Skip to content

Fix UB in SIMD dot product arithmetic #8234

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stevenfontanella merged 1 commit into from
Jan 27, 2026
+18 −7
Merged

Fix UB in SIMD dot product arithmetic #8234

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions scripts/test/shared.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -462,9 +462,6 @@ def get_tests(test_dir, extensions=[], recursive=False):
'simd_f64x2.wast', # Min of 0 and NaN should give a canonical NaN
'simd_f64x2_arith.wast', # Adding inf and -inf should give a canonical NaN
'simd_f64x2_rounding.wast', # Ceil of NaN should give a canonical NaN
'simd_i32x4_cmp.wast', # UBSan error on integer overflow
'simd_i32x4_arith2.wast', # UBSan error on integer overflow
'simd_i32x4_dot_i16x8.wast', # UBSan error on integer overflow
'token.wast', # Lexer should require spaces between strings and non-paren tokens
]

Expand Down
9 changes: 5 additions & 4 deletions src/wasm/literal.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1161,9 +1161,9 @@ Literal Literal::demote() const {
Literal Literal::add(const Literal& other) const {
switch (type.getBasic()) {
case Type::i32:
return Literal(uint32_t(i32) + uint32_t(other.i32));
return Literal(bit_cast<uint32_t>(i32) + bit_cast<uint32_t>(other.i32));
Copy link
Member

@kripken kripken Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am getting en.cppreference.com took too long to respond so I can't read the docs on this, but is bit_cast not from a pretty recent C++ version? Is it not too new?

Copy link
Member Author

@stevenfontanella stevenfontanella Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bit_cast is from C++20 but we polyfill it with our own implementation: link. utilities.h is included in this file and bit_cast is already used in other places in this file.

Copy link
Member

@kripken kripken Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good, thanks.

case Type::i64:
return Literal(uint64_t(i64) + uint64_t(other.i64));
return Literal(bit_cast<uint64_t>(i64) + bit_cast<uint64_t>(other.i64));
case Type::f32:
return standardizeNaN(Literal(getf32() + other.getf32()));
case Type::f64:
Expand Down Expand Up @@ -1408,6 +1408,8 @@ Literal Literal::maxUInt(const Literal& other) const {
}

Literal Literal::avgrUInt(const Literal& other) const {
// This looks like it could overflow, but these are promoted from uint8 in the
// caller (`binary`).
return Literal((geti32() + other.geti32() + 1) / 2);
}

Expand Down Expand Up @@ -2652,8 +2654,7 @@ static Literal dot(const Literal& left, const Literal& right) {
for (size_t i = 0; i < Lanes; ++i) {
result[i] = Literal(int32_t(0));
for (size_t j = 0; j < Factor; ++j) {
result[i] = Literal(result[i].geti32() + lhs[i * Factor + j].geti32() *
rhs[i * Factor + j].geti32());
result[i] = result[i].add(lhs[i * Factor + j].mul(rhs[i * Factor + j]));
}
}
return Literal(result);
Expand Down
13 changes: 13 additions & 0 deletions test/lit/exec/simd.wast
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,12 +23,25 @@
(i64.const -4611686018427387904)
)
)

;; CHECK: [fuzz-exec] calling i8x16.avgr_u
;; CHECK-NEXT: [fuzz-exec] note result: i8x16.avgr_u => i32x4 0x80808080 0x80808080 0x80808080 0x80808080
(func $i8x16.avgr_u (export "i8x16.avgr_u") (result v128)
(i8x16.avgr_u
(v128.const i8x16 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128)
(v128.const i8x16 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128 -128)
)
)
)

;; CHECK: [fuzz-exec] calling load8x8_s
;; CHECK-NEXT: [fuzz-exec] note result: load8x8_s => i32x4 0x00620061 0x00640063 0x00660065 0x00000067

;; CHECK: [fuzz-exec] calling load32x2_u
;; CHECK-NEXT: [trap final > memory: 13835058055282163712 > 1048576]

;; CHECK: [fuzz-exec] calling i8x16.avgr_u
;; CHECK-NEXT: [fuzz-exec] note result: i8x16.avgr_u => i32x4 0x80808080 0x80808080 0x80808080 0x80808080
;; CHECK-NEXT: [fuzz-exec] comparing i8x16.avgr_u
;; CHECK-NEXT: [fuzz-exec] comparing load32x2_u
;; CHECK-NEXT: [fuzz-exec] comparing load8x8_s
Loading