| ;; NOTE: Assertions have been generated by update_lit_checks.py --all-items --output=fuzz-exec and should not be edited. | |
| ;; RUN: wasm-opt %s -all --coalesce-locals --optimize-instructions --fuzz-exec -q -o /dev/null 2>&1 | filecheck %s --check-prefix=NORMAL | |
| ;; RUN: wasm-opt %s -tnh -all --coalesce-locals --optimize-instructions --fuzz-exec -q -o /dev/null 2>&1 | filecheck %s --check-prefix=TNH | |
| ;; The sequence of passes here will do the following: | |
| ;; | |
| ;; * coalesce-locals will remove the local.set. That does not reach any | |
| ;; local.get due to the unreachable, so it is a dead store that we can | |
| ;; remove. | |
| ;; * optimize-instructions will reorder the select's arms (to get rid of the | |
| ;; i32.eqz). It looks ok to reorder them because the local.get on one arm has | |
| ;; no side effects at all. | |
| ;; | |
| ;; After those, if we did not fix up non-nullable locals in between, then we'd | |
| ;; end up executing a local.get of a non-nullable local that has no local.set, | |
| ;; which means we are reading a null by a non-nullable local - an internal | |
| ;; error. We avoid this situation by fixing up non-nullable locals in between | |
| ;; these passes, which adds a ref.as_non_null on the local.get, and that | |
| ;; possibly-trapping instruction will prevent dangerous reordering. In | |
| ;; particular, --fuzz-exec result should be identical before and after: always | |
| ;; log 42 and then trap on that unreachable. | |
| ;; | |
| ;; This also tests traps-never-happen mode. Atm that mode changes nothing here, | |
| ;; but that may change in the future as tnh starts to optimize more things. In | |
| ;; particular, tnh can in principle remove the ref.as_non_null that is added on | |
| ;; the local.get, which would then let optimize-instructions reorder - but that | |
| ;; will still not affect observable behavior, so it is fine. | |
| (module | |
| (import "fuzzing-support" "log-i32" (func $log (param i32))) | |
| ;; NORMAL: [fuzz-exec] export foo | |
| ;; NORMAL-NEXT: [LoggingExternalInterface logging 42] | |
| ;; NORMAL-NEXT: [trap unreachable] | |
| ;; TNH: [fuzz-exec] export foo | |
| ;; TNH-NEXT: [LoggingExternalInterface logging 42] | |
| ;; TNH-NEXT: [trap unreachable] | |
| (func $foo (export "foo") (param $i i32) (result funcref) | |
| (local $ref (ref func)) | |
| (local.set $ref | |
| (ref.func $foo) | |
| ) | |
| (select (result funcref) | |
| (block $trap (result funcref) | |
| (call $log | |
| (i32.const 42) | |
| ) | |
| ;; We never reach the br, but its existence makes the block's type none | |
| ;; instead of unreachable (optimization passes may ignore such | |
| ;; obviously-unreachable code, so we make it less obvious this way). | |
| (unreachable) | |
| (br $trap | |
| (ref.func $foo) | |
| ) | |
| ) | |
| (local.get $ref) | |
| (i32.eqz | |
| (local.get $i) | |
| ) | |
| ) | |
| ) | |
| ) | |
| ;; NORMAL: [fuzz-exec] export foo | |
| ;; NORMAL-NEXT: [LoggingExternalInterface logging 42] | |
| ;; NORMAL-NEXT: [trap unreachable] | |
| ;; NORMAL-NEXT: [fuzz-exec] comparing foo | |
| ;; TNH: [fuzz-exec] export foo | |
| ;; TNH-NEXT: [LoggingExternalInterface logging 42] | |
| ;; TNH-NEXT: [trap unreachable] | |
| ;; TNH-NEXT: [fuzz-exec] comparing foo |