diff options
| author | Thomas Lively <tlively@google.com> | 2024-11-21 11:49:08 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-11-21 19:49:08 +0000 |
| commit | 901ba6024f3ca9117c5720be3cf19ab75034070a (patch) | |
| tree | 4001f757f119d748220f6208e1155b1ef99fed41 | |
| parent | 3342d56e4a13170c094a29138b32ff17cad4c01d (diff) | |
| download | binaryen-901ba6024f3ca9117c5720be3cf19ab75034070a.tar.gz binaryen-901ba6024f3ca9117c5720be3cf19ab75034070a.tar.bz2 binaryen-901ba6024f3ca9117c5720be3cf19ab75034070a.zip | |
Make validation of stale types stricter (#7097)
We previously allowed valid expressions to have stale types as long as
those stale types were supertypes of the most precise possible types for
the expressions. Allowing stale types like this could mask bugs where we
failed to propagate precise type information, though.
Make validation stricter by requiring all expressions except for control
flow structures to have the most precise possible types. Control flow
structures are exempt because many passes that can refine types wrap the
refined expressions in blocks with the old type to avoid the need for
refinalization. This pattern would be broken and we would need to
refinalize more frequently without this exception for control flow
structures.
Now that all non-control flow expressions must have precise types,
remove functionality relating to building select instructions with
non-precise types. Since finalization of selects now always calculates a
LUB rather than using a provided type, remove the type parameter from
BinaryenSelect in the C and JS APIs.
Now that stale types are no longer valid, fix a bug in TypeSSA where it
failed to refinalize module-level code. This bug previously would not
have caused problems on its own, but the stale types could cause
problems for later runs of Unsubtyping. Now the stale types would cause
TypeSSA output to fail validation.
Also fix a bug where Builder::replaceWithIdenticalType was in fact
replacing with refined types.
Fixes #7087.
26 files changed, 144 insertions, 129 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index a1dbd4591..9c45eac79 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,8 @@ full changeset diff at the end of each section. Current Trunk ------------- + - BinaryenSelect no longer takes a type parameter. + v120 ---- diff --git a/src/binaryen-c.cpp b/src/binaryen-c.cpp index 854b0c995..a278f7778 100644 --- a/src/binaryen-c.cpp +++ b/src/binaryen-c.cpp @@ -1276,17 +1276,12 @@ BinaryenExpressionRef BinaryenBinary(BinaryenModuleRef module, BinaryenExpressionRef BinaryenSelect(BinaryenModuleRef module, BinaryenExpressionRef condition, BinaryenExpressionRef ifTrue, - BinaryenExpressionRef ifFalse, - BinaryenType type) { + BinaryenExpressionRef ifFalse) { auto* ret = ((Module*)module)->allocator.alloc<Select>(); ret->condition = (Expression*)condition; ret->ifTrue = (Expression*)ifTrue; ret->ifFalse = (Expression*)ifFalse; - if (type != BinaryenTypeAuto()) { - ret->finalize(Type(type)); - } else { - ret->finalize(); - } + ret->finalize(); return static_cast<Expression*>(ret); } BinaryenExpressionRef BinaryenDrop(BinaryenModuleRef module, diff --git a/src/binaryen-c.h b/src/binaryen-c.h index b23945d18..d24b2bb56 100644 --- a/src/binaryen-c.h +++ b/src/binaryen-c.h @@ -821,8 +821,7 @@ BINARYEN_API BinaryenExpressionRef BinaryenSelect(BinaryenModuleRef module, BinaryenExpressionRef condition, BinaryenExpressionRef ifTrue, - BinaryenExpressionRef ifFalse, - BinaryenType type); + BinaryenExpressionRef ifFalse); BINARYEN_API BinaryenExpressionRef BinaryenDrop(BinaryenModuleRef module, BinaryenExpressionRef value); // Return: value can be NULL diff --git a/src/js/binaryen.js-post.js b/src/js/binaryen.js-post.js index 40d08dceb..a90b79d49 100644 --- a/src/js/binaryen.js-post.js +++ b/src/js/binaryen.js-post.js @@ -2331,8 +2331,8 @@ function wrapModule(module, self = {}) { } }; - self['select'] = function(condition, ifTrue, ifFalse, type) { - return Module['_BinaryenSelect'](module, condition, ifTrue, ifFalse, typeof type !== 'undefined' ? type : Module['auto']); + self['select'] = function(condition, ifTrue, ifFalse) { + return Module['_BinaryenSelect'](module, condition, ifTrue, ifFalse); }; self['drop'] = function(value) { return Module['_BinaryenDrop'](module, value); diff --git a/src/passes/OptimizeInstructions.cpp b/src/passes/OptimizeInstructions.cpp index c9fe5f652..881b7ea1f 100644 --- a/src/passes/OptimizeInstructions.cpp +++ b/src/passes/OptimizeInstructions.cpp @@ -5248,7 +5248,7 @@ private: curr->ifTrue = updateArm(curr->ifTrue); curr->ifFalse = updateArm(curr->ifFalse); un->value = curr; - curr->finalize(newType); + curr->finalize(); return replaceCurrent(un); } } diff --git a/src/passes/RemoveUnusedBrs.cpp b/src/passes/RemoveUnusedBrs.cpp index 2ccf3c761..96db281d8 100644 --- a/src/passes/RemoveUnusedBrs.cpp +++ b/src/passes/RemoveUnusedBrs.cpp @@ -1420,7 +1420,7 @@ struct RemoveUnusedBrs : public WalkerPass<PostWalker<RemoveUnusedBrs>> { return nullptr; } return Builder(*getModule()) - .makeSelect(iff->condition, iff->ifTrue, iff->ifFalse, iff->type); + .makeSelect(iff->condition, iff->ifTrue, iff->ifFalse); } void visitLocalSet(LocalSet* curr) { diff --git a/src/passes/SSAify.cpp b/src/passes/SSAify.cpp index c220fdd06..8e827d0fc 100644 --- a/src/passes/SSAify.cpp +++ b/src/passes/SSAify.cpp @@ -150,7 +150,7 @@ struct SSAify : public Pass { LiteralUtils::makeZero(get->type, *module); // If we replace a local.get with a null then we are refining the // type that the parent receives to a bottom type. - if (get->type.isRef()) { + if (get->type.hasRef()) { refinalize = true; } } else { diff --git a/src/passes/TypeSSA.cpp b/src/passes/TypeSSA.cpp index cda78474b..3d68c9913 100644 --- a/src/passes/TypeSSA.cpp +++ b/src/passes/TypeSSA.cpp @@ -200,6 +200,7 @@ struct TypeSSA : public Pass { // Finally, refinalize to propagate the new types to parents. ReFinalize().run(getPassRunner(), module); + ReFinalize().runOnModuleCode(getPassRunner(), module); } News newsToModify; diff --git a/src/tools/fuzzing.h b/src/tools/fuzzing.h index 3e8ec5b97..1afb4bf36 100644 --- a/src/tools/fuzzing.h +++ b/src/tools/fuzzing.h @@ -358,7 +358,7 @@ private: Expression* makeUnary(Type type); Expression* buildBinary(const BinaryArgs& args); Expression* makeBinary(Type type); - Expression* buildSelect(const ThreeArgs& args, Type type); + Expression* buildSelect(const ThreeArgs& args); Expression* makeSelect(Type type); Expression* makeSwitch(Type type); Expression* makeDrop(Type type); diff --git a/src/tools/fuzzing/fuzzing.cpp b/src/tools/fuzzing/fuzzing.cpp index a283aae91..7e87f4f58 100644 --- a/src/tools/fuzzing/fuzzing.cpp +++ b/src/tools/fuzzing/fuzzing.cpp @@ -3808,15 +3808,14 @@ Expression* TranslateToFuzzReader::makeBinary(Type type) { WASM_UNREACHABLE("invalid type"); } -Expression* TranslateToFuzzReader::buildSelect(const ThreeArgs& args, - Type type) { - return builder.makeSelect(args.a, args.b, args.c, type); +Expression* TranslateToFuzzReader::buildSelect(const ThreeArgs& args) { + return builder.makeSelect(args.a, args.b, args.c); } Expression* TranslateToFuzzReader::makeSelect(Type type) { Type subType1 = getSubType(type); Type subType2 = getSubType(type); - return buildSelect({make(Type::i32), make(subType1), make(subType2)}, type); + return buildSelect({make(Type::i32), make(subType1), make(subType2)}); } Expression* TranslateToFuzzReader::makeSwitch(Type type) { diff --git a/src/wasm-builder.h b/src/wasm-builder.h index 15b7a2059..20485f14d 100644 --- a/src/wasm-builder.h +++ b/src/wasm-builder.h @@ -632,17 +632,6 @@ public: ret->finalize(); return ret; } - Select* makeSelect(Expression* condition, - Expression* ifTrue, - Expression* ifFalse, - Type type) { - auto* ret = wasm.allocator.alloc<Select>(); - ret->condition = condition; - ret->ifTrue = ifTrue; - ret->ifFalse = ifFalse; - ret->finalize(type); - return ret; - } Return* makeReturn(Expression* value = nullptr) { auto* ret = wasm.allocator.alloc<Return>(); ret->value = value; @@ -1381,21 +1370,23 @@ public: // Returns a replacement with the precise same type, and with minimal contents // as best we can. As a replacement, this may reuse the input node. template<typename T> Expression* replaceWithIdenticalType(T* curr) { + auto type = curr->type; + // Anything that would otherwise have a more refined type than the original + // expression needs to be wrapped in a block with the original type. + auto maybeWrap = [&](Expression* expr) -> Expression* { + return expr->type == type ? expr : makeBlock({expr}, type); + }; if (curr->type.isTuple() && curr->type.isDefaultable()) { - return makeConstantExpression(Literal::makeZeros(curr->type)); + return maybeWrap(makeConstantExpression(Literal::makeZeros(curr->type))); } - if (curr->type.isNullable() && curr->type.isNull()) { - return ExpressionManipulator::refNull(curr, curr->type); + if (curr->type.isNullable()) { + return maybeWrap(ExpressionManipulator::refNull( + curr, Type(curr->type.getHeapType().getBottom(), Nullable))); } if (curr->type.isRef() && curr->type.getHeapType().isMaybeShared(HeapType::i31)) { - Expression* ret = - makeRefI31(makeConst(0), curr->type.getHeapType().getShared()); - if (curr->type.isNullable()) { - // To keep the type identical, wrap it in a block that adds nullability. - ret = makeBlock({ret}, curr->type); - } - return ret; + return maybeWrap( + makeRefI31(makeConst(0), curr->type.getHeapType().getShared())); } if (!curr->type.isBasic()) { // We can't do any better, keep the original. diff --git a/src/wasm.h b/src/wasm.h index 22e71560f..a5fc070e6 100644 --- a/src/wasm.h +++ b/src/wasm.h @@ -1271,7 +1271,6 @@ public: Expression* condition; void finalize(); - void finalize(Type type_); }; class Drop : public SpecificExpression<Expression::DropId> { diff --git a/src/wasm/wasm-binary.cpp b/src/wasm/wasm-binary.cpp index 73718e636..21842e19b 100644 --- a/src/wasm/wasm-binary.cpp +++ b/src/wasm/wasm-binary.cpp @@ -7042,6 +7042,7 @@ bool WasmBinaryReader::maybeVisitSIMDLoadStoreLane(Expression*& out, } void WasmBinaryReader::visitSelect(Select* curr, uint8_t code) { + Type annotated = Type::none; if (code == BinaryConsts::SelectWithType) { size_t numTypes = getU32LEB(); std::vector<Type> types; @@ -7052,15 +7053,15 @@ void WasmBinaryReader::visitSelect(Select* curr, uint8_t code) { } types.push_back(t); } - curr->type = Type(types); + annotated = Type(types); } curr->condition = popNonVoidExpression(); curr->ifFalse = popNonVoidExpression(); curr->ifTrue = popNonVoidExpression(); - if (code == BinaryConsts::SelectWithType) { - curr->finalize(curr->type); - } else { - curr->finalize(); + curr->finalize(); + if (code == BinaryConsts::SelectWithType && + !Type::isSubType(curr->type, annotated)) { + throwError("select type does not match annotation"); } } diff --git a/src/wasm/wasm-ir-builder.cpp b/src/wasm/wasm-ir-builder.cpp index a73c7f2ac..54cd0149e 100644 --- a/src/wasm/wasm-ir-builder.cpp +++ b/src/wasm/wasm-ir-builder.cpp @@ -1412,9 +1412,7 @@ Result<> IRBuilder::makeBinary(BinaryOp op) { Result<> IRBuilder::makeSelect(std::optional<Type> type) { Select curr; CHECK_ERR(visitSelect(&curr)); - auto* built = - type ? builder.makeSelect(curr.condition, curr.ifTrue, curr.ifFalse, *type) - : builder.makeSelect(curr.condition, curr.ifTrue, curr.ifFalse); + auto* built = builder.makeSelect(curr.condition, curr.ifTrue, curr.ifFalse); if (type && !Type::isSubType(built->type, *type)) { return Err{"select type does not match expected type"}; } diff --git a/src/wasm/wasm-validator.cpp b/src/wasm/wasm-validator.cpp index 339a3c7a1..516bb86e1 100644 --- a/src/wasm/wasm-validator.cpp +++ b/src/wasm/wasm-validator.cpp @@ -3671,10 +3671,10 @@ static void validateBinaryenIR(Module& wasm, ValidationInfo& info) { auto oldType = curr->type; ReFinalizeNode().visit(curr); auto newType = curr->type; - // It's ok for types to be further refinable, but they must admit a - // superset of the values allowed by the most precise possible type, i.e. - // they must not be strict subtypes of or unrelated to the refined type. - if (!Type::isSubType(newType, oldType)) { + // It's ok for control flow structures to be further refinable, but all + // other instructions must have the most-precise possible types. + if (oldType != newType && !(Properties::isControlFlowStructure(curr) && + Type::isSubType(newType, oldType))) { std::ostringstream ss; ss << "stale type found in " << scope << " on " << curr << "\n(marked as " << oldType << ", should be " << newType << ")\n"; diff --git a/src/wasm/wasm.cpp b/src/wasm/wasm.cpp index a1ac076e0..f89ef80c2 100644 --- a/src/wasm/wasm.cpp +++ b/src/wasm/wasm.cpp @@ -777,16 +777,6 @@ void Binary::finalize() { } } -void Select::finalize(Type type_) { - assert(ifTrue && ifFalse); - if (ifTrue->type == Type::unreachable || ifFalse->type == Type::unreachable || - condition->type == Type::unreachable) { - type = Type::unreachable; - } else { - type = type_; - } -} - void Select::finalize() { assert(ifTrue && ifFalse); if (ifTrue->type == Type::unreachable || ifFalse->type == Type::unreachable || diff --git a/test/binaryen.js/kitchen-sink.js b/test/binaryen.js/kitchen-sink.js index da281910f..6e6808ab8 100644 --- a/test/binaryen.js/kitchen-sink.js +++ b/test/binaryen.js/kitchen-sink.js @@ -598,7 +598,7 @@ function test_core() { module.ref.is_null(module.ref.null(binaryen.externref)), module.ref.is_null(module.ref.null(binaryen.funcref)), module.ref.is_null(module.ref.func("kitchen()sinker", binaryen.funcref)), - module.select(temp10, module.ref.null(binaryen.funcref), module.ref.func("kitchen()sinker", binaryen.funcref), binaryen.funcref), + module.select(temp10, module.ref.null(binaryen.funcref), module.ref.func("kitchen()sinker", binaryen.funcref)), // GC module.ref.eq(module.ref.null(binaryen.eqref), module.ref.null(binaryen.eqref)), diff --git a/test/example/c-api-kitchen-sink.c b/test/example/c-api-kitchen-sink.c index d3f20e888..a6a196ae6 100644 --- a/test/example/c-api-kitchen-sink.c +++ b/test/example/c-api-kitchen-sink.c @@ -1021,7 +1021,7 @@ void test_core() { module, 8, 0, 2, 8, BinaryenTypeFloat64(), makeInt32(module, 9), "0"), BinaryenStore(module, 4, 0, 0, temp13, temp14, BinaryenTypeInt32(), "0"), BinaryenStore(module, 8, 2, 4, temp15, temp16, BinaryenTypeInt64(), "0"), - BinaryenSelect(module, temp10, temp11, temp12, BinaryenTypeAuto()), + BinaryenSelect(module, temp10, temp11, temp12), BinaryenReturn(module, makeInt32(module, 1337)), // Tail call BinaryenReturnCall( @@ -1040,8 +1040,7 @@ void test_core() { module, temp10, BinaryenRefNull(module, BinaryenTypeNullFuncref()), - BinaryenRefFunc(module, "kitchen()sinker", BinaryenTypeFuncref()), - BinaryenTypeFuncref()), + BinaryenRefFunc(module, "kitchen()sinker", BinaryenTypeFuncref())), // GC BinaryenRefEq(module, BinaryenRefNull(module, BinaryenTypeNullref()), diff --git a/test/lit/basic/reference-types.wast b/test/lit/basic/reference-types.wast index 44494c80d..22250c9a0 100644 --- a/test/lit/basic/reference-types.wast +++ b/test/lit/basic/reference-types.wast @@ -711,7 +711,7 @@ ;; CHECK-TEXT-NEXT: ) ;; CHECK-TEXT-NEXT: ) ;; CHECK-TEXT-NEXT: (drop - ;; CHECK-TEXT-NEXT: (select (result anyref) + ;; CHECK-TEXT-NEXT: (select (result eqref) ;; CHECK-TEXT-NEXT: (local.get $local_eqref) ;; CHECK-TEXT-NEXT: (ref.i31 ;; CHECK-TEXT-NEXT: (i32.const 0) @@ -1314,7 +1314,7 @@ ;; CHECK-BIN-NEXT: ) ;; CHECK-BIN-NEXT: ) ;; CHECK-BIN-NEXT: (drop - ;; CHECK-BIN-NEXT: (select (result anyref) + ;; CHECK-BIN-NEXT: (select (result eqref) ;; CHECK-BIN-NEXT: (local.get $local_eqref) ;; CHECK-BIN-NEXT: (ref.i31 ;; CHECK-BIN-NEXT: (i32.const 0) @@ -2651,7 +2651,7 @@ ;; CHECK-BIN-NODEBUG-NEXT: ) ;; CHECK-BIN-NODEBUG-NEXT: ) ;; CHECK-BIN-NODEBUG-NEXT: (drop -;; CHECK-BIN-NODEBUG-NEXT: (select (result anyref) +;; CHECK-BIN-NODEBUG-NEXT: (select (result eqref) ;; CHECK-BIN-NODEBUG-NEXT: (local.get $0) ;; CHECK-BIN-NODEBUG-NEXT: (ref.i31 ;; CHECK-BIN-NODEBUG-NEXT: (i32.const 0) diff --git a/test/lit/passes/cfp.wast b/test/lit/passes/cfp.wast index 461baa373..e70cfc639 100644 --- a/test/lit/passes/cfp.wast +++ b/test/lit/passes/cfp.wast @@ -2332,9 +2332,11 @@ ;; CHECK-NEXT: (struct.set $A 0 ;; CHECK-NEXT: (select (result (ref null $A)) ;; CHECK-NEXT: (ref.null none) - ;; CHECK-NEXT: (local.tee $B - ;; CHECK-NEXT: (struct.new $B - ;; CHECK-NEXT: (i32.const 20) + ;; CHECK-NEXT: (block (result (ref null $A)) + ;; CHECK-NEXT: (local.tee $B + ;; CHECK-NEXT: (struct.new $B + ;; CHECK-NEXT: (i32.const 20) + ;; CHECK-NEXT: ) ;; CHECK-NEXT: ) ;; CHECK-NEXT: ) ;; CHECK-NEXT: (i32.const 0) @@ -2361,10 +2363,12 @@ ;; This select is used to keep the type that reaches the struct.set $A, ;; and not $B, so it looks like a perfect copy of $A->$A. (select (result (ref null $A)) - (ref.null $A) - (local.tee $B - (struct.new $B - (i32.const 20) + (ref.null none) + (block (result (ref null $A)) + (local.tee $B + (struct.new $B + (i32.const 20) + ) ) ) (i32.const 0) diff --git a/test/lit/passes/coalesce-locals-gc.wast b/test/lit/passes/coalesce-locals-gc.wast index d2b6fcaeb..59232d1b4 100644 --- a/test/lit/passes/coalesce-locals-gc.wast +++ b/test/lit/passes/coalesce-locals-gc.wast @@ -25,7 +25,7 @@ (global $nn-tuple-global (mut (tuple (ref any) i32)) (tuple.make 2 (ref.i31 (i32.const 0)) (i32.const 1))) - ;; CHECK: (func $test-dead-get-non-nullable (type $6) (param $0 (ref struct)) + ;; CHECK: (func $test-dead-get-non-nullable (type $7) (param $0 (ref struct)) ;; CHECK-NEXT: (unreachable) ;; CHECK-NEXT: (drop ;; CHECK-NEXT: (block (result (ref struct)) @@ -43,7 +43,7 @@ ) ) - ;; CHECK: (func $br_on_null (type $7) (param $0 (ref null $array)) (result (ref null $array)) + ;; CHECK: (func $br_on_null (type $8) (param $0 (ref null $array)) (result (ref null $array)) ;; CHECK-NEXT: (block $label$1 (result (ref null $array)) ;; CHECK-NEXT: (block $label$2 ;; CHECK-NEXT: (br $label$1 @@ -79,7 +79,7 @@ ) ) - ;; CHECK: (func $nn-dead (type $4) + ;; CHECK: (func $nn-dead (type $3) ;; CHECK-NEXT: (local $0 funcref) ;; CHECK-NEXT: (drop ;; CHECK-NEXT: (ref.func $nn-dead) @@ -118,7 +118,7 @@ ) ) - ;; CHECK: (func $nn-dead-nameless (type $4) + ;; CHECK: (func $nn-dead-nameless (type $3) ;; CHECK-NEXT: (local $0 (ref func)) ;; CHECK-NEXT: (drop ;; CHECK-NEXT: (ref.func $nn-dead) @@ -149,26 +149,24 @@ ) ) - ;; CHECK: (func $unreachable-get-null (type $4) + ;; CHECK: (func $unreachable-get-null (type $3) ;; CHECK-NEXT: (local $0 anyref) ;; CHECK-NEXT: (local $1 i31ref) ;; CHECK-NEXT: (unreachable) ;; CHECK-NEXT: (drop ;; CHECK-NEXT: (block (result anyref) - ;; CHECK-NEXT: (unreachable) + ;; CHECK-NEXT: (ref.null none) ;; CHECK-NEXT: ) ;; CHECK-NEXT: ) ;; CHECK-NEXT: (drop ;; CHECK-NEXT: (block (result i31ref) - ;; CHECK-NEXT: (ref.i31 - ;; CHECK-NEXT: (i32.const 0) - ;; CHECK-NEXT: ) + ;; CHECK-NEXT: (ref.null none) ;; CHECK-NEXT: ) ;; CHECK-NEXT: ) ;; CHECK-NEXT: ) (func $unreachable-get-null - ;; Check that we don't replace the local.get $null with a ref.null, which - ;; would have a more precise type. + ;; Check that we don't replace the local.get $null with just a ref.null, which + ;; would have a more precise type. We wrap the ref.null in a block instead. (local $null-any anyref) (local $null-i31 i31ref) (unreachable) @@ -180,6 +178,32 @@ ) ) + ;; CHECK: (func $unreachable-get-tuple (type $3) + ;; CHECK-NEXT: (local $0 (tuple anyref i32)) + ;; CHECK-NEXT: (unreachable) + ;; CHECK-NEXT: (drop + ;; CHECK-NEXT: (tuple.extract 2 0 + ;; CHECK-NEXT: (block (type $6) (result anyref i32) + ;; CHECK-NEXT: (tuple.make 2 + ;; CHECK-NEXT: (ref.null none) + ;; CHECK-NEXT: (i32.const 0) + ;; CHECK-NEXT: ) + ;; CHECK-NEXT: ) + ;; CHECK-NEXT: ) + ;; CHECK-NEXT: ) + ;; CHECK-NEXT: ) + (func $unreachable-get-tuple + (local $tuple (tuple anyref i32)) + (unreachable) + (drop + ;; If we replaced the get with something with a more refined type, this + ;; extract would end up with a stale type. + (tuple.extract 2 0 + (local.get $tuple) + ) + ) + ) + ;; CHECK: (func $remove-tee-refinalize (type $5) (param $0 (ref null $A)) (param $1 (ref null $B)) (result structref) ;; CHECK-NEXT: (struct.get $B 0 ;; CHECK-NEXT: (local.get $1) @@ -218,16 +242,14 @@ ) ) - ;; CHECK: (func $replace-i31-local (type $8) (result i32) + ;; CHECK: (func $replace-i31-local (type $9) (result i32) ;; CHECK-NEXT: (local $0 i31ref) ;; CHECK-NEXT: (i32.add ;; CHECK-NEXT: (unreachable) ;; CHECK-NEXT: (ref.test (ref i31) ;; CHECK-NEXT: (ref.cast i31ref ;; CHECK-NEXT: (block (result i31ref) - ;; CHECK-NEXT: (ref.i31 - ;; CHECK-NEXT: (i32.const 0) - ;; CHECK-NEXT: ) + ;; CHECK-NEXT: (ref.null none) ;; CHECK-NEXT: ) ;; CHECK-NEXT: ) ;; CHECK-NEXT: ) @@ -250,7 +272,7 @@ ) ) - ;; CHECK: (func $replace-struct-param (type $9) (param $0 f64) (param $1 (ref null $A)) (result f32) + ;; CHECK: (func $replace-struct-param (type $10) (param $0 f64) (param $1 (ref null $A)) (result f32) ;; CHECK-NEXT: (call $replace-struct-param ;; CHECK-NEXT: (block (result f64) ;; CHECK-NEXT: (unreachable) @@ -278,7 +300,7 @@ ) ) - ;; CHECK: (func $test (type $10) (param $0 (ref any)) (result (ref any) i32) + ;; CHECK: (func $test (type $11) (param $0 (ref any)) (result (ref any) i32) ;; CHECK-NEXT: (local $1 (tuple anyref i32)) ;; CHECK-NEXT: (tuple.drop 2 ;; CHECK-NEXT: (tuple.make 2 diff --git a/test/lit/passes/issue-7087.wast b/test/lit/passes/issue-7087.wast new file mode 100644 index 000000000..096c88e5d --- /dev/null +++ b/test/lit/passes/issue-7087.wast @@ -0,0 +1,31 @@ +;; NOTE: Assertions have been generated by update_lit_checks.py --all-items and should not be edited. + +;; Regression test for a bug in TypeSSA. TypeSSA creates a new subtype, $t_1, +;; for use in the struct.new in the global initializer, but ran ReFinalize only +;; on function code, not on module-level code. As a result, the tuple.make +;; result type still used $t instead of $t_1 after TypeSSA. This stale type +;; caused Unsubtyping to incorrectly break the subtype relationship between $t +;; and $t_1, leading to a validation error. The fix was to refinalize +;; module-level code in TypeSSA and fix the validator so it would have caught +;; the stale type. + +;; RUN: wasm-opt %s -all --type-ssa --unsubtyping -S -o - | filecheck %s + +(module + ;; CHECK: (rec + ;; CHECK-NEXT: (type $t (sub (struct))) + (type $t (sub (struct))) + + ;; CHECK: (type $t_1 (sub $t (struct))) + + ;; CHECK: (global $g (tuple i32 (ref null $t)) (tuple.make 2 + ;; CHECK-NEXT: (i32.const 0) + ;; CHECK-NEXT: (struct.new_default $t_1) + ;; CHECK-NEXT: )) + (global $g (tuple i32 (ref null $t)) + (tuple.make 2 + (i32.const 0) + (struct.new $t) + ) + ) +) diff --git a/test/lit/passes/optimize-instructions-gc-tnh.wast b/test/lit/passes/optimize-instructions-gc-tnh.wast index ff2975766..c930f2fc1 100644 --- a/test/lit/passes/optimize-instructions-gc-tnh.wast +++ b/test/lit/passes/optimize-instructions-gc-tnh.wast @@ -497,7 +497,7 @@ ) ;; TNH: (func $null.arm.null.effects (type $void) - ;; TNH-NEXT: (block ;; (replaces unreachable StructSet we can't emit) + ;; TNH-NEXT: (block ;; TNH-NEXT: (drop ;; TNH-NEXT: (select ;; TNH-NEXT: (unreachable) @@ -505,9 +505,6 @@ ;; TNH-NEXT: (call $get-i32) ;; TNH-NEXT: ) ;; TNH-NEXT: ) - ;; TNH-NEXT: (drop - ;; TNH-NEXT: (i32.const 1) - ;; TNH-NEXT: ) ;; TNH-NEXT: (unreachable) ;; TNH-NEXT: ) ;; TNH-NEXT: (block @@ -523,7 +520,7 @@ ;; TNH-NEXT: ) ;; TNH-NEXT: ) ;; NO_TNH: (func $null.arm.null.effects (type $void) - ;; NO_TNH-NEXT: (block ;; (replaces unreachable StructSet we can't emit) + ;; NO_TNH-NEXT: (block ;; NO_TNH-NEXT: (drop ;; NO_TNH-NEXT: (select ;; NO_TNH-NEXT: (unreachable) @@ -531,9 +528,6 @@ ;; NO_TNH-NEXT: (call $get-i32) ;; NO_TNH-NEXT: ) ;; NO_TNH-NEXT: ) - ;; NO_TNH-NEXT: (drop - ;; NO_TNH-NEXT: (i32.const 1) - ;; NO_TNH-NEXT: ) ;; NO_TNH-NEXT: (unreachable) ;; NO_TNH-NEXT: ) ;; NO_TNH-NEXT: (block diff --git a/test/lit/passes/remove-unused-brs_all-features.wast b/test/lit/passes/remove-unused-brs_all-features.wast index 4e722a043..e2d89a5ea 100644 --- a/test/lit/passes/remove-unused-brs_all-features.wast +++ b/test/lit/passes/remove-unused-brs_all-features.wast @@ -119,7 +119,7 @@ (func $i32_=>_none (param i32) ) ;; CHECK: (func $selectify (type $6) (param $x i32) (result funcref) - ;; CHECK-NEXT: (select (result funcref) + ;; CHECK-NEXT: (select (result (ref func)) ;; CHECK-NEXT: (ref.func $none_=>_i32) ;; CHECK-NEXT: (ref.func $i32_=>_none) ;; CHECK-NEXT: (local.get $x) diff --git a/test/lit/passes/ssa.wast b/test/lit/passes/ssa.wast index b082cd888..0d696f75a 100644 --- a/test/lit/passes/ssa.wast +++ b/test/lit/passes/ssa.wast @@ -58,4 +58,20 @@ (unreachable) ) ) + + ;; CHECK: (func $null-tuple (type $4) (result funcref) + ;; CHECK-NEXT: (local $tuple (tuple i32 funcref)) + ;; CHECK-NEXT: (tuple.extract 2 1 + ;; CHECK-NEXT: (tuple.make 2 + ;; CHECK-NEXT: (i32.const 0) + ;; CHECK-NEXT: (ref.null nofunc) + ;; CHECK-NEXT: ) + ;; CHECK-NEXT: ) + ;; CHECK-NEXT: ) + (func $null-tuple (result funcref) + (local $tuple (tuple i32 funcref)) + (tuple.extract 2 1 + (local.get $tuple) + ) + ) ) diff --git a/test/lit/select-gc.wat b/test/lit/select-gc.wat deleted file mode 100644 index bd1394950..000000000 --- a/test/lit/select-gc.wat +++ /dev/null @@ -1,26 +0,0 @@ -;; NOTE: Assertions have been generated by update_lit_checks.py and should not be edited. - -;; RUN: wasm-opt -all --roundtrip %s -S -o - | filecheck %s - -;; Check that annotated select is propery roundtripped, even if the type is -;; only used in that one place in the whole module. - -(module - ;; CHECK: (type $struct (struct)) - (type $struct (struct)) - - ;; CHECK: (func $foo (type $0) (result anyref) - ;; CHECK-NEXT: (select (result (ref null $struct)) - ;; CHECK-NEXT: (ref.null none) - ;; CHECK-NEXT: (ref.null none) - ;; CHECK-NEXT: (i32.const 1) - ;; CHECK-NEXT: ) - ;; CHECK-NEXT: ) - (func $foo (result anyref) - (select (result (ref null $struct)) - (ref.null any) - (ref.null eq) - (i32.const 1) - ) - ) -) |