Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Fuzzer: DAE generates invalid code

Geschlossen
  • Stimmt etwas nicht?
#9,233 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
47/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
cpp, wasm
Bereich
compilers

Rechercherichtung

Start with src/passes/DeadArgumentElimination.cpp and the dae-optimizing pass; reproduce the validator failure using the reduced WAT and command in the issue. Trace how callers are tracked when call_ref becomes a direct call, and check whether the enclosing expression is re-finalized after return-type refinement. Done means the reduced case validates after the pass and relevant tests pass.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Run from the latest main bee0b57. Reduced WAT:

(module
 (rec
  (type $0 (sub (shared (func (result (ref null $1))))))
  (type $1 (sub (shared (array f32))))
  (type $2 (sub $0 (shared (func (result (ref null $1))))))
  (type $3 (sub (struct)))
  (type $4 (func (param (ref null $2)) (result f64)))
  (type $5 (func (result (ref $6))))
  (type $6 (shared (func (param (ref $3)) (result v128))))
  (type $7 (func))
 )
 (elem declare func $1 $2)
 (func $1 (type $6) (param $0 (ref $3)) (result v128)
  (unreachable)
 )
 (func $2 (type $5) (result (ref $6))
  (unreachable)
 )
 (func $3 (type $5) (result (ref $6))
  (local $10 i32)
  (select (result (ref $6))
   (call_ref $5
    (ref.func $2)
   )
   (ref.func $1)
   (stringview_wtf16.get_codeunit
    (string.const "\e2\82\ac")
    (block (result i32)
     (local.set $10
      (i32.const 1)
     )
     (local.get $10)
    )
   )
  )
 )
 (func $4 (type $7)
  (drop
   (call $3)
  )
 )
)

Command:

BINARYEN_PASS_DEBUG=1 bin/wasm-opt -all --closed-world --dae-optimizing fuzzed.wat

Output:

[wasm-validator error in function 3] stale type found in 3 on 0x561b46e160d8
(marked as (ref $func.0), should be (ref (exact $func.0)))
, on
(select (result (ref (exact $6)))
 (call $2)
 (ref.func $1)
 (stringview_wtf16.get_codeunit
  (string.const "\e2\82\ac")
  (i32.const 1)
 )
)
Fatal: Last pass (dae-optimizing) broke validation.

Replacing the call_ref with a direct call $2 makes the bug go away.

AI-generated hypothesis

In DeadArgumentElimination.cpp:

  1. callers is computed once, from direct Calls only. Initially $3 reaches $2 only via call_ref, so callers[$2] = {}.
  2. Iteration 1: $4 drops $3's result, so removeReturnValue($3) runs and $3 goes into worthOptimizing. optimizeAfterInlining then rewrites call_ref (ref.func $2) into call $2.
  3. Iteration 2: $2 now has a seen direct call, so refineReturnTypes($2) refines its result to (ref (shared nofunc)) and updates the Call's type. refinedCallers is populated from the stale callers[$2], which is empty, so $3 is never ReFinalized. The enclosing select keeps (ref $6) while its LUB is now (ref (exact $6)).

The comment above callers says over-approximating it is safe; this is an under-approximation, since new direct callers appear mid-pass via devirtualization.

Vorherrschende Sprache
WebAssembly
Sterne
8.7k
Forks
897
Ø Merge
2 T. 4 Std.
Gemergte PRs (30 T.)
103

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus WebAssembly/binaryen

Alle Issues in WebAssembly/binaryen

Ähnliche Issues

Weitere Issues zu Compilers

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.