Skip to content

Conversation

@tlively
Copy link
Member

@tlively tlively commented May 1, 2024

When GlobalRefining refines the type of a global, it updates the type of
corresponding GlobalGet expressions, then runs ReFinalize to propagate the
refined types. However, it only performed these updates in function bodies,
leaving stale types on GlobalGet expressions in constant initializers. This bug
was not easily caught because the validator did not check that GlobalGet types
actually match the types of the corresponding globals.

Fix the validator to check the types of GlobalGet expressions and fix
GlobalRefining to properly update constant initializers.

Fixes #6565.

When GlobalRefining refines the type of a global, it updates the type of
corresponding GlobalGet expressions, then runs ReFinalize to propagate the
refined types. However, it only performed these updates in function bodies,
leaving stale types on GlobalGet expressions in constant initializers. This bug
was not easily caught because the validator did not check that `GlobalGet` types
actually match the types of the corresponding globals.

Fix the validator to check the types of `GlobalGet` expressions and fix
GlobalRefining to properly update constant initializers.

Fixes #6565.
@tlively tlively requested a review from kripken May 1, 2024 03:20
Copy link
Member Author

tlively commented May 1, 2024

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @tlively and the rest of your teammates on Graphite Graphite

@tlively
Copy link
Member Author

tlively commented May 1, 2024

So far this fixes the validator and adds a failing test, but does not actually fix GlobalRefining yet. Once GlobalRefining is fixed to refinalize global initializers, it will open up the possibility of further refining the globals whose initializers depend on previously refined globals. @kripken, do you think it is worth iterating to a fixed point in this pass?

@kripken
Copy link
Member

kripken commented May 1, 2024

Good find! Yeah, when we are missing validation then these bugs can be hard to figure out (and my guess at the cause here was way off...).

Iterating to a fixed point makes sense I think, unless there is some complexity I am missing.

@tlively
Copy link
Member Author

tlively commented May 20, 2024

Superseded by #6603

@tlively tlively closed this May 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Unsubtyping fuzz bug

3 participants