kripken
commented
3 years ago This isn't a known issue. It should fail to allocate (and halt), or it should hit the limit in the code you quote and avoid running the analysis. So that it runs it and segfaults suggest were are missing a check somehow. But reading the code for copies it is allocated properly AFAICT.
Do these assertions catch anything?
diff --git a/src/cfg/liveness-traversal.h b/src/cfg/liveness-traversal.h
index 6deab2fd6..7eec02682 100644
--- a/src/cfg/liveness-traversal.h
+++ b/src/cfg/liveness-traversal.h
@@ -277,6 +277,7 @@ struct LivenessWalker : public CFGWalker<SubType, VisitorType, Liveness> {
}
void addCopy(Index i, Index j) {
+ assert(i < numLocals && j < numLocals);
auto k = std::min(i, j) * numLocals + std::max(i, j);
copies[k] = std::min(copies[k], uint8_t(254)) + 1;
totalCopies[i]++;
@@ -284,6 +285,7 @@ struct LivenessWalker : public CFGWalker<SubType, VisitorType, Liveness> {
}
uint8_t getCopies(Index i, Index j) {
+ assert(i < numLocals && j < numLocals);
return copies[std::min(i, j) * numLocals + std::max(i, j)];
}
};Looking at the line numbers in the traces, they don't match anything reasonable in current main or in the hash mentioned in the link. Which specific version was this compiled from?
trzecieu
Hi,
I've found that wasm2js is getting terminated during execution, After re-compiling wasm2js with address sanitizer suport I've got follwing report. The original wasm was compiled with
-O3 -g2 -fsanitize=address(so, wasm with ASAN).The iteration speed over this issue is pretty slow, getting asan report took 90min of execution, now I'm tryign to get to run with debugger. Wat file is 1GiB size, which makes challenging to process it
While digging through code I've found that this might be already a suspected flaw: https://github.com/WebAssembly/binaryen/blob/760a51bd15a51f02bc1c75087a9cd9e11b9f27bb/src/cfg/liveness-traversal.h#L174-L176