RemoveUnusedModuleElements drops an active elem segment whose items are global.get, so call_indirect traps

Aperta
  • Qualcosa non va?
#9,366 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
68/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
cpp, wasm
Ambito
compilers

Direzione di ricerca

Start in src/passes/RemoveUnusedModuleElements.cpp, especially Analyzer::prepare() and notePossibleFunc; the issue identifies the RefFunc-only check and the missing global.get handling. Read the existing pass tests for element segments and add a regression case based on the supplied WAT module. Done means the segment and referenced global are retained as needed, and optimized execution still returns 42 instead of trapping.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

An active element segment whose item is global.get (the "Initializing a table with imported funcref global" case in the spec's elem.wast) is removed by --remove-unused-module-elements and at -O1 and above. The table slot stays null and call_indirect traps.

;; b2.wat
(module
  (type $f (func (result i32)))
  (import "env" "g" (global $g funcref))
  (table 1 funcref)
  (elem (i32.const 0) funcref (global.get $g))
  (func (export "call") (result i32)
    (call_indirect (type $f) (i32.const 0))))

wasm-opt b2.wat --enable-reference-types --remove-unused-module-elements -S -o - prints:

(module
 (type $f (func (result i32)))
 (table $0 1 funcref)
 (export "call" (func $0))
 (func $0 (result i32)
  (call_indirect $0 (type $f)
   (i32.const 0)
  )
 )
)

The segment and the import are gone. Instantiated in Node.js 26.13.0 with env.g set to a function returning 42:

unoptimized:                       call() = 42
--remove-unused-module-elements:   RuntimeError: function signature mismatch
-O1:                               RuntimeError: unreachable

The same happens when $g is a defined global initialized with ref.func (with --enable-gc).

Tested with wasm-opt version_133; on main (95a214dc48) the pass differs from version_133 only by the NFC renames in #9286/#9288.

In src/passes/RemoveUnusedModuleElements.cpp, notePossibleFunc in Analyzer::prepare() only looks at item->dynCast<RefFunc>(), so a segment with global.get items never gets into FlatTableInfo::typeElems and is considered unused.

Found with a differential-testing tool; the report was drafted with AI assistance and reviewed and edited by me.

Credit: https://ucsbplse.github.io/

Lingua principale
WebAssembly
Stelle
8.7k
Fork
905
Merge medio
1g 23h
PR unite (30g)
86

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di WebAssembly/binaryen

Tutte le issue di WebAssembly/binaryen

Issue simili

Altre issue su Compilers

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.