Fuzz bug in MemoryPacking

[kripken]

(module
 (type $none_=>_externref_f64_i64_f64_i32_exnref (func (result externref f64 i64 f64 i32 exnref)))
 (type $v128_=>_externref_f64_i64_f64_i32_exnref (func (param v128) (result externref f64 i64 f64 i32 exnref)))
 (memory $0 (shared 2048 2049))
 (data passive "h\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00v\00n\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00")
 (data passive "")
 (data passive "")
 (data passive "")
 (data passive "")
 (data (i32.const 0) "")
 (data passive "")
 (data (i32.const 5) "")
 (data (i32.const 13) "")
 (export "func_54" (func $0))
 (func $0 (param $0 v128) (result externref f64 i64 f64 i32 exnref)
  (memory.init 0
   (i32.const 6)
   (i32.const 2)
   (i32.const 51)
  )
  (tuple.make
   (ref.null extern)
   (f64.const -nan:0xfffffffffbb56)
   (i64.const -130625735552240)
   (f64.const 0.235)
   (i32.const 102)
   (ref.null exn)
  )
 )
)

STR

$ wasm-opt w.wat --memory-packing --fuzz-exec
[fuzz-exec] calling func_54
[fuzz-exec] note result: func_54 => (externref(null), -nan:0xfffffffffbb56, -130625735552240, 0.235, 102, exnref(null))
[fuzz-exec] calling func_54
[trap out of bounds segment access in memory.init]
[fuzz-exec] comparing func_54
not identical! () != (externref(null), -nan:0xfffffffffbb56, -130625735552240, 0.235, 102, exnref(null))
[fuzz-exec] optimization passes changed execution results

[tlively]

This is separate from #3222, right?

[kripken]

Yes, this looks unrelated. The passive segments are a factor somehow (which they are not in #3222).

[kripken]

There still seems to be an issue here, e.g.

(module
 (type $none_=>_none (func))
 (type $i64_=>_i32 (func (param i64) (result i32)))
 (type $f32_f32_=>_f64 (func (param f32 f32) (result f64)))
 (memory $0 2048 2049)
 (data passive "\00i\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00n\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00h")
 (data passive "\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00")
 (data passive "")
 (data passive "")
 (data (i32.const 0) "")
 (data (i32.const 8) "")
 (data (i32.const 15) "")
 (export "func_1" (func $0))
 (export "func_18" (func $1))
 (func $0 (param $0 f32) (param $1 f32) (result f64)
  (memory.init 0
   (i32.const 13)
   (i32.const 10)
   (i32.const 0)
  )
  (f64.const 1)
 )
 (func $1
  (memory.init 1
   (i32.const 13)
   (i32.const 33)
   (i32.const 0)
  )
  (data.drop 1)
 )
 (func $2 (param $0 i64) (result i32)
  (memory.init 0
   (i32.const 0)
   (i32.const 27)
   (i32.const 9)
  )
  (unreachable)
 )
)

This fails with -O1 -O1, so something goes wrong when running it twice.

[kripken]

Fatal: Module::addGlobal: __mem_segment_drop_state_0 already exists

edit: oh, maybe it just needs to ensure a unique name?