Truncating slightly less than INT32_MIN?

[kripken]

(module
 (func (export "trunc")
  (drop
   (i32.trunc_f64_s
    (f64.const -2147483648.1)
   )
  )
 )
)
(assert_trap (invoke "trunc") "integer overflow")

This behaves differently in different VMs: The spec interpreter, JavaScriptCore, wabt and binaryen trap (that is, the testcase passes as it throws an error when doing the truncation), while V8 and SpiderMonkey do not trap.

To run it: d8 aa.js -- aa.wasm etc., or run the above wast file in something that can run spec testcases.

test.zip

[kripken]

IIUC the spec says that this should in fact trap?

[binji]

Hm, this looks like it should not trap to me, according to the spec. The definition of truncation is to drop the fractional parts: https://webassembly.github.io/spec/core/exec/numerics.html#aux-trunc

And the truncation instruction itself is defined here as cvtop: https://webassembly.github.io/spec/core/exec/instructions.html#t-2-mathsf-xref-syntax-instructions-syntax-cvtop-mathit-cvtop-mathsf-t-1-mathsf-xref-syntax-instructions-syntax-sx-mathit-sx

Which forwards to this numeric function: https://webassembly.github.io/spec/core/exec/numerics.html#xref-exec-numerics-op-trunc-s-mathrm-trunc-mathsf-s-m-n-z

In particular, truncation is defined if -2^N - 1 < trunc(q) < 2^N-1. For i32 this means the range is -2147483649 < trunc(q) < 2147483647.

So -2147483648.1 should be truncated to -2147483648, which should be valid.

[kripken]

Ah yes, I think you're right... I did misread that.

So it seems like the spec interpreter, JavaScriptCore, wabt and binaryen are all wrong here..?

[binji]

I think so, yeah. There's similar (somewhat unintuitive) behavior for the trunc_u instructions, see for example:

(assert_return (invoke "i32.trunc_f64_u" (f64.const -0x1.ccccccccccccdp-1)) (i32.const 0))
(assert_return (invoke "i32.trunc_f64_u" (f64.const -0x1.fffffffffffffp-1)) (i32.const 0))
...
(assert_trap (invoke "i32.trunc_f64_u" (f64.const -1.0)) "integer overflow")

[Constellation]

Fixed in JavaScriptCore too. https://trac.webkit.org/changeset/264995/webkit