Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix direct comparisons with unshared basic heap types #6845

Merged
merged 1 commit into from
Aug 16, 2024

Conversation

tlively
Copy link
Member

@tlively tlively commented Aug 16, 2024

Audit the remaining ocurrences of == HeapType:: and fix those that did
not handle shared types correctly. Add tests for some of the fixes;
others are NFC but clarify the code.

Audit the remaining ocurrences of `== HeapType::` and fix those that did
not handle shared types correctly. Add tests for some of the fixes;
others are NFC but clarify the code.
@tlively tlively requested a review from kripken August 16, 2024 21:22
@tlively tlively enabled auto-merge (squash) August 16, 2024 21:45
@tlively tlively merged commit 95a4d5d into main Aug 16, 2024
13 checks passed
@tlively tlively deleted the fix-basic-heaptype-comparisons branch August 16, 2024 21:53
@gkdn gkdn mentioned this pull request Aug 31, 2024
@kripken
Copy link
Member

kripken commented Sep 26, 2024

I bisected a fuzz bug down to this commit. Testcase:

(module
 (rec
  (type $3 (sub (func)))
  (type $2 (shared (func (param f32))))
  (type $11 (func (param (ref eq) f32 f64 (ref $2) (ref $3) (ref null $4)) (result f64)))
  (type $4 (sub final $3 (func)))
  (type $1 (sub (array (ref null (shared array)))))
  (type $10 (func (param f64 (ref struct)) (result (ref $2))))
  (type $9 (struct))
  (type $8 (func))
  (type $7 (func (param i64)))
 )
 (type $7_0 (func (param i64)))
 (table $0 269 269 funcref)
 (elem declare func $2 $3)
 (tag $tag$0 (param i64))
 (func $0 (type $8)
  (drop
   (call $1
    (f64.const 0)
    (struct.new_default $9)
   )
  )
 )
 (func $1 (type $10) (param $0 f64) (param $1 (ref struct)) (result (ref $2))
  (drop
   (call_indirect $0 (type $11)
    (array.new_default $1
     (i32.const 0)
    )
    (f32.const 0)
    (f64.const 0)
    (ref.func $3)
    (ref.func $2)
    (block $label$1 (result (ref $4))
     (br_if $label$1
      (ref.func $2)
      (try (result i32)
       (do
        (return
         (ref.func $3)
        )
       )
       (catch $tag$0
        (drop
         (pop i64)
        )
        (i32.const 0)
       )
       (catch_all
        (unreachable)
       )
      )
     )
    )
    (i32.const 0)
   )
  )
  (ref.func $3)
 )
 (func $2 (type $4)
  (nop)
 )
 (func $3 (type $2) (param $0 f32)
  (nop)
 )
)
$ bin/wasm-opt aa.wat -all --inlining-optimizing --roundtrip
[wasm-validator error in function 0] break type must be a subtype of the target block type, on 
(block $label$1 (result (ref $4))
 (drop
  (array.new_default $1
   (i32.const 0)
  )
 )
 (drop
  (f32.const 0)
 )
 (drop
  (f64.const 0)
 )
 (drop
  (ref.func $3)
 )
 (drop
  (ref.func $2)
 )
 (br $label$1
  (ref.func $3)
 )
)
Fatal: error after opts

@kripken
Copy link
Member

kripken commented Sep 26, 2024

That fuzz bug bisected to this, but this was not the culprit. It only made it easier to hit the bug. Fix for that issue: #6976

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants