Skip to content

Commit 23e1d51

Browse files
wenyonghwenyongh
authored
Fix loader parse block type and calculate dynamic offset for loop args (#3482)
Fix several issues in wasm loader: - Parse a block's type index with leb int32 instead leb uint32 - Correct dst dynamic offset of loop block arguments for opcode br when copying the stack operands to the arguments of loop block - Free each frame_csp's param_frame_offsets when destroy loader ctx - Fix compilation error in wasm_mini_loader.c - Add test cases of failed issues This PR fixes issue #3467 and #3468.
1 parent 67638e2 commit 23e1d51

7 files changed

Lines changed: 139 additions & 32 deletions

File tree

‎core/iwasm/compilation/aot_compiler.c‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1028,7 +1028,9 @@ aot_compile_func(AOTCompContext *comp_ctx, uint32 func_index)
10281028
}
10291029
else {
10301030
frame_ip--;
1031-
read_leb_uint32(frame_ip, frame_ip_end, type_index);
1031+
read_leb_int32(frame_ip, frame_ip_end, type_index);
1032+
/* type index was checked in wasm loader */
1033+
bh_assert(type_index < comp_ctx->comp_data->type_count);
10321034
func_type =
10331035
(AOTFuncType *)comp_ctx->comp_data->types[type_index];
10341036
param_count = func_type->param_count;
@@ -1048,7 +1050,9 @@ aot_compile_func(AOTCompContext *comp_ctx, uint32 func_index)
10481050
case EXT_OP_LOOP:
10491051
case EXT_OP_IF:
10501052
{
1051-
read_leb_uint32(frame_ip, frame_ip_end, type_index);
1053+
read_leb_int32(frame_ip, frame_ip_end, type_index);
1054+
/* type index was checked in wasm loader */
1055+
bh_assert(type_index < comp_ctx->comp_data->type_count);
10521056
func_type =
10531057
(AOTFuncType *)comp_ctx->comp_data->types[type_index];
10541058
param_count = func_type->param_count;

‎core/iwasm/fast-jit/jit_frontend.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1510,7 +1510,9 @@ jit_compile_func(JitCompContext *cc)
15101510
case EXT_OP_LOOP:
15111511
case EXT_OP_IF:
15121512
{
1513-
read_leb_uint32(frame_ip, frame_ip_end, type_idx);
1513+
read_leb_int32(frame_ip, frame_ip_end, type_idx);
1514+
/* type index was checked in wasm loader */
1515+
bh_assert(type_idx < cc->cur_wasm_module->type_count);
15141516
func_type = cc->cur_wasm_module->types[type_idx];
15151517
param_count = func_type->param_count;
15161518
param_types = func_type->types;

‎core/iwasm/interpreter/wasm_loader.c‎

Lines changed: 50 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -7086,7 +7086,8 @@ wasm_loader_find_block_addr(WASMExecEnv *exec_env, BlockAddr *block_addr_cache,
70867086
}
70877087
else {
70887088
p--;
7089-
skip_leb_uint32(p, p_end);
7089+
/* block type */
7090+
skip_leb_int32(p, p_end);
70907091
}
70917092
if (block_nested_depth
70927093
< sizeof(block_stack) / sizeof(BlockAddr)) {
@@ -7101,7 +7102,7 @@ wasm_loader_find_block_addr(WASMExecEnv *exec_env, BlockAddr *block_addr_cache,
71017102
case EXT_OP_LOOP:
71027103
case EXT_OP_IF:
71037104
/* block type */
7104-
skip_leb_uint32(p, p_end);
7105+
skip_leb_int32(p, p_end);
71057106
if (block_nested_depth
71067107
< sizeof(block_stack) / sizeof(BlockAddr)) {
71077108
block_stack[block_nested_depth].start_addr = p;
@@ -7850,7 +7851,11 @@ typedef struct BranchBlock {
78507851
BranchBlockPatch *patch_list;
78517852
/* This is used to save params frame_offset of of if block */
78527853
int16 *param_frame_offsets;
7853-
/* This is used to recover dynamic offset for else branch */
7854+
/* This is used to recover the dynamic offset for else branch,
7855+
* and also to remember the start offset of dynamic space which
7856+
* stores the block arguments for loop block, so we can use it
7857+
* to copy the stack operands to the loop block's arguments in
7858+
* wasm_loader_emit_br_info for opcode br. */
78547859
uint16 start_dynamic_offset;
78557860
#endif
78567861

@@ -8001,13 +8006,26 @@ static void
80018006
free_all_label_patch_lists(BranchBlock *frame_csp, uint32 csp_num)
80028007
{
80038008
BranchBlock *tmp_csp = frame_csp;
8009+
uint32 i;
80048010

8005-
for (uint32 i = 0; i < csp_num; i++) {
8011+
for (i = 0; i < csp_num; i++) {
80068012
free_label_patch_list(tmp_csp);
80078013
tmp_csp++;
80088014
}
80098015
}
80108016

8017+
static void
8018+
free_all_label_param_frame_offsets(BranchBlock *frame_csp, uint32 csp_num)
8019+
{
8020+
BranchBlock *tmp_csp = frame_csp;
8021+
uint32 i;
8022+
8023+
for (i = 0; i < csp_num; i++) {
8024+
if (tmp_csp->param_frame_offsets)
8025+
wasm_runtime_free(tmp_csp->param_frame_offsets);
8026+
tmp_csp++;
8027+
}
8028+
}
80118029
#endif /* end of WASM_ENABLE_FAST_INTERP */
80128030

80138031
#if WASM_ENABLE_GC != 0
@@ -8126,6 +8144,8 @@ wasm_loader_ctx_destroy(WASMLoaderContext *ctx)
81268144
if (ctx->frame_csp_bottom) {
81278145
#if WASM_ENABLE_FAST_INTERP != 0
81288146
free_all_label_patch_lists(ctx->frame_csp_bottom, ctx->csp_num);
8147+
free_all_label_param_frame_offsets(ctx->frame_csp_bottom,
8148+
ctx->csp_num);
81298149
#endif
81308150
#if WASM_ENABLE_GC != 0
81318151
wasm_loader_clean_all_local_use_masks(ctx);
@@ -9238,8 +9258,14 @@ wasm_loader_emit_br_info(WASMLoaderContext *ctx, BranchBlock *frame_csp,
92389258
emit_operand(ctx, *(int16 *)(frame_offset));
92399259
}
92409260
/* Part e */
9241-
dynamic_offset =
9242-
frame_csp->dynamic_offset + wasm_get_cell_num(types, arity);
9261+
if (frame_csp->label_type == LABEL_TYPE_LOOP)
9262+
/* Use start_dynamic_offset which was set in
9263+
copy_params_to_dynamic_space */
9264+
dynamic_offset = frame_csp->start_dynamic_offset
9265+
+ wasm_get_cell_num(types, arity);
9266+
else
9267+
dynamic_offset =
9268+
frame_csp->dynamic_offset + wasm_get_cell_num(types, arity);
92439269
if (is_br)
92449270
ctx->dynamic_offset = dynamic_offset;
92459271
for (i = (int32)arity - 1; i >= 0; i--) {
@@ -10623,8 +10649,8 @@ check_block_stack(WASMLoaderContext *loader_ctx, BranchBlock *block,
1062310649
* Part e: each param's dst offset
1062410650
*/
1062510651
static bool
10626-
copy_params_to_dynamic_space(WASMLoaderContext *loader_ctx, bool is_if_block,
10627-
char *error_buf, uint32 error_buf_size)
10652+
copy_params_to_dynamic_space(WASMLoaderContext *loader_ctx, char *error_buf,
10653+
uint32 error_buf_size)
1062810654
{
1062910655
bool ret = false;
1063010656
int16 *frame_offset = NULL;
@@ -10638,6 +10664,7 @@ copy_params_to_dynamic_space(WASMLoaderContext *loader_ctx, bool is_if_block,
1063810664
uint32 param_count = block_type->u.type->param_count;
1063910665
int16 condition_offset = 0;
1064010666
bool disable_emit = false;
10667+
bool is_if_block = (block->label_type == LABEL_TYPE_IF ? true : false);
1064110668
int16 operand_offset = 0;
1064210669

1064310670
uint64 size = (uint64)param_count * (sizeof(*cells) + sizeof(*src_offsets));
@@ -10690,6 +10717,14 @@ copy_params_to_dynamic_space(WASMLoaderContext *loader_ctx, bool is_if_block,
1069010717
if (is_if_block)
1069110718
emit_operand(loader_ctx, condition_offset);
1069210719

10720+
/* Since the start offset to save the block's params and
10721+
* the start offset to save the block's results may be
10722+
* different, we remember the dynamic offset for loop block
10723+
* so that we can use it to copy the stack operands to the
10724+
* loop block's params in wasm_loader_emit_br_info. */
10725+
if (block->label_type == LABEL_TYPE_LOOP)
10726+
block->start_dynamic_offset = loader_ctx->dynamic_offset;
10727+
1069310728
/* Part e) */
1069410729
/* Push to dynamic space. The push will emit the dst offset. */
1069510730
for (i = 0; i < param_count; i++)
@@ -11062,12 +11097,12 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
1106211097
#endif /* end of WASM_ENABLE_GC != 0 */
1106311098
}
1106411099
else {
11065-
uint32 type_index;
11100+
int32 type_index;
1106611101
/* Resolve the leb128 encoded type index as block type */
1106711102
p--;
1106811103
p_org = p - 1;
11069-
read_leb_uint32(p, p_end, type_index);
11070-
if (type_index >= module->type_count) {
11104+
read_leb_int32(p, p_end, type_index);
11105+
if ((uint32)type_index >= module->type_count) {
1107111106
set_error_buf(error_buf, error_buf_size,
1107211107
"unknown type");
1107311108
goto fail;
@@ -11171,8 +11206,8 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
1117111206

1117211207
if (BLOCK_HAS_PARAM(block_type)) {
1117311208
/* Make sure params are in dynamic space */
11174-
if (!copy_params_to_dynamic_space(
11175-
loader_ctx, false, error_buf, error_buf_size))
11209+
if (!copy_params_to_dynamic_space(loader_ctx, error_buf,
11210+
error_buf_size))
1117611211
goto fail;
1117711212
}
1117811213

@@ -11218,8 +11253,8 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
1121811253
/* skip the if label */
1121911254
skip_label();
1122011255
/* Emit a copy instruction */
11221-
if (!copy_params_to_dynamic_space(
11222-
loader_ctx, true, error_buf, error_buf_size))
11256+
if (!copy_params_to_dynamic_space(loader_ctx, error_buf,
11257+
error_buf_size))
1122311258
goto fail;
1122411259

1122511260
/* Emit the if instruction */

‎core/iwasm/interpreter/wasm_mini_loader.c‎

Lines changed: 48 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3451,7 +3451,7 @@ wasm_loader_find_block_addr(WASMExecEnv *exec_env, BlockAddr *block_addr_cache,
34513451
case EXT_OP_LOOP:
34523452
case EXT_OP_IF:
34533453
/* block type */
3454-
skip_leb_uint32(p, p_end);
3454+
skip_leb_int32(p, p_end);
34553455
if (block_nested_depth
34563456
< sizeof(block_stack) / sizeof(BlockAddr)) {
34573457
block_stack[block_nested_depth].start_addr = p;
@@ -3921,7 +3921,11 @@ typedef struct BranchBlock {
39213921
/* This is used to store available param num for if/else branch, so the else
39223922
* opcode can know how many parameters should be copied to the stack */
39233923
uint32 available_param_num;
3924-
/* This is used to recover dynamic offset for else branch */
3924+
/* This is used to recover the dynamic offset for else branch,
3925+
* and also to remember the start offset of dynamic space which
3926+
* stores the block arguments for loop block, so we can use it
3927+
* to copy the stack operands to the loop block's arguments in
3928+
* wasm_loader_emit_br_info for opcode br. */
39253929
uint16 start_dynamic_offset;
39263930
#endif
39273931

@@ -4050,13 +4054,26 @@ static void
40504054
free_all_label_patch_lists(BranchBlock *frame_csp, uint32 csp_num)
40514055
{
40524056
BranchBlock *tmp_csp = frame_csp;
4057+
uint32 i;
40534058

4054-
for (uint32 i = 0; i < csp_num; i++) {
4059+
for (i = 0; i < csp_num; i++) {
40554060
free_label_patch_list(tmp_csp);
40564061
tmp_csp++;
40574062
}
40584063
}
40594064

4065+
static void
4066+
free_all_label_param_frame_offsets(BranchBlock *frame_csp, uint32 csp_num)
4067+
{
4068+
BranchBlock *tmp_csp = frame_csp;
4069+
uint32 i;
4070+
4071+
for (i = 0; i < csp_num; i++) {
4072+
if (tmp_csp->param_frame_offsets)
4073+
wasm_runtime_free(tmp_csp->param_frame_offsets);
4074+
tmp_csp++;
4075+
}
4076+
}
40604077
#endif
40614078

40624079
static bool
@@ -4120,6 +4137,8 @@ wasm_loader_ctx_destroy(WASMLoaderContext *ctx)
41204137
if (ctx->frame_csp_bottom) {
41214138
#if WASM_ENABLE_FAST_INTERP != 0
41224139
free_all_label_patch_lists(ctx->frame_csp_bottom, ctx->csp_num);
4140+
free_all_label_param_frame_offsets(ctx->frame_csp_bottom,
4141+
ctx->csp_num);
41234142
#endif
41244143
wasm_runtime_free(ctx->frame_csp_bottom);
41254144
}
@@ -4798,8 +4817,14 @@ wasm_loader_emit_br_info(WASMLoaderContext *ctx, BranchBlock *frame_csp,
47984817
emit_operand(ctx, *(int16 *)(frame_offset));
47994818
}
48004819
/* Part e */
4801-
dynamic_offset =
4802-
frame_csp->dynamic_offset + wasm_get_cell_num(types, arity);
4820+
if (frame_csp->label_type == LABEL_TYPE_LOOP)
4821+
/* Use start_dynamic_offset which was set in
4822+
copy_params_to_dynamic_space */
4823+
dynamic_offset = frame_csp->start_dynamic_offset
4824+
+ wasm_get_cell_num(types, arity);
4825+
else
4826+
dynamic_offset =
4827+
frame_csp->dynamic_offset + wasm_get_cell_num(types, arity);
48034828
if (is_br)
48044829
ctx->dynamic_offset = dynamic_offset;
48054830
for (i = (int32)arity - 1; i >= 0; i--) {
@@ -5778,8 +5803,8 @@ check_block_stack(WASMLoaderContext *loader_ctx, BranchBlock *block,
57785803
* Part e: each param's dst offset
57795804
*/
57805805
static bool
5781-
copy_params_to_dynamic_space(WASMLoaderContext *loader_ctx, bool is_if_block,
5782-
char *error_buf, uint32 error_buf_size)
5806+
copy_params_to_dynamic_space(WASMLoaderContext *loader_ctx, char *error_buf,
5807+
uint32 error_buf_size)
57835808
{
57845809
bool ret = false;
57855810
int16 *frame_offset = NULL;
@@ -5793,6 +5818,7 @@ copy_params_to_dynamic_space(WASMLoaderContext *loader_ctx, bool is_if_block,
57935818
uint32 param_count = block_type->u.type->param_count;
57945819
int16 condition_offset = 0;
57955820
bool disable_emit = false;
5821+
bool is_if_block = (block->label_type == LABEL_TYPE_IF ? true : false);
57965822
int16 operand_offset = 0;
57975823

57985824
uint64 size = (uint64)param_count * (sizeof(*cells) + sizeof(*src_offsets));
@@ -5845,6 +5871,14 @@ copy_params_to_dynamic_space(WASMLoaderContext *loader_ctx, bool is_if_block,
58455871
if (is_if_block)
58465872
emit_operand(loader_ctx, condition_offset);
58475873

5874+
/* Since the start offset to save the block's params and
5875+
* the start offset to save the block's results may be
5876+
* different, we remember the dynamic offset for loop block
5877+
* so that we can use it to copy the stack operands to the
5878+
* loop block's params in wasm_loader_emit_br_info. */
5879+
if (block->label_type == LABEL_TYPE_LOOP)
5880+
block->start_dynamic_offset = loader_ctx->dynamic_offset;
5881+
58485882
/* Part e) */
58495883
/* Push to dynamic space. The push will emit the dst offset. */
58505884
for (i = 0; i < param_count; i++)
@@ -6043,11 +6077,11 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
60436077
block_type.u.value_type.type = value_type;
60446078
}
60456079
else {
6046-
uint32 type_index;
6080+
int32 type_index;
60476081
/* Resolve the leb128 encoded type index as block type */
60486082
p--;
6049-
read_leb_uint32(p, p_end, type_index);
6050-
bh_assert(type_index < module->type_count);
6083+
read_leb_int32(p, p_end, type_index);
6084+
bh_assert((uint32)type_index < module->type_count);
60516085
block_type.is_value_type = false;
60526086
block_type.u.type = module->types[type_index];
60536087
#if WASM_ENABLE_FAST_INTERP == 0
@@ -6134,8 +6168,8 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
61346168
skip_label();
61356169
if (BLOCK_HAS_PARAM(block_type)) {
61366170
/* Make sure params are in dynamic space */
6137-
if (!copy_params_to_dynamic_space(
6138-
loader_ctx, false, error_buf, error_buf_size))
6171+
if (!copy_params_to_dynamic_space(loader_ctx, error_buf,
6172+
error_buf_size))
61396173
goto fail;
61406174
}
61416175
if (opcode == WASM_OP_LOOP) {
@@ -6175,8 +6209,8 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
61756209
/* skip the if label */
61766210
skip_label();
61776211
/* Emit a copy instruction */
6178-
if (!copy_params_to_dynamic_space(
6179-
loader_ctx, true, error_buf, error_buf_size))
6212+
if (!copy_params_to_dynamic_space(loader_ctx, error_buf,
6213+
error_buf_size))
61806214
goto fail;
61816215

61826216
/* Emit the if instruction */

‎tests/regression/ba-issues/issues/issue-3467/tt_unreachable.wasm‎

237 Bytes
Binary file not shown.

‎tests/regression/ba-issues/issues/issue-3468/i64.add.wasm‎

14.3 KB
Binary file not shown.

‎tests/regression/ba-issues/running_config.json‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1674,6 +1674,38 @@
16741674
"stdout content": "Hello from Kotlin via WASI\nCurrent 'realtime' timestamp is:",
16751675
"description": "no 'type mismatch: expect (ref null ht) but got other1 unknown type'"
16761676
}
1677+
},
1678+
{
1679+
"deprecated": false,
1680+
"ids": [
1681+
3467
1682+
],
1683+
"runtime": "iwasm-default-wasi-disabled",
1684+
"file": "tt_unreachable.wasm",
1685+
"mode": "fast-interp",
1686+
"options": "--heap-size=0 -f to_test",
1687+
"argument": "",
1688+
"expected return": {
1689+
"ret code": 1,
1690+
"stdout content": "Exception: unreachable",
1691+
"description": "no '-1.861157e+19:f32'"
1692+
}
1693+
},
1694+
{
1695+
"deprecated": false,
1696+
"ids": [
1697+
3468
1698+
],
1699+
"runtime": "iwasm-default-wasi-disabled",
1700+
"file": "i64.add.wasm",
1701+
"mode": "fast-interp",
1702+
"options": "--heap-size=0 -f to_test",
1703+
"argument": "",
1704+
"expected return": {
1705+
"ret code": 255,
1706+
"stdout content": "WASM module load failed: unknown type",
1707+
"description": "no '0x0:i64'"
1708+
}
16771709
}
16781710
]
16791711
}

0 commit comments

Comments
 (0)