It seems that the fast interpreter can miscompute the length of a block type. I think this happens for multi-byte type indexes. I get this trace for the piece of code below:
jerome@catalpa:~/tmp/bugs$ ~/sources/wizard-engine/bin/spectest.x86-64-linux -ti bug.bin.wast
##+bug.bin.wast
+1: block[[] -> [i32 i32]]
+3: unreachable
##-fail: bug.bin.wast @ 21:2 assert_return expected [], got trap[UNREACHABLE]
(module
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func)) (type (func)) (type (func)) (type (func))
(type (func))
(type $res (func (result i32 i32)))
(func (export "main")
(block (type $res)
(return))
(drop)
(drop)
)
)
(assert_return (invoke "main"))
(module definition binary
"\00\61\73\6d\01\00\00\00\01\c9\81\80\80\00\42\60"
"\00\00\60\00\00\60\00\00\60\00\00\60\00\00\60\00"
"\00\60\00\00\60\00\00\60\00\00\60\00\00\60\00\00"
"\60\00\00\60\00\00\60\00\00\60\00\00\60\00\00\60"
"\00\00\60\00\00\60\00\00\60\00\00\60\00\00\60\00"
"\00\60\00\00\60\00\00\60\00\00\60\00\00\60\00\00"
"\60\00\00\60\00\00\60\00\00\60\00\00\60\00\00\60"
"\00\00\60\00\00\60\00\00\60\00\00\60\00\00\60\00"
"\00\60\00\00\60\00\00\60\00\00\60\00\00\60\00\00"
"\60\00\00\60\00\00\60\00\00\60\00\00\60\00\00\60"
"\00\00\60\00\00\60\00\00\60\00\00\60\00\00\60\00"
"\00\60\00\00\60\00\00\60\00\00\60\00\00\60\00\00"
"\60\00\00\60\00\00\60\00\00\60\00\00\60\00\00\60"
"\00\00\60\00\02\7f\7f\03\82\80\80\80\00\01\00\07"
"\88\80\80\80\00\01\04\6d\61\69\6e\00\00\0a\8f\80"
"\80\80\00\01\89\80\80\80\00\00\02\c1\00\0f\0b\1a"
"\1a\0b"
)
(module instance)
(assert_return (invoke "main"))
It seems that the fast interpreter can miscompute the length of a block type. I think this happens for multi-byte type indexes. I get this trace for the piece of code below: