+            for (old_tid, is_final, supertype) in &members {
+                // Get the new type id for the old type id.
+                let new_tid = old_to_new[old_tid];
+
+                // Map the supertype to the new type id.
+                // If it has no supertype, we keep it as None.
+                // If its supertype is in the same group, we map it to the new type id.
+                // If its supertype is in a different group, we keep it as is.
+                let mapped_super = supertype.map(|st| *old_to_new.get(&st).unwrap_or(&st));
                 ops.types
-                    .insert_empty_struct(ops.types.fresh_type_id(ctx.rng()), new_gid);
+                    .insert_empty_struct(new_tid, new_gid, *is_final, mapped_super);
             }
 
-            log::debug!(
-                "Duplicated rec group {source_gid:?} as new group {new_gid:?} ({count} types)"
-            );
             Ok(())
         })?;
+
         Ok(())
     }
 
-    // Define a mutation that removes a whole (rec ...) group.
+    /// Define a mutation that removes a whole (rec ...) group.
     fn remove_rec_group(&mut self, c: &mut Candidates<'_>, ops: &mut GcOps) -> mutatis::Result<()> {
         if ops.types.rec_groups.len() <= 2 {
             return Ok(());
@@ -247,16 +266,15 @@ impl GcOpsMutator {
                 .copied()
                 .expect("rec_groups not empty");
 
-            ops.types.type_defs.retain(|_, def| def.rec_group != gid);
             ops.types.rec_groups.remove(&gid);
 
-            log::debug!("Removed rec group {gid:?} and its member types");
+            log::debug!("Removed rec group {gid:?}");
             Ok(())
         })?;
         Ok(())
     }
 
-    // Define a mutation that merges two (rec ...) groups.
+    /// Define a mutation that merges two (rec ...) groups.
     fn merge_rec_groups(&mut self, c: &mut Candidates<'_>, ops: &mut GcOps) -> mutatis::Result<()> {
         if ops.types.rec_groups.is_empty() || ops.types.rec_groups.len() <= 2 {
             return Ok(());
@@ -314,6 +332,7 @@ impl GcOpsMutator {
     // Define a mutation that splits a (rec ...) group in two, if possible.
     fn split_rec_group(&mut self, c: &mut Candidates<'_>, ops: &mut GcOps) -> mutatis::Result<()> {
         if c.shrink()
+            || ops.types.rec_groups.is_empty()
             || ops.types.rec_groups.len() >= usize::try_from(ops.limits.max_rec_groups).unwrap()
             || ops.types.type_defs.len() < 2
         {
@@ -359,7 +378,7 @@ impl GcOpsMutator {
             };
             let k = k_minus_1 + 1;
 
-            // Move k distinct members by removing them from `members` as we pick.
+            // Move k distinct members by removing them from `members as we pick.
             for _ in 0..k {
                 let Some(i) = ctx.rng().gen_index(members.len()) else {
                     break;

crates/fuzzing/src/generators/gc_ops/ops.rs

@@ -69,7 +69,8 @@ impl GcOps {
         );
 
         // 1: "run"
-        let mut params: Vec<ValType> = Vec::with_capacity(self.limits.num_params as usize);
+        let mut params: Vec<ValType> =
+            Vec::with_capacity(usize::try_from(self.limits.num_params).unwrap());
         for _i in 0..self.limits.num_params {
             params.push(ValType::EXTERNREF);
         }
@@ -104,24 +105,46 @@ impl GcOps {
 
         let struct_type_base: u32 = types.len();
 
+        let type_order: Vec<TypeId> = self.types.sort_types_by_supertype();
+
+        // Build per-group member lists in `type_order` order (each group's list is a subsequence
+        // of `type_order`, so within-group supertypes come before subtypes when possible).
         let mut rec_groups: BTreeMap<RecGroupId, Vec<TypeId>> = self
             .types
             .rec_groups
             .iter()
             .copied()
-            .map(|id| (id, Vec::new()))
+            .map(|g| (g, Vec::new()))
             .collect();
 
-        for (id, ty) in self.types.type_defs.iter() {
-            rec_groups.entry(ty.rec_group).or_default().push(*id);
+        for &id in &type_order {
+            let g = self.types.type_defs[&id].rec_group;
+            rec_groups.get_mut(&g).unwrap().push(id);
         }
 
+        // Topological sort of rec-groups based on cross-group supertype edges.
+        let group_order: Vec<RecGroupId> = self.types.sort_rec_groups_topo(&rec_groups);
+
+        // Build the actual emission order and index map from it.
+        let encoding_order: Vec<TypeId> = group_order
+            .iter()
+            .flat_map(|g| rec_groups[g].iter().copied())
+            .collect();
+
+        // Build the index map from the encoding order.
+        let type_ids_to_index: BTreeMap<TypeId, u32> = encoding_order
+            .iter()
+            .copied()
+            .enumerate()
+            .map(|(i, id)| (id, struct_type_base + u32::try_from(i).unwrap()))
+            .collect();
+
         let encode_ty_id = |ty_id: &TypeId| -> wasm_encoder::SubType {
             let def = &self.types.type_defs[ty_id];
             match &def.composite_type {
                 CompositeType::Struct(StructType {}) => wasm_encoder::SubType {
-                    is_final: true,
-                    supertype_idx: None,
+                    is_final: def.is_final,
+                    supertype_idx: def.supertype.map(|st| type_ids_to_index[&st]),
                     composite_type: wasm_encoder::CompositeType {
                         inner: wasm_encoder::CompositeInnerType::Struct(wasm_encoder::StructType {
                             fields: Box::new([]),
@@ -136,10 +159,12 @@ impl GcOps {
 
         let mut struct_count = 0;
 
-        for type_ids in rec_groups.values() {
+        // Emit in topological order of rec-groups.
+        for g in &group_order {
+            let type_ids = &rec_groups[g];
             let members: Vec<wasm_encoder::SubType> = type_ids.iter().map(encode_ty_id).collect();
             types.ty().rec(members);
-            struct_count += type_ids.len() as u32;
+            struct_count += u32::try_from(type_ids.len()).unwrap();
         }
 
         let typed_fn_type_base: u32 = struct_type_base + struct_count;