STR: wasm-opt w.wasm -all --print --name-types --print
The output is
(module
(type$none_=>_none (func))
(global$global$0 (ref null $none_=>_none) (ref.func$0))
(global$global$1i32 (i32.const0))
(global$global$2 (mutexternref) (ref.nullextern))
(global$global$3 (muti32) (i32.const-6567))
(global$global$4 (mutanyref) (ref.null any))
(global$global$5 (muti32) (i32.const10))
(memory$0 (shared 1617))
(table$016funcref)
(table$128funcref)
(table$21818funcref)
(table$300externref)
(elem$0 (table$0) (i32.const0) func)
(elem$1 (table$1) (i32.const0) func)
(elem$2 (table$1) (i32.const1) func)
(elem$3 (table$2) (i32.const0) func)
(elem$4 (table$2) (i32.const2) func)
(elem$5func)
(elem$6func)
(elem$7 (ref null $none_=>_none) (ref.func$0) (ref.func$0) (ref.null$none_=>_none))
(elem$8func)
(func$0
(nop)
)
)
(module
(type$type$0 (func))
(global$global$0 (ref null $type$0) (ref.func$0))
(global$global$1i32 (i32.const0))
(global$global$2 (mutexternref) (ref.nullextern))
(global$global$3 (muti32) (i32.const-6567))
(global$global$4 (mutanyref) (ref.null any))
(global$global$5 (muti32) (i32.const10))
(memory$0 (shared 1617))
(table$016funcref)
(table$128funcref)
(table$21818funcref)
(table$300externref)
(elem$0 (table$0) (i32.const0) func)
(elem$1 (table$1) (i32.const0) func)
(elem$2 (table$1) (i32.const1) func)
(elem$3 (table$2) (i32.const0) func)
(elem$4 (table$2) (i32.const2) func)
(elem$5func)
(elem$6func)
(elem$7 (ref null $type$0) (ref.func$0) (ref.func$0) (ref.null$none_=>_none))
(elem$8func)
(func$0
(nop)
)
)
The key thing is the $none_=>_none type, which should not exist after we name the types. It appears twice in the element segments, and remains in one of them at the end. It seems that the two may have gotten different types..?
cc @tlively
(found by fuzzer seed 9943180413750209438, then reduced. it can't be reduced by hand as the bug does not show itself on the text format...)
w.wasm.gz
STR:
wasm-opt w.wasm -all --print --name-types --printThe output is
The key thing is the
$none_=>_nonetype, which should not exist after we name the types. It appears twice in the element segments, and remains in one of them at the end. It seems that the two may have gotten different types..?cc @tlively
(found by fuzzer seed
9943180413750209438, then reduced. it can't be reduced by hand as the bug does not show itself on the text format...)w.wasm.gz