Skip to content

ArrayCmpxchg fuzz bug in Heap2Local #8548

Description

@kripken
(module
 (rec
  (type $6 (array (mut eqref)))
  (type $0 (array (mut f64)))
  (type $14 (func (param (ref $6) eqref) (result eqref)))
 )
 (func $3 (type $14) (param $0 (ref $6)) (param $1 eqref) (result eqref)
  (array.atomic.rmw.cmpxchg $6
   (local.get $0)
   (i32.const 0)
   (array.new_default $0
    (i32.const 1)
   )
   (local.get $1)
  )
 )
)
$ bin/wasm-opt a.wat -all --heap2local
wasm-opt: src/wasm/wasm-type.cpp:923: const wasm::Struct& wasm::HeapType::getStruct() const: Assertion `isStruct()' failed.
Aborted                    (core dumped) bin/wasm-opt a.wat -all --heap2local

Looks like Array2Struct::visitArrayCmpxchg doesn't handle the case where the allocation we are removing is the expected value, not the ref. Likely it needs logic like visitStructCmpxchg @tlively ?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions