Skip to content

Commit 1a5b410

Browse files
authored
Fix getExitingBranches, which had |targets| instead of |curr->targets| (#1936)
That caused it to miss switch targets, and a code-folding bug. Fixes #1838 Sadly the fuzzer didn't find this because code folding looks for very particular code patterns that are unlikely to be emitted randomly.
1 parent 3a5dcc6 commit 1a5b410

File tree

3 files changed

+44
-1
lines changed

3 files changed

+44
-1
lines changed

src/ir/branch-utils.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ inline std::set<Name> getExitingBranches(Expression* ast) {
9595
targets.insert(curr->name);
9696
}
9797
void visitSwitch(Switch* curr) {
98-
for (auto target : targets) {
98+
for (auto target : curr->targets) {
9999
targets.insert(target);
100100
}
101101
targets.insert(curr->default_);

test/passes/code-folding.txt

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,7 @@
142142
)
143143
(module
144144
(type $0 (func))
145+
(type $1 (func (param i32)))
145146
(global $global$0 (mut i32) (i32.const 10))
146147
(func $determinism (; 0 ;) (type $0)
147148
(block $folding-inner0
@@ -181,4 +182,25 @@
181182
)
182183
(unreachable)
183184
)
185+
(func $careful-of-the-switch (; 1 ;) (type $1) (param $0 i32)
186+
(block $label$1
187+
(block $label$3
188+
(block $label$5
189+
(block $label$7
190+
(br_table $label$3 $label$7
191+
(i32.const 0)
192+
)
193+
)
194+
(br $label$1)
195+
)
196+
(block $label$8
197+
(br_table $label$3 $label$8
198+
(i32.const 0)
199+
)
200+
)
201+
(br $label$1)
202+
)
203+
(unreachable)
204+
)
205+
)
184206
)

test/passes/code-folding.wast

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,5 +198,26 @@
198198
)
199199
(unreachable)
200200
)
201+
(func $careful-of-the-switch (param $0 i32)
202+
(block $label$1
203+
(block $label$3
204+
(block $label$5
205+
(block $label$7 ;; this is block is equal to $label$8 when accounting for the internal 7/8 difference
206+
(br_table $label$3 $label$7 ;; the reference to $label$3 must remain valid, cannot hoist out of it!
207+
(i32.const 0)
208+
)
209+
)
210+
(br $label$1)
211+
)
212+
(block $label$8
213+
(br_table $label$3 $label$8
214+
(i32.const 0)
215+
)
216+
)
217+
(br $label$1)
218+
)
219+
(unreachable)
220+
)
221+
)
201222
)
202223

0 commit comments

Comments
 (0)