Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

OptimizeInstructions: `select (memory.grow 1) (memory.grow 1) c` is folded to one operand and returns the wrong result

Offen
  • Stimmt etwas nicht?
#9,181 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

@tamaroning arbeitet bereits daran.

Seit 07.10.2026.

  • #9227 von @tamaroning — offen

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
68/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
wasm
Bereich
compilers

Rechercherichtung

Start at the line 2893 check in OptimizeInstructions and reproduce the issue with the supplied wasm-opt commands and WebAssembly modules. Verify the fix with --optimize-instructions --fuzz-exec for the memory.grow, array.get, atomic RMW, and table.grow cases, ensuring optimized results match the originals.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Summary

areConsecutiveInputsEqual treats two syntactically equal operands as equal in value when their children have no effects. That is wrong for operands that themselves write state (memory.grow, table.grow, atomic RMW), which return a different value on each evaluation.

Root cause

The check at line 2893, fallthroughEffects.orderedBefore(fallthroughChildEffects), leaves the operand itself out so that an idempotent call does not interfere with itself. As a result, an operand that reads and writes the same state, like memory.grow, is never compared with itself, and isGenerative (calls and allocations only) does not catch it. A possible fix is to also reject an operand whose own effects interfere with a second evaluation of itself, keeping the exemption for idempotent calls only.

Affected passes

Only OptimizeInstructions.

Reproducer
(module (memory 1 5)
  (func (export "s") (result i32)
    (select (memory.grow (i32.const 1)) (memory.grow (i32.const 1)) (i32.const 1))))

$ wasm-opt in.wat -all --optimize-instructions --print
 (func $0 (type $0) (result i32)
  (drop
   (memory.grow
    (i32.const 1)
   )
  )
  (drop
   (i32.const 1)
  )
  (memory.grow
   (i32.const 1)
  )
 )

The condition is 1, so the select must return the first grow's result:

$ wasm-opt in.wat -all --optimize-instructions --fuzz-exec -o /dev/null
[fuzz-exec] export s
[fuzz-exec] note result: s => 1
[fuzz-exec] export s
[fuzz-exec] note result: s => 2
[fuzz-exec] comparing s
values not identical! 2 != 1
[fuzz-exec] optimization passes changed results

Second reproducer:

(module
  (type $a (array (mut i32)))
  (memory 1 10)
  (func (export "f") (result i32)
    (array.get $a
      (array.new_fixed $a 2 (memory.grow (i32.const 1)) (memory.grow (i32.const 1)))
      (i32.const 1))))

$ wasm-opt in.wat --enable-reference-types --enable-gc --optimize-instructions --fuzz-exec -o /dev/null
[fuzz-exec] export f
[fuzz-exec] note result: f => 2
[fuzz-exec] export f
[fuzz-exec] note result: f => 1
[fuzz-exec] comparing f
values not identical! 1 != 2
[fuzz-exec] optimization passes changed results
Expected vs actual

select, c = 1: the original returns the first grow's result, 1; the optimized module returns 2. array.get ... 1: the original gives 2; the optimized module gives 1. Two i32.atomic.rmw.adds and table.grow behave the same.

Version

Reproduced on upstream main at 4d8ac549e2ab9b283246ea95e79ebe139ca579ac (wasm-opt version 133).

AI was used as part of the process of finding this issue. I have manually checked and reproduced it.

Vorherrschende Sprache
WebAssembly
Sterne
8.7k
Forks
893
Ø Merge
1 T. 18 Std.
Gemergte PRs (30 T.)
95

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus WebAssembly/binaryen

Alle Issues in WebAssembly/binaryen

Ähnliche Issues

Weitere Issues zu Compilers

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.