Skip to content

JS interop fuzz bug with GTO and externref #9026

Description

@kripken
$ bin/wasm-opt -all --closed-world --gto t.wat --fuzz-exec
[fuzz-exec] export func_invoker
[trap unreachable]
[fuzz-exec] export func_31
[fuzz-exec] note result: func_31 => object(null)
[fuzz-exec] export func_invoker
[trap unreachable]
[fuzz-exec] export func_31
[fuzz-exec] note result: func_31 => object(externref(105))
[fuzz-exec] comparing func_31
values not identical! [ref (type $struct.0 (descriptor $struct.1) (struct)) ()desc=[ref (type $struct.0 (sub (describes $struct.1) (struct (field externref)))) externref(105)]] != [ref (type $struct.0 (descriptor $struct.1) (struct (field (mut (ref null (shared func)))) (field v128) (field i8) (field (mut (ref $func.0))) (field (mut (ref struct))))) (shared funcref(1), i32x4 0x00000000 0x00000000 0x00000000 0x00000000, 0, shared funcref(1), [ref (type $struct.0 (sub (describes $struct.1) (struct (field (mut externref)) (field (mut (ref $func.0))) (field v128) (field f64) (field v128) (field (mut exnref))))) (externref(105), shared funcref(1), i32x4 0x00000000 0x00000000 0x00000000 0x00000000, 0, i32x4 0x00000000 0x00000000 0x00000000 0x00000000, exnref)]), desc=[ref (type $struct.0 (sub (describes $struct.1) (struct (field (mut externref)) (field (mut (ref $func.0))) (field v128) (field f64) (field v128) (field (mut exnref))))) (externref(105), shared funcref(1), i32x4 0x00000000 0x00000000 0x00000000 0x00000000, 0, i32x4 0x00000000 0x00000000 0x00000000 0x00000000, nullexnref)]]
[fuzz-exec] optimization passes changed results
(module
 (rec
  (type $0 (descriptor $2) (struct (field (mut (ref null (shared func)))) (field v128) (field i8) (field (mut (ref $1))) (field (mut (ref struct)))))
  (type $5 (func (result f32 f64 f64 v128 (ref null $3) (ref $2))))
  (type $3 (shared (struct (field i16) (field (mut v128)) (field (mut (ref null (shared none)))))))
  (type $2 (sub (describes $0) (struct (field (mut externref)) (field (mut (ref $1))) (field v128) (field f64) (field v128) (field (mut exnref)))))
  (type $15 (func (param (ref null $2)) (result (ref $0))))
  (type $4 (sub (func (param i64) (result f32 f64 f64 v128 (ref null $3) (ref $2)))))
  (type $1 (shared (func (result f64 v128))))
  (type $11 (func (param f32)))
 )
 (type $9 (func))
 (type $17 (func (result structref)))
 (import "__fuzz_import" "extern$" (global $gimport$0 (ref extern)))
 (table $0 i64 55 funcref (ref.null nofunc))
 (elem $0 (i64.const 0) $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $5 $11)
 (elem declare func $1)
 (tag $tag$0 (type $11) (param f32))
 (tag $tag$1 (type $9))
 (export "func_invoker" (func $4))
 (export "func_31" (func $9))
 (func $1 (type $1) (result f64 v128)
  (tuple.make 2
   (f64.const 0)
   (v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000)
  )
 )
 (@binaryen.js.called)
 (func $2 (type $4) (param $0 i64) (result f32 f64 f64 v128 (ref null $3) (ref $2))
  (local $2 (ref null $4))
  (drop
   (try (result v128)
    (do
     (v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000)
    )
    (catch $tag$0
     (drop
      (pop f32)
     )
     (block (result v128)
      (table.set $0
       (i64.const 0)
       (ref.as_non_null
        (local.get $2)
       )
      )
      (v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000)
     )
    )
    (catch_all
     (unreachable)
    )
   )
  )
  (unreachable)
 )
 (func $4 (type $9)
  (drop
   (block (result f32)
    (drop
     (block (result f32)
      (drop
       (tuple.extract 6 0
        (call $2
         (i64.const 0)
        )
       )
      )
      (f32.const 0)
     )
    )
    (f32.const 0)
   )
  )
 )
 (@binaryen.js.called)
 (func $5 (type $15) (param $0 (ref null $2)) (result (ref $0))
  (unreachable)
 )
 (func $9 (type $17) (result structref)
  (local $0 exnref)
  (struct.new_desc $0
   (ref.func $1)
   (v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000)
   (i32.const 0)
   (ref.func $1)
   (struct.new $2
    (global.get $gimport$0)
    (ref.func $1)
    (v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000)
    (f64.const 0)
    (v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000)
    (block $block (result (ref exn))
     (try_table (catch_all_ref $block)
      (throw $tag$1)
     )
    )
   )
   (struct.new $2
    (global.get $gimport$0)
    (ref.func $1)
    (v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000)
    (f64.const 0)
    (v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000)
    (local.get $0)
   )
  )
 )
 (@binaryen.js.called)
 (func $11 (type $4) (param $0 i64) (result f32 f64 f64 v128 (ref null $3) (ref $2))
  (local $1 stringref)
  (drop
   (struct.get $2 0
    (struct.new $2
     (local.get $1)
     (ref.func $1)
     (v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000)
     (f64.const 0)
     (v128.const i32x4 0x00000000 0x00000000 0x00000000 0x00000000)
     (ref.null noexn)
    )
   )
  )
  (unreachable)
 )
)

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions