Repository navigation
[Interpreter] Implement StackSwitch execution - #9323
Conversation
`ModuleRunnerBase::visitStackSwitch` previously returned `Flow(NONCONSTANT_FLOW)`, which caused `ModuleRunnerBase::callFunction` to throw an uncaught `NonconstantException` when executing a `switch` instruction under `--fuzz-exec` or `wasm-shell`. Implement full interpreter support for `switch` instructions and `(on $tag switch)` handlers in `resume` and `resume_throw`, distinguishing label handlers from switch handlers and looping in `doResume` to transfer control directly to the target continuation.
There was a problem hiding this comment.
Code Review
This pull request implements stack switching support in the WebAssembly interpreter, enabling fuzzer support and unblocking several spec tests. Key changes include adding STACK_SWITCH_FLOW control flow handling, refactoring continuation resumption, and implementing the visitStackSwitch and doResume logic to support switching between continuations. Additionally, comprehensive tests have been added to verify behavior under various scenarios, such as null continuation traps and switching back and forth. A potential underflow issue was identified in visitStackSwitch when retrieving the last parameter of the continuation's signature, which could lead to an out-of-bounds access if sig.params is empty.
| auto sig = | ||
| curr->cont->type.getHeapType().getContinuation().type.getSignature(); | ||
| new_->type = sig.params[sig.params.size() - 1].getHeapType(); |
There was a problem hiding this comment.
If sig.params is empty, sig.params.size() - 1 will underflow because size() returns an unsigned size_t. This would lead to an out-of-bounds access and undefined behavior. We should assert that sig.params is not empty before accessing its elements.
auto sig =
curr->cont->type.getHeapType().getContinuation().type.getSignature();
assert(sig.params.size() > 0);
new_->type = sig.params[sig.params.size() - 1].getHeapType();
kripken
left a comment
There was a problem hiding this comment.
Looks like this fixes current fuzz errors on main?
Yes :) |
|
LGTM after ASAN build is resolved |
|
ASAN build resolved by 1) ignoring leaks due to cycles, like we already do for GCData, etc. and 2) clearing continuation arguments after they are consumed. This avoids building up unbounded chains of expired continuations when passing continuations to other continuations. |
ModuleRunnerBase::visitStackSwitchpreviously returnedFlow(NONCONSTANT_FLOW), which causedModuleRunnerBase::callFunctionto throw an uncaughtNonconstantExceptionwhen executing aswitchinstruction under--fuzz-execorwasm-shell. Implement full interpreter support forswitchinstructions and(on $tag switch)handlers inresumeandresume_throw, distinguishing label handlers from switch handlers and looping indoResumeto transfer control directly to the target continuation.