Handle extended const segment offsets in the fuzzer#6382
Merged
Conversation
Member
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
Merged
kripken
reviewed
Mar 7, 2024
| // If the offset is a global that was imported (which is ok) but no | ||
| // longer is (not ok) we need to change that. | ||
| if (auto* offset = segment->offset->dynCast<GlobalGet>()) { | ||
| if (!wasm.getGlobal(offset->name)->imported()) { |
Member
There was a problem hiding this comment.
Why did the check for ->imported() go away? I think we only need to zero it out of there is a global.get that is not imported.
Member
Author
There was a problem hiding this comment.
Hmm, I see that finalizeMemory does do this check, but with a note that imported globals are never encountered. Indeed, setupGlobals removes all imports. I guess I can follow finalizeMemory's lead here.
This was referenced Mar 7, 2024
kripken
approved these changes
Mar 7, 2024
Member
kripken
left a comment
kripken
left a comment
There was a problem hiding this comment.
Another option might be to assert on not seeing an import there - lgtm either way.
Member
Author
|
Oh yes, assertions make much more sense. Will change both cases. |
The fuzzer already had logic to remove all references to non-imported globals from global initializers and data segment offsets, but it was missing for element segment offsets. Add it, and also add a missing check line for the new test that uncovered this bug as initial fuzzer input.
tlively
force-pushed
the
fuzzer-fix-segment-offsets
branch
from
ad7c8d3 to
979b615
Compare
Member
Author
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The fuzzer already had logic to remove all references to non-imported globals
from global initializers and data segment offsets, but it was missing for
element segment offsets. Add it, and also add a missing check line for the new
test that uncovered this bug as initial fuzzer input.