Bug 1517351 Comment 15 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
Apparently the test labeled "// address.wast:533", needs to be verified.
Revision 1 by
on 
Failure is caused by the test labeled "// address.wast:535" even when run in isolation.  That is this test case:
```
(module
  (type (;0;) (func))
  (type (;1;) (func (param i32) (result f32)))
  (import "$3" "32_good1" (func (;0;) (type 1)))
  (func (;1;) (type 0)
    block  ;; label = @1
      i32.const 65525
      call 0
      i32.reinterpret_f32
      f32.const 0x0p+0 (;=0;)
      i32.reinterpret_f32
      i32.eq
      i32.eqz
      br_if 0 (;@1;)
      return
    end
    unreachable)
  (export "run" (func 1)))
```
and the function "32_good1" comes from here:
``
(module
  (type (;0;) (func (param i32) (result f32)))
  (type (;1;) (func (param i32)))
  (func (;0;) (type 0) (param i32) (result f32)
    local.get 0
    f32.load)
  (func (;1;) (type 0) (param i32) (result f32)
    local.get 0
    f32.load align=1)
  (func (;2;) (type 0) (param i32) (result f32)
    local.get 0
    f32.load offset=1 align=1)
  (func (;3;) (type 0) (param i32) (result f32)
    local.get 0
    f32.load offset=2 align=2)
  (func (;4;) (type 0) (param i32) (result f32)
    local.get 0
    f32.load offset=8)
  (func (;5;) (type 1) (param i32)
    local.get 0
    f32.load offset=4294967295
    drop)
  (memory (;0;) 1)
  (export "32_good1" (func 0))
  (export "32_good2" (func 1))
  (export "32_good3" (func 2))
  (export "32_good4" (func 3))
  (export "32_good5" (func 4))
  (export "32_bad" (func 5))
  (data (;0;) (i32.const 0) "\00\00\00\00\00\00\a0\7f\01\00\d0\7f"))
```
This looks like an f32 load from an unaligned address without any alignment specifier; a known dark corner of our ARM implementation...

OOB is a strange error to see here since the access is clearly in-bounds, so more likely the load causes an exception that is interpreted by us as OOB.  But we'll see.
Revision 2 by
on 
Failure is caused by the test labeled "// address.wast:535" even when run in isolation.  That is this test case:
```
(module
  (type (;0;) (func))
  (type (;1;) (func (param i32) (result f32)))
  (import "$3" "32_good1" (func (;0;) (type 1)))
  (func (;1;) (type 0)
    block  ;; label = @1
      i32.const 65525
      call 0
      i32.reinterpret_f32
      f32.const 0x0p+0 (;=0;)
      i32.reinterpret_f32
      i32.eq
      i32.eqz
      br_if 0 (;@1;)
      return
    end
    unreachable)
  (export "run" (func 1)))
```
and the function "32_good1" comes from here:
```
(module
  (type (;0;) (func (param i32) (result f32)))
  (type (;1;) (func (param i32)))
  (func (;0;) (type 0) (param i32) (result f32)
    local.get 0
    f32.load)
  (func (;1;) (type 0) (param i32) (result f32)
    local.get 0
    f32.load align=1)
  (func (;2;) (type 0) (param i32) (result f32)
    local.get 0
    f32.load offset=1 align=1)
  (func (;3;) (type 0) (param i32) (result f32)
    local.get 0
    f32.load offset=2 align=2)
  (func (;4;) (type 0) (param i32) (result f32)
    local.get 0
    f32.load offset=8)
  (func (;5;) (type 1) (param i32)
    local.get 0
    f32.load offset=4294967295
    drop)
  (memory (;0;) 1)
  (export "32_good1" (func 0))
  (export "32_good2" (func 1))
  (export "32_good3" (func 2))
  (export "32_good4" (func 3))
  (export "32_good5" (func 4))
  (export "32_bad" (func 5))
  (data (;0;) (i32.const 0) "\00\00\00\00\00\00\a0\7f\01\00\d0\7f"))
```
This looks like an f32 load from an unaligned address without any alignment specifier; a known dark corner of our ARM implementation...

OOB is a strange error to see here since the access is clearly in-bounds, so more likely the load causes an exception that is interpreted by us as OOB.  But we'll see.

Back to Bug 1517351 Comment 15