Skip to content

Commit 1faa606

Browse files
authored
Fuzzing: Do not emit RefAsNonNull in non-function contexts (#7188)
Emitting that in e.g. a global init is not going to validate, so avoid doing so, and continue to the code below, which may manage to emit something in this case.
1 parent 059aa20 commit 1faa606

1 file changed

Lines changed: 9 additions & 4 deletions

File tree

src/tools/fuzzing/fuzzing.cpp

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3243,14 +3243,19 @@ Expression* TranslateToFuzzReader::makeCompoundRef(Type type) {
32433243
// which is not ideal.
32443244
if (type.isNonNullable() && (random.finished() || nesting >= LIMIT)) {
32453245
// If we have a function context then we can at least emit a local.get,
3246-
// perhaps, which is less bad. Note that we need to check typeLocals
3246+
// sometimes, which is less bad. Note that we need to check typeLocals
32473247
// manually here to avoid infinite recursion (as makeLocalGet will fall back
32483248
// to us, if there is no local).
32493249
// TODO: we could also look for locals containing subtypes
3250-
if (funcContext && !funcContext->typeLocals[type].empty()) {
3251-
return makeLocalGet(type);
3250+
if (funcContext) {
3251+
if (!funcContext->typeLocals[type].empty()) {
3252+
return makeLocalGet(type);
3253+
}
3254+
// No local, but we are in a function context so RefAsNonNull is valid.
3255+
return builder.makeRefAs(RefAsNonNull, builder.makeRefNull(heapType));
32523256
}
3253-
return builder.makeRefAs(RefAsNonNull, builder.makeRefNull(heapType));
3257+
// No function context, so we are in quite the pickle. Continue onwards, as
3258+
// we may succeed to emit something more complex (like a struct.new).
32543259
}
32553260

32563261
// When we make children, they must be trivial if we are not in a function

0 commit comments

Comments
 (0)