WebAssembly / WebAssembly/binaryen
Flatten pass can make invalid modules on tuple types
Nobody has claimed this yet.
- Dominant language
- WebAssembly
- Stars
- 8.6k
- Forks
- 885
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 69
Description
This came up while fuzzing, and I traced it using git bisect to PR #3710 where non-nullable locals are handled by handleNonNullableLocals. It doesn't seem to handle tuple types that contain a non-nullable ref, resulting in a validation error after Flatten pass.
seed: 17382324165229480416
Full validation result:
[wasm-validator error in function 3] unexpected false: vars must be defaultable, on
(v128 (ref (func (param f32))) v128 i64)
[wasm-validator error in function 3] unexpected false: vars must be defaultable, on
(v128 (ref (func (param f32))) v128 i64)
[wasm-validator error in function 3] unexpected false: vars must be defaultable, on
(v128 (ref (func (param f32))) v128 i64)
[wasm-validator error in function 3] unexpected false: vars must be defaultable, on
(v128 (ref (func (param f32))) v128 i64)
Fatal: Last pass (flatten) broke validation. Run with BINARYEN_PASS_DEBUG=2 in the env to see the earlier state, or 3 to dump byn-* files for each pass
Also wasm-reducer crashes with the following message when reducing the original file:
Missing type: (func (param externref f32) (result f32))
wasm-reduce: ../src/wasm/wasm-binary.cpp:529: uint32_t wasm::WasmBinaryWriter::getTypeIndex(wasm::HeapType) const: Assertion `0' failed.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the reported seed through the Flatten pass, focusing on handleNonNullableLocals and tuple types containing a non-nullable reference. Use BINARYEN_PASS_DEBUG as suggested to inspect the earlier state and validate the result; done means Flatten no longer produces invalid modules and the reported wasm-reduce failure is addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- wasm
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100