Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

OptimizeInstructions: `select (memory.grow 1) (memory.grow 1) c` is folded to one operand and returns the wrong result

Fermée
  • Quelque chose ne va pas ?
#9,181 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

@tamaroning y travaille déjà.

Depuis le 7/10/2026.

  • #9227 par @tamaroning — ouverte

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
68/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
wasm
Domaine
compilers

Piste de recherche

Start at the line 2893 check in OptimizeInstructions and reproduce the issue with the supplied wasm-opt commands and WebAssembly modules. Verify the fix with --optimize-instructions --fuzz-exec for the memory.grow, array.get, atomic RMW, and table.grow cases, ensuring optimized results match the originals.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Summary

areConsecutiveInputsEqual treats two syntactically equal operands as equal in value when their children have no effects. That is wrong for operands that themselves write state (memory.grow, table.grow, atomic RMW), which return a different value on each evaluation.

Root cause

The check at line 2893, fallthroughEffects.orderedBefore(fallthroughChildEffects), leaves the operand itself out so that an idempotent call does not interfere with itself. As a result, an operand that reads and writes the same state, like memory.grow, is never compared with itself, and isGenerative (calls and allocations only) does not catch it. A possible fix is to also reject an operand whose own effects interfere with a second evaluation of itself, keeping the exemption for idempotent calls only.

Affected passes

Only OptimizeInstructions.

Reproducer
(module (memory 1 5)
  (func (export "s") (result i32)
    (select (memory.grow (i32.const 1)) (memory.grow (i32.const 1)) (i32.const 1))))

$ wasm-opt in.wat -all --optimize-instructions --print
 (func $0 (type $0) (result i32)
  (drop
   (memory.grow
    (i32.const 1)
   )
  )
  (drop
   (i32.const 1)
  )
  (memory.grow
   (i32.const 1)
  )
 )

The condition is 1, so the select must return the first grow's result:

$ wasm-opt in.wat -all --optimize-instructions --fuzz-exec -o /dev/null
[fuzz-exec] export s
[fuzz-exec] note result: s => 1
[fuzz-exec] export s
[fuzz-exec] note result: s => 2
[fuzz-exec] comparing s
values not identical! 2 != 1
[fuzz-exec] optimization passes changed results

Second reproducer:

(module
  (type $a (array (mut i32)))
  (memory 1 10)
  (func (export "f") (result i32)
    (array.get $a
      (array.new_fixed $a 2 (memory.grow (i32.const 1)) (memory.grow (i32.const 1)))
      (i32.const 1))))

$ wasm-opt in.wat --enable-reference-types --enable-gc --optimize-instructions --fuzz-exec -o /dev/null
[fuzz-exec] export f
[fuzz-exec] note result: f => 2
[fuzz-exec] export f
[fuzz-exec] note result: f => 1
[fuzz-exec] comparing f
values not identical! 1 != 2
[fuzz-exec] optimization passes changed results
Expected vs actual

select, c = 1: the original returns the first grow's result, 1; the optimized module returns 2. array.get ... 1: the original gives 2; the optimized module gives 1. Two i32.atomic.rmw.adds and table.grow behave the same.

Version

Reproduced on upstream main at 4d8ac549e2ab9b283246ea95e79ebe139ca579ac (wasm-opt version 133).

AI was used as part of the process of finding this issue. I have manually checked and reproduced it.

Langage dominant
WebAssembly
Étoiles
8.7k
Forks
900
Merge moyen
2 j 2 h
PR mergées (30 j)
101

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de WebAssembly/binaryen

Toutes les issues de WebAssembly/binaryen

Issues similaires

Plus d'issues Compilers

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.