WebAssembly / WebAssembly/binaryen
wasm-split fuzzing and reusing an existing Table
Nobody has claimed this yet.
- Dominant language
- WebAssembly
- Stars
- 8.6k
- Forks
- 885
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 69
Description
I seem to recall we discussed using a new Table in wasm-split, when reference types is set? Atm it looks like we reuse the table if one exists:
The fuzzer errored on this, with exports like these:
(func $0
)
(func $1
(table.set $0
(i32.const 1)
(ref.null nofunc)
)
(unreachable)
)
(func $2
)
After splitting these three out, we end up with call_indirects in all three in the primary module. The secondary module's elem writes the proper function pointers, but when we call $1 we trample some of that data, leading to the third export trapping. That is, it is unsafe to use the table for normal stuff and also wasm-split stuff, without the two being aware of each other.
cc @tlively @aheejin
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read src/ir/module-splitting.cpp at lines 186-191 and reproduce the reported fuzzer case with the shown wat. Trace how the existing table, call_indirects, and secondary-module element writes interact; done means ordinary table.set operations no longer overwrite wasm-split function pointers and the third export does not trap.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, wasm
- Domain
- compilers, testing-qa
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100