Skip to content

[multibyte] Expand array load and store validation#8929

Merged
brendandahl merged 1 commit into
WebAssembly:mainfrom
brendandahl:multibyte-array-expanded-types
Jul 23, 2026
Merged

[multibyte] Expand array load and store validation#8929
brendandahl merged 1 commit into
WebAssembly:mainfrom
brendandahl:multibyte-array-expanded-types

Conversation

@brendandahl

Copy link
Copy Markdown
Collaborator

Expand array load and store validation to all numeric, vector, and packed element types (i8, i16, i32, i64, f32, f64, v128), as well as offset and alignment immediates.

Multibyte array operations apply to numeric and vector array backing types. This permits loads from mutable and immutable arrays while enforcing mutability on stores, rejecting non-numeric arrays, and validating offset and alignment immediates.

Expand array load and store validation to all numeric, vector, and
packed element types (i8, i16, i32, i64, f32, f64, v128), as well as
offset and alignment immediates.

Multibyte array operations apply to numeric and vector array backing
types. This permits loads from mutable and immutable arrays while
enforcing mutability on stores, rejecting non-numeric arrays, and
validating offset and alignment immediates.
@brendandahl
brendandahl requested a review from a team as a code owner July 22, 2026 22:17
@brendandahl
brendandahl requested review from kripken and removed request for a team July 22, 2026 22:17
@brendandahl

Copy link
Copy Markdown
Collaborator Author

Updates to the interpreter will be in a following PR.

@brendandahl
brendandahl merged commit e88a1b5 into WebAssembly:main Jul 23, 2026
16 checks passed
@kripken

kripken commented Jul 23, 2026

Copy link
Copy Markdown
Member

Looks like this is breaking the fuzzer:

(module
 (type $0 (func))
 (type $1 (array (mut i64)))
 (export "expanded_types_invoker" (func $0))
 (func $0 (type $0)
  (drop
   (i64.load (type $1)
    (array.new_default $1
     (i32.const 32)
    )
    (i32.const 0)
   )
  )
  (unreachable)
 )
)

This used to not validate, but now it does, and it errors when we try to run it,

$ bin/wasm-opt a.wat -all --fuzz-exec-before
[fuzz-exec] export expanded_types_invoker
wasm-opt: /src/binaryen/src/literal.h:289: int32_t wasm::Literal::geti32() const: Assertion `type == Type::i32' failed.
Aborted                    (core dumped)

The fuzzer ignores things that don't validate (it assumes it is running with the wrong features), but runtime errors during execution are reported as bugs.

@brendandahl

Copy link
Copy Markdown
Collaborator Author

Forgot the fuzzer would potentially generate these instructions already.
#8934 should fix this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants