Closed fitzgen closed 2 years ago
Interesting, when run via wasmtime --invoke func_5 test-case.wasm
, we see a verifier error:
I forget, did we disable the verifier in the fuzz targets because of timeouts, @alexcrichton?
Ah its just for DifferentialConfig::to_wasmtime_config
that we don't enable the verifier!
This is as small as creduce
could get it:
test-case.wat
The new backend framework uses a different register allocator.
@fitzgen was this ever actually resolved? If it's still an open bug, we can leave this open until we switch over the wasmtime default to the new backend, I think.
@fitzgen was this ever actually resolved?
Not as far as I know
I believe we just stopped running the IR verifier in the fuzzers because it was too slow, so we don't see these kinds of bugs anymore
Wasmtime has been switched over to the new backend by default in https://github.com/bytecodealliance/wasmtime/pull/2718.
I can confirm that even with the debug verifier enabled this issue is fixed, so closing.
```wat (module (type (;0;) (func)) (type (;1;) (func (param i32))) (type (;2;) (func (param i64))) (type (;3;) (func (param f32))) (type (;4;) (func (param f64))) (type (;5;) (func (result i32))) (type (;6;) (func (param f64 i64 i32 i64 f32) (result f64))) (import "fuzzing-support" "log-i32" (func (;0;) (type 1))) (import "fuzzing-support" "log-i64" (func (;1;) (type 2))) (import "fuzzing-support" "log-f32" (func (;2;) (type 3))) (import "fuzzing-support" "log-f64" (func (;3;) (type 4))) (func (;4;) (type 5) (result i32) (local i32) i32.const 5381 local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=1 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=2 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=3 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=4 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=5 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=6 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=7 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=8 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=9 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=10 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=11 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=12 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=13 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=14 i32.xor local.set 0 local.get 0 i32.const 5 i32.shl local.get 0 i32.add i32.const 0 i32.load8_u offset=15 i32.xor local.set 0 local.get 0) (func (;5;) (type 6) (param f64 i64 i32 i64 f32) (result f64) (local i32 i64 i64 f32 f64 f64) block ;; label = @1 global.get 4 i32.eqz if ;; label = @2 f64.const 0x1.00000002p+31 (;=2147483649;) return end global.get 4 i32.const 1 i32.sub global.set 4 end block ;; label = @1 loop ;; label = @2 block ;; label = @3 global.get 4 i32.eqz if ;; label = @4 f64.const 0x1.dcp+6 (;=119;) return end global.get 4 i32.const 1 i32.sub global.set 4 end block ;; label = @3 block ;; label = @4 loop ;; label = @5 block ;; label = @6 global.get 4 i32.eqz if ;; label = @7 local.get 9 return end global.get 4 i32.const 1 i32.sub global.set 4 end block ;; label = @6 block ;; label = @7 local.get 5 local.tee 2 local.tee 2 local.tee 5 local.tee 2 local.tee 5 local.tee 5 local.tee 2 local.tee 2 local.set 5 loop (result f32) ;; label = @8 block ;; label = @9 global.get 4 i32.eqz if ;; label = @10 f64.const -nan:0xfffffffffcf41 (;=NaN;) return end global.get 4 i32.const 1 i32.sub global.set 4 end block (result f32) ;; label = @9 block ;; label = @10 loop (result f32) ;; label = @11 block ;; label = @12 global.get 4 i32.eqz if ;; label = @13 local.get 0 return end global.get 4 i32.const 1 i32.sub global.set 4 end block (result f32) ;; label = @12 block ;; label = @13 local.get 2 i32.const 15 i32.and local.get 7 i64.store offset=22 align=2 i64.const -2 local.set 6 end loop (result i32) ;; label = @13 block ;; label = @14 global.get 4 i32.eqz if ;; label = @15 f64.const 0x1.060606060606p+519 (;=1756580577739303000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000;) return end global.get 4 i32.const 1 i32.sub global.set 4 end block (result i32) ;; label = @14 local.get 5 i32.const 141 local.tee 5 br_if 0 (;@14;) if (result i32) ;; label = @15 local.get 5 else i32.const 2097152 end if ;; label = @15 i32.const 2048 i32.eqz if ;; label = @16 local.get 0 local.set 0 else f64.const 0x1p+41 (;=2199023255552;) local.set 10 end local.get 8 local.set 4 else i32.const 1381126738 local.set 2 local.get 1 local.set 6 end loop (result i32) ;; label = @15 block ;; label = @16 global.get 4 i32.eqz if ;; label = @17 f64.const -nan:0xfffffffffffab (;=NaN;) return end global.get 4 i32.const 1 i32.sub global.set 4 end local.get 2 end end end i32.eqz br_if 1 (;@11;) local.get 4 end end local.tee 4 local.tee 4 local.set 4 loop ;; label = @11 block ;; label = @12 global.get 4 i32.eqz if ;; label = @13 local.get 9 return end global.get 4 i32.const 1 i32.sub global.set 4 end local.get 0 local.set 9 end end i32.const 255 br_if 1 (;@8;) local.get 8 local.tee 8 local.tee 8 local.tee 8 local.tee 4 local.tee 4 local.tee 4 global.get 1 f32.div end end global.set 0 end i32.const -126 i32.eqz br_if 1 (;@5;) local.get 5 if (result i32) ;; label = @7 local.get 5 else local.get 5 end i32.eqz if (result i32) ;; label = @7 local.get 5 br_if 3 (;@4;) br 3 (;@4;) else i32.const -70 end i32.eqz if (result i32) ;; label = @7 local.get 2 local.set 2 local.get 5 local.tee 2 if (result i32) ;; label = @8 local.get 5 else local.get 5 end local.tee 5 else local.get 3 local.set 7 i32.const 1684300900 i32.clz end i32.eqz if (result i32) ;; label = @7 local.get 2 else local.get 7 local.tee 1 local.tee 3 local.tee 6 local.set 1 loop (result i32) ;; label = @8 block ;; label = @9 global.get 4 i32.eqz if ;; label = @10 f64.const 0x1p+53 (;=9007199254740992;) return end global.get 4 i32.const 1 i32.sub global.set 4 end block (result i32) ;; label = @9 block ;; label = @10 f64.const 0x1.79797978p+29 (;=791621423;) local.set 10 i32.const 33554432 if ;; label = @11 f64.const -0x1p+48 (;=-281474976710656;) local.tee 0 local.set 0 else nop end end i32.const -1073741824 local.tee 5 i32.eqz br_if 1 (;@8;) i32.const -126 end end i32.load8_s offset=4 end i32.eqz if (result i32) ;; label = @7 local.get 2 else local.get 5 end i32.eqz if (result i32) ;; label = @7 block (result i32) ;; label = @8 block ;; label = @9 loop (result i32) ;; label = @10 block ;; label = @11 global.get 4 i32.eqz if ;; label = @12 local.get 10 return end global.get 4 i32.const 1 i32.sub global.set 4 end block (result i32) ;; label = @11 block ;; label = @12 f32.const -0x1p+30 (;=-1073741800;) local.tee 4 local.set 8 local.get 5 i32.const -125 br_if 4 (;@8;) local.set 2 end local.get 5 i32.eqz br_if 1 (;@10;) local.get 5 i32.const -64 br_if 3 (;@8;) i32.eqz if (result i32) ;; label = @12 i32.const 268435456 local.get 5 i32.eqz br_if 4 (;@8;) else local.get 5 end i32.eqz if (result i32) ;; label = @12 local.get 5 if ;; label = @13 nop else i64.const 96 local.set 1 end br 3 (;@9;) else local.get 5 local.tee 2 local.get 2 i32.eqz br_if 4 (;@8;) local.get 5 i32.eqz br_if 4 (;@8;) end end end local.set 5 loop ;; label = @10 block ;; label = @11 global.get 4 i32.eqz if ;; label = @12 f64.const 0x1.a3a6e5f5f3a2p-92 (;=0.000000000000000000000000000331047014332659;) return end global.get 4 i32.const 1 i32.sub global.set 4 end block ;; label = @11 block ;; label = @12 i32.const -262144 if ;; label = @13 f64.const -0x1p+19 (;=-524288;) local.set 0 else local.get 5 local.set 2 end br 8 (;@4;) unreachable end unreachable unreachable br 7 (;@4;) unreachable end unreachable unreachable end unreachable unreachable end i32.const 7 if (result i32) ;; label = @9 local.get 9 local.set 0 f64.const 0x1.1cp+6 (;=71;) return else block (result i32) ;; label = @10 local.get 5 i32.eqz if (result i32) ;; label = @11 local.get 5 else i32.const 11051 end if (result i32) ;; label = @11 local.get 10 local.set 10 br 7 (;@4;) else loop ;; label = @12 block ;; label = @13 global.get 4 i32.eqz if ;; label = @14 local.get 9 return end global.get 4 i32.const 1 i32.sub global.set 4 end block ;; label = @13 local.get 10 local.set 10 i32.const -134217728 br_if 1 (;@12;) nop end end local.get 5 i32.const -32 i32.eqz br_if 3 (;@8;) end i32.eqz if ;; label = @11 block ;; label = @12 block ;; label = @13 local.get 10 local.set 0 br 9 (;@4;) unreachable end unreachable local.get 5 drop unreachable end unreachable unreachable else i32.const 48 local.tee 2 i32.const 55 br_if 1 (;@10;) i32.eqz br_if 6 (;@5;) i64.const 7234017283807667300 local.set 1 end i32.const 7710 local.tee 2 if (result i32) ;; label = @11 local.get 4 local.set 4 local.get 2 local.tee 2 else i32.const -16384 i32.const 536870912 local.get 5 i32.eqz br_if 1 (;@10;) i32.eqz br_if 3 (;@8;) end local.tee 2 end end local.tee 2 end else block (result i32) ;; label = @8 loop (result i32) ;; label = @9 block ;; label = @10 global.get 4 i32.eqz if ;; label = @11 local.get 9 return end global.get 4 i32.const 1 i32.sub global.set 4 end block (result i32) ;; label = @10 block ;; label = @11 i32.const 96 i32.eqz if (result f32) ;; label = @12 local.get 4 else local.get 8 end local.tee 4 local.set 8 i32.const 168430090 i32.eqz if ;; label = @12 local.get 5 local.tee 5 local.set 5 else block (result i64) ;; label = @13 i64.const -60 local.set 1 i64.const 26 end local.set 6 local.get 1 local.set 6 end end i32.const 33554432 if (result i32) ;; label = @11 local.get 5 else i32.const 4 end if (result i32) ;; label = @11 i64.const 1970632053 local.set 3 br 9 (;@2;) else loop (result i32) ;; label = @12 block ;; label = @13 global.get 4 i32.eqz if ;; label = @14 local.get 0 return end global.get 4 i32.const 1 i32.sub global.set 4 end local.get 5 local.tee 2 i32.const 268435456 local.get 5 i32.eqz br_if 4 (;@8;) i32.eqz br_if 4 (;@8;) end end if (result i32) ;; label = @11 block (result i32) ;; label = @12 loop (result i64) ;; label = @13 block ;; label = @14 global.get 4 i32.eqz if ;; label = @15 local.get 0 return end global.get 4 i32.const 1 i32.sub global.set 4 end block (result i64) ;; label = @14 nop local.get 5 br_if 1 (;@13;) local.get 7 end end local.set 3 local.get 2 i32.const -16384 local.tee 2 i32.eqz br_if 0 (;@12;) end else i32.const -1 i32.const -64 br_if 3 (;@8;) i32.eqz if (result i32) ;; label = @12 local.get 5 else i32.const 119 end if ;; label = @12 local.get 8 local.set 8 br 8 (;@4;) else local.get 5 drop br 3 (;@9;) end unreachable end i32.eqz br_if 1 (;@9;) local.get 5 local.tee 2 local.tee 5 local.tee 2 end end drop local.get 0 return end end i32.eqz if (result i32) ;; label = @7 local.get 5 local.tee 2 local.tee 5 local.tee 5 local.tee 2 local.tee 5 local.tee 2 else loop ;; label = @8 block ;; label = @9 global.get 4 i32.eqz if ;; label = @10 f64.const -0x1p+31 (;=-2147483648;) return end global.get 4 i32.const 1 i32.sub global.set 4 end block ;; label = @9 block ;; label = @10 loop (result i32) ;; label = @11 block ;; label = @12 global.get 4 i32.eqz if ;; label = @13 f64.const 0x1p+4 (;=16;) return end global.get 4 i32.const 1 i32.sub global.set 4 end block (result i32) ;; label = @12 block ;; label = @13 f64.const 0x1.79797978p+29 (;=791621423;) local.set 10 i32.const 33554432 if ;; label = @14 f64.const -0x1p+48 (;=-281474976710656;) local.tee 0 local.set 0 else nop end end i32.const -1073741824 local.tee 5 i32.eqz br_if 1 (;@11;) i32.const -126 end end i64.load offset=4 align=4 local.set 6 local.get 0 local.set 10 end block (result i32) ;; label = @10 loop (result i32) ;; label = @11 block ;; label = @12 global.get 4 i32.eqz if ;; label = @13 f64.const 0x1p+63 (;=9223372036854776000;) return end global.get 4 i32.const 1 i32.sub global.set 4 end local.get 5 local.get 5 br_if 1 (;@10;) end local.tee 2 local.set 2 i32.const 33554432 if (result i32) ;; label = @11 local.get 5 else i32.const 4 end i32.ctz i32.const -262144 if (result i32) ;; label = @11 local.get 5 else local.get 5 end local.tee 2 i32.eqz br_if 0 (;@10;) end br_if 1 (;@8;) block ;; label = @10 f32.const -0x1p+8 (;=-256;) local.set 4 br 6 (;@4;) unreachable end unreachable unreachable end unreachable unreachable end unreachable unreachable i32.const 1684300900 i32.clz end i32.eqz if (result i32) ;; label = @7 local.get 2 else local.get 7 local.tee 1 local.tee 3 local.tee 6 local.tee 1 local.tee 3 local.tee 6 local.tee 3 local.set 1 loop (result i32) ;; label = @8 block ;; label = @9 global.get 4 i32.eqz if ;; label = @10 f64.const -0x1p+46 (;=-70368744177664;) return end global.get 4 i32.const 1 i32.sub global.set 4 end block (result i32) ;; label = @9 block ;; label = @10 local.get 0 local.set 9 i32.const -4 i32.eqz if (result f64) ;; label = @11 local.get 0 local.set 9 loop (result i32) ;; label = @12 block ;; label = @13 global.get 4 i32.eqz if ;; label = @14 f64.const 0x1.e8p+5 (;=61;) return end global.get 4 i32.const 1 i32.sub global.set 4 end block (result i32) ;; label = @13 block ;; label = @14 f64.const 0x1.79797978p+29 (;=791621423;) local.set 10 i32.const 33554432 if ;; label = @15 f64.const -0x1p+48 (;=-281474976710656;) local.tee 0 local.set 0 else nop end end i32.const -1073741824 local.tee 5 i32.eqz br_if 1 (;@12;) i32.const -126 end end f64.load offset=4 else local.get 10 local.tee 0 local.tee 10 local.tee 10 end local.set 10 end loop (result i32) ;; label = @10 block ;; label = @11 global.get 4 i32.eqz if ;; label = @12 local.get 9 return end global.get 4 i32.const 1 i32.sub global.set 4 end block (result i32) ;; label = @11 block ;; label = @12 loop ;; label = @13 block ;; label = @14 global.get 4 i32.eqz if ;; label = @15 f64.const -0x1p+49 (;=-562949953421312;) return end global.get 4 i32.const 1 i32.sub global.set 4 end block ;; label = @14 i32.const 96 i32.eqz if (result f64) ;; label = @15 local.get 9 else f64.const 0x1.ffffffc4p+31 (;=4294967266;) end local.set 10 local.get 9 local.set 10 end end loop ;; label = @13 block ;; label = @14 global.get 4 i32.eqz if ;; label = @15 f64.const 0x1.060606060606p+519 (;=1756580577739303000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000;) return end global.get 4 i32.const 1 i32.sub global.set 4 end block ;; label = @14 block ;; label = @15 local.get 4 local.set 4 i64.const 16777216 local.set 3 end i32.const 256 i32.eqz br_if 1 (;@13;) f32.const -0x1p+46 (;=-70368744000000;) local.set 8 end end end i32.const -255 local.tee 5 local.tee 5 local.tee 2 local.tee 5 i32.eqz br_if 1 (;@10;) block ;; label = @12 i64.const -121 local.set 7 br 7 (;@5;) unreachable end unreachable unreachable unreachable if (result i32) ;; label = @12 local.get 5 else local.get 2 end end end i32.eqz br_if 1 (;@8;) local.get 2 end end i32.const 15 i32.and i32.load offset=4 end i32.eqz if ;; label = @7 f64.const -0x1.5p+6 (;=-84;) local.set 10 else nop end end end nop end local.get 5 i32.eqz br_if 1 (;@2;) i64.const 6872316419617283935 local.set 7 end end local.get 0 return unreachable end unreachable) (func (;6;) (type 0) i32.const 10 global.set 4) (table (;0;) 0 funcref) (memory (;0;) 1 1) (global (;0;) (mut f32) (f32.const 0x1p+32 (;=4294967300;))) (global (;1;) (mut f32) (f32.const 0x1p-126 (;=0.000000000000000000000000000000000000011754944;))) (global (;2;) (mut f64) (f64.const 0x1p-1022 (;=0.000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000022250738585072014;))) (global (;3;) (mut f64) (f64.const -nan:0xfffffffff923b (;=NaN;))) (global (;4;) (mut i32) (i32.const 10)) (export "hashMemory" (func 4)) (export "memory" (memory 0)) (export "func_5" (func 5)) (export "hangLimitInitializer" (func 6)) (elem (;0;) (i32.const 0) func) (data (;0;) (i32.const 0) "")) ```test-case.wat
I'm working on reducing this test case further now.
Steps to Reproduce