diff --git a/FuzzTesting/FailCases/FuzzTranslator/crash-2e61aac9dea72d2efe93489c1276ec1b69fb2992 b/FuzzTesting/FailCases/FuzzTranslator/crash-2e61aac9dea72d2efe93489c1276ec1b69fb2992 new file mode 100644 index 00000000..0230e496 Binary files /dev/null and b/FuzzTesting/FailCases/FuzzTranslator/crash-2e61aac9dea72d2efe93489c1276ec1b69fb2992 differ diff --git a/Sources/WasmKit/Translator.swift b/Sources/WasmKit/Translator.swift index 9d78dfda..3a7135a3 100644 --- a/Sources/WasmKit/Translator.swift +++ b/Sources/WasmKit/Translator.swift @@ -900,8 +900,8 @@ struct InstructionTranslator: InstructionVisitor { /// /// - Parameter typeHint: A type expected to be popped. Only used for diagnostic purpose. /// - Returns: `true` if check succeed. `false` if the pop operation is going to be performed in unreachable code path. - private func checkBeforePop(typeHint: ValueType?, controlFrame: ControlStack.ControlFrame) throws -> Bool { - if _slowPath(valueStack.height <= controlFrame.stackHeight) { + private func checkBeforePop(typeHint: ValueType?, depth: Int = 0, controlFrame: ControlStack.ControlFrame) throws -> Bool { + if _slowPath(valueStack.height - depth <= controlFrame.stackHeight) { if controlFrame.reachable { let message: String if let typeHint { @@ -916,9 +916,9 @@ struct InstructionTranslator: InstructionVisitor { } return true } - private func checkBeforePop(typeHint: ValueType?) throws -> Bool { + private func checkBeforePop(typeHint: ValueType?, depth: Int = 0) throws -> Bool { let controlFrame = try controlStack.currentFrame() - return try self.checkBeforePop(typeHint: typeHint, controlFrame: controlFrame) + return try self.checkBeforePop(typeHint: typeHint, depth: depth, controlFrame: controlFrame) } private mutating func ensureOnVReg(_ source: ValueSource) -> VReg { // TODO: Copy to stack if source is on preg @@ -994,7 +994,7 @@ struct InstructionTranslator: InstructionVisitor { private func checkStackTop(_ valueTypes: [ValueType]) throws { for (stackDepth, type) in valueTypes.reversed().enumerated() { - guard try checkBeforePop(typeHint: type) else { return } + guard try checkBeforePop(typeHint: type, depth: stackDepth) else { return } let actual = valueStack.peekType(depth: stackDepth) switch actual { case .some(let actualType):