diff options
author | Alon Zakai <azakai@google.com> | 2021-05-07 20:59:30 -0700 |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-05-07 20:59:30 -0700 |
commit | 75c8584997e7e09a20c7ebba1802461362b67a7b (patch) | |
tree | 423915ccde24280ad873610a6244f06fd140bc8d /src | |
parent | 88c7b3d6d0e9789caa466f76dfe3116611925756 (diff) | |
download | binaryen-75c8584997e7e09a20c7ebba1802461362b67a7b.tar.gz binaryen-75c8584997e7e09a20c7ebba1802461362b67a7b.tar.bz2 binaryen-75c8584997e7e09a20c7ebba1802461362b67a7b.zip |
[Wasm GC] Fix Array initialization of a packed value (#3868)
We truncated and extended packed values in get and set, but
not during initialization.
Found by the fuzzer.
Diffstat (limited to 'src')
-rw-r--r-- | src/wasm-interpreter.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/wasm-interpreter.h b/src/wasm-interpreter.h index 42bcbaebc..008825632 100644 --- a/src/wasm-interpreter.h +++ b/src/wasm-interpreter.h @@ -1643,7 +1643,8 @@ public: if (init.breaking()) { return init; } - auto value = init.getSingleValue(); + auto field = curr->type.getHeapType().getArray().element; + auto value = truncateForPacking(init.getSingleValue(), field); for (Index i = 0; i < num; i++) { data[i] = value; } |