WebAssembly / WebAssembly/binaryen

Flatten pass can make invalid modules on tuple types

Open
#3,759 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
WebAssembly
Stars
8.6k
Forks
885
Avg merge
1d 19h
Merged PRs (30d)
69

Description

This came up while fuzzing, and I traced it using git bisect to PR #3710 where non-nullable locals are handled by handleNonNullableLocals. It doesn't seem to handle tuple types that contain a non-nullable ref, resulting in a validation error after Flatten pass.

seed: 17382324165229480416

Full validation result:

[wasm-validator error in function 3] unexpected false: vars must be defaultable, on 
(v128 (ref (func (param f32))) v128 i64)
[wasm-validator error in function 3] unexpected false: vars must be defaultable, on 
(v128 (ref (func (param f32))) v128 i64)
[wasm-validator error in function 3] unexpected false: vars must be defaultable, on 
(v128 (ref (func (param f32))) v128 i64)
[wasm-validator error in function 3] unexpected false: vars must be defaultable, on 
(v128 (ref (func (param f32))) v128 i64)
Fatal: Last pass (flatten) broke validation. Run with BINARYEN_PASS_DEBUG=2 in the env to see the earlier state, or 3 to dump byn-* files for each pass

Also wasm-reducer crashes with the following message when reducing the original file:

Missing type: (func (param externref f32) (result f32))
wasm-reduce: ../src/wasm/wasm-binary.cpp:529: uint32_t wasm::WasmBinaryWriter::getTypeIndex(wasm::HeapType) const: Assertion `0' failed.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the reported seed through the Flatten pass, focusing on handleNonNullableLocals and tuple types containing a non-nullable reference. Use BINARYEN_PASS_DEBUG as suggested to inspect the earlier state and validate the result; done means Flatten no longer produces invalid modules and the reported wasm-reduce failure is addressed.

Written by the indexing model from the issue text.

Assessment

Tech stack
wasm
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.