Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

OptimizeInstructions: `select (memory.grow 1) (memory.grow 1) c` is folded to one operand and returns the wrong result

Aberta
  • Algo errado?
#9,181 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

@tamaroning já está trabalhando nisso.

Desde 7/10/2026.

  • #9227 de @tamaroning — aberto

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
68/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
wasm
Domínio
compilers

Direção de pesquisa

Start at the line 2893 check in OptimizeInstructions and reproduce the issue with the supplied wasm-opt commands and WebAssembly modules. Verify the fix with --optimize-instructions --fuzz-exec for the memory.grow, array.get, atomic RMW, and table.grow cases, ensuring optimized results match the originals.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Summary

areConsecutiveInputsEqual treats two syntactically equal operands as equal in value when their children have no effects. That is wrong for operands that themselves write state (memory.grow, table.grow, atomic RMW), which return a different value on each evaluation.

Root cause

The check at line 2893, fallthroughEffects.orderedBefore(fallthroughChildEffects), leaves the operand itself out so that an idempotent call does not interfere with itself. As a result, an operand that reads and writes the same state, like memory.grow, is never compared with itself, and isGenerative (calls and allocations only) does not catch it. A possible fix is to also reject an operand whose own effects interfere with a second evaluation of itself, keeping the exemption for idempotent calls only.

Affected passes

Only OptimizeInstructions.

Reproducer
(module (memory 1 5)
  (func (export "s") (result i32)
    (select (memory.grow (i32.const 1)) (memory.grow (i32.const 1)) (i32.const 1))))

$ wasm-opt in.wat -all --optimize-instructions --print
 (func $0 (type $0) (result i32)
  (drop
   (memory.grow
    (i32.const 1)
   )
  )
  (drop
   (i32.const 1)
  )
  (memory.grow
   (i32.const 1)
  )
 )

The condition is 1, so the select must return the first grow's result:

$ wasm-opt in.wat -all --optimize-instructions --fuzz-exec -o /dev/null
[fuzz-exec] export s
[fuzz-exec] note result: s => 1
[fuzz-exec] export s
[fuzz-exec] note result: s => 2
[fuzz-exec] comparing s
values not identical! 2 != 1
[fuzz-exec] optimization passes changed results

Second reproducer:

(module
  (type $a (array (mut i32)))
  (memory 1 10)
  (func (export "f") (result i32)
    (array.get $a
      (array.new_fixed $a 2 (memory.grow (i32.const 1)) (memory.grow (i32.const 1)))
      (i32.const 1))))

$ wasm-opt in.wat --enable-reference-types --enable-gc --optimize-instructions --fuzz-exec -o /dev/null
[fuzz-exec] export f
[fuzz-exec] note result: f => 2
[fuzz-exec] export f
[fuzz-exec] note result: f => 1
[fuzz-exec] comparing f
values not identical! 1 != 2
[fuzz-exec] optimization passes changed results
Expected vs actual

select, c = 1: the original returns the first grow's result, 1; the optimized module returns 2. array.get ... 1: the original gives 2; the optimized module gives 1. Two i32.atomic.rmw.adds and table.grow behave the same.

Version

Reproduced on upstream main at 4d8ac549e2ab9b283246ea95e79ebe139ca579ac (wasm-opt version 133).

AI was used as part of the process of finding this issue. I have manually checked and reproduced it.

Linguagem predominante
WebAssembly
Estrelas
8.7k
Forks
893
Merge médio
1d 18h
PRs com merge (30d)
95

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de WebAssembly/binaryen

Todas as issues de WebAssembly/binaryen

Issues semelhantes

Mais issues de Compilers

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.