Skip to content

Fuzz bug: merge-similar-functions breaks validation #5580

@tlively

Description

@tlively

The fuzzer found this test case:

(module
 (rec
  (type $none_=>_none (func))
  (type $i32_=>_none (func (param i32)))
 )
 (import "fuzzing-support" "log-i32" (func $fimport$0 (param i32)))
 (global $global$0 (mut i32) (i32.const 100))
 (export "func_227_invoker" (func $0))
 (export "func_94" (func $1))
 (export "func_360" (func $2))
 (export "func_319" (func $3))
 (func $0 (type $none_=>_none)
  (global.set $global$0
   (i32.const -1)
  )
  (global.set $global$0
   (i32.const -2)
  )
 )
 (func $1 (type $none_=>_none)
  (if
   (global.get $global$0)
   (unreachable)
  )
  (unreachable)
 )
 (func $2 (type $none_=>_none)
  (if
   (i32.eqz
    (global.get $global$0)
   )
   (block
    (global.set $global$0
     (i32.const 100)
    )
    (unreachable)
   )
  )
  (global.set $global$0
   (i32.sub
    (global.get $global$0)
    (i32.const 1)
   )
  )
  (call $fimport$0
   (i32.const 0)
  )
  (return_call $0)
 )
 (func $3 (type $none_=>_none)
  (if
   (i32.eqz
    (global.get $global$0)
   )
   (block
    (global.set $global$0
     (i32.const 100)
    )
    (unreachable)
   )
  )
  (global.set $global$0
   (i32.sub
    (global.get $global$0)
    (i32.const 1)
   )
  )
  (call $fimport$0
   (i32.const 0)
  )
  (return_call $1)
 )
)

Running wasm-opt -all a.wast --merge-similar-functions produces this error:

[wasm-validator error in function byn$mgfn-shared$2] unexpected false: unreachable instruction must have unreachable child, on
(call_ref $none_=>_none
 (local.get $0)
)
Fatal: error after opts

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions