Skip to content

TypeRefiningGUFA errors on visitStructCmpxchg etc. #8473

@kripken

Description

@kripken

// TODO: Model the modification part of the RMW in addition to the read and
// the write.
addRoot(curr);

@tlively you added 4 of these TODOs and I think we need to fix them. Fuzzer testcase:

(module
 (type $struct (struct (field (mut eqref))))

 (func $atomic (param $0 (ref $struct)) (param $1 eqref) (result eqref)
  (struct.atomic.rmw.cmpxchg $struct 0
   (local.get $0)
   (local.get $1)
   (local.get $1)
  )
 )

 (func $call
  (drop
   (call $atomic
    (struct.new_default $struct)
    (ref.i31
     (i32.const 0)
    )
   )
  )
 )
)
$ bin/wasm-opt a.wat -all --type-refining-gufa --closed-world 
[wasm-validator error in function atomic] struct.atomic.rmw.cmpxchg replacement value must have the proper type, on 
(struct.atomic.rmw.cmpxchg $struct 0
 (local.get $0)
 (local.get $1)
 (local.get $1)
)
Fatal: error after opts

The problem is that this is not counted as a write, so GUFA thinks nothing is written to the field, and makes it nullref. And it then fails to validate to write an eqref there.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions