{{ message }}
Repository navigation
"+=" for an operand with side effects causes miscompilation #3051
Description
Bug description
Hi, I ran the following index.ts and got a runtime error: Index out of range, but I think elements[index++] += 1; should be executed successfully.
// index.ts
export function main(): void {
const elements = new StaticArray<i32>(1);
let index: i32 = 0;
elements[index++] += 1;
}Steps to reproduce
-> node /home/ringzzz/fuzz_emerging_compilers/AssemblyScript/assemblyscript/bin/asc --optimizeLevel 2 --shrinkLevel 2 index.ts -o index.wasm
# run index.wasm in a js wrapper
# put the index.wasm and run.js in the same folder
-> node run.js
# error messages
file:///test/release.js:12
throw Error(`${message} in ${fileName}:${lineNumber}:${columnNumber}`);
^
Error: Index out of range in ~lib/staticarray.ts:78:41
at file:///test/release.js:12:17
at abort (file:///test/release.js:13:11)
at wasm://wasm/2bf41e12:wasm-function[22]:0xb2a
at file:///test/run.js:3:13
Node.js v20.14.0
// run.js
async function instantiate(module, imports = {}) {
const adaptedImports = {
env: Object.setPrototypeOf({
abort(message, fileName, lineNumber, columnNumber) {
// ~lib/builtins/abort(~lib/string/String | null?, ~lib/string/String | null?, u32?, u32?) => void
message = __liftString(message >>> 0);
fileName = __liftString(fileName >>> 0);
lineNumber = lineNumber >>> 0;
columnNumber = columnNumber >>> 0;
(() => {
// @external.js
throw Error(`${message} in ${fileName}:${lineNumber}:${columnNumber}`);
})();
},
trace(message, n, a0, a1, a2, a3, a4) {
// env.trace(message: usize, n: i32, a0?: f64, a1?: f64, a2?: f64, a3?: f64, a4?: f64): void
message = __liftString(message >>> 0);
n = n | 0;
const values = [a0, a1, a2, a3, a4].slice(0, Math.max(0, Math.min(n, 5)));
if (values.length > 0) {
console.log(`[trace] ${message}`, ...values);
} else {
console.log(`[trace] ${message}`);
}
},
}, Object.assign(Object.create(globalThis), imports.env || {})),
index: Object.setPrototypeOf({
log(ptr) {
// ptr: i32 (指向 AS string)
console.log(__liftString(ptr >>> 0));
},
}, Object.assign(Object.create(globalThis), imports.index || {})),
};
const { exports } = await WebAssembly.instantiate(module, adaptedImports);
const memory = exports.memory || imports.env.memory;
function __liftString(pointer) {
if (!pointer) return null;
const
end = pointer + new Uint32Array(memory.buffer)[pointer - 4 >>> 2] >>> 1,
memoryU16 = new Uint16Array(memory.buffer);
let
start = pointer >>> 1,
string = "";
while (end - start > 1024) string += String.fromCharCode(...memoryU16.subarray(start, start += 1024));
return string + String.fromCharCode(...memoryU16.subarray(start, end));
}
return exports;
}
export const {
memory,
main,
} = await (async url => instantiate(
await (async () => {
const isNodeOrBun = typeof process != "undefined" && process.versions != null && (process.versions.node != null || process.versions.bun != null);
if (isNodeOrBun) { return globalThis.WebAssembly.compile(await (await import("node:fs/promises")).readFile(url)); }
else { return await globalThis.WebAssembly.compileStreaming(globalThis.fetch(url)); }
})(), {
}
))(new URL("index.wasm", import.meta.url));
main();
Activity