Skip to content

Winch: Assertion failure with saturating conversion instructions #8848

@alexcrichton

Description

@alexcrichton

Given this input:

(module
  (func (param f64 f64 f64 f64) (result f32 f64)
    f64.const 0
    local.get 0
    i64.const 0
    f64.const 0
    i64.const 0
    local.get 0
    f64.const 0
    i64.const 1
    i32.const 1
    i64.const 1
    f32.const 0
    local.get 0

    i32.const 0
    br_if 0

    drop
    drop
    drop
    drop
    drop
    drop
    i64.reinterpret_f64
    i64.const 0
    i64.xor
    drop
    drop
    drop
    drop
    drop
    drop
    f32.const 0
    f64.const 0
  )
)

since the implementation of saturating conversion instructions in #7909 this has panicked

$ cargo run --features winch --no-default-features --features compile compile -C compiler=winch ./testcase1.wasm -o /dev/null
...
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.06s
     Running `target/debug/wasmtime compile -C compiler=winch -o /dev/null ./foo.wat`
thread 'main' panicked at winch/codegen/src/codegen/context.rs:165:13:
assertion `left == right` failed
  left: 64
 right: 48
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

cc @saulecabrera

Metadata

Metadata

Assignees

No one assigned

    Labels

    fuzz-bugBugs found by a fuzzerwinchWinch issues or pull requests

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions