jeffcharles opened PR #7443 from jeffcharles:winch-defined-locals-range-fix
to bytecodealliance:main
:
<!--
Please make sure you include the following information:
If this work has been discussed elsewhere, please include a link to that
conversation. If it was discussed in an issue, just mention "issue #...".Explain why this change is needed. If the details are in an issue already,
this can be brief.Our development process is documented in the Wasmtime book:
https://docs.wasmtime.dev/contributing-development-process.htmlPlease ensure all communication follows the code of conduct:
https://github.com/bytecodealliance/wasmtime/blob/main/CODE_OF_CONDUCT.md
-->
I noticed a differential fuzzing failure in Winch when running the following module:(module (type (;0;) (func (param i64))) (func (;0;) (type 0) (param i64) (local i32) global.get 1 i32.eqz if ;; label = @1 unreachable end global.get 1 i32.const 1 i32.sub global.set 1 local.get 1 local.tee 1 global.get 0 i32.xor global.set 0 ) (global (;0;) (mut i32) i32.const 0) (global (;1;) (mut i32) i32.const 1000) (export "\00\01\00" (func 0)) (export "" (global 0)) )
I was able to narrow a repro case down to:
(module (func (;0;) (param i32) (result i32) (local i32) local.get 1 ) (export "t" (func 0)) )
This strongly hinted that there was a potential issue with locals when there is a param present.
In the area of code I have changed,
defined_locals.stack_size
may be an equal or lower value thandefined_locals_start
sincedefined_locals_start
is set based on the number and type of parameters anddefined_locals.stack_size
is set based on the number and type of locals but not parameters. The range should bedefined_locals_start
todefined_locals_start
plusdefined_locals.stack_size
.
jeffcharles requested abrown for a review on PR #7443.
jeffcharles requested wasmtime-compiler-reviewers for a review on PR #7443.
saulecabrera submitted PR review:
Thanks!
saulecabrera has enabled auto merge for PR #7443.
saulecabrera merged PR #7443.
Last updated: Dec 23 2024 at 13:07 UTC