cranelift: Prevent infinite loops in ssa frontend with unreachable code. #3258
Conversation
github-actions
bot
added
the
cranelift
|
This fixes the case of a block branching back to itself, but this code will still infinite loop if it walks into a cycle containing multiple blocks and the entire cycle is unreachable from the entry block. |
Perform a search over block predecessors trying to find loops of unreachable predecessors. We do this by iterating on predecessors and marking them as visited, stopping if we find a previously visited block or if we find a block with multiple predecessors. This issue was found by the CLIF fuzzer in bytecodealliance#3094.
|
That's true! And running the fuzzer again with this fix found a example of the situation that you were mentioning. I've change the approach somewhat, we now do a sort of graph search over predecessors. It is not a full search over all blocks, because we stop searching once we find a block with multiple predecessors. This avoids the situation where we have to visit all blocks in the function for every non local var lookup, which should help a lot with performance. The original algorithm can deal with these cases where we have multiple predecessors somewhere down the line of predecessors. I've run the fuzzer on this for the last 2 hours, and it seems to be working as intended. (The other examples were usually found within 5 min) |
4 participants
This issue was found by the CLIF fuzzer in #3094. There is a better description in this comment
It looks like all we need to do is not special case the single predecessor if the predecessor is itself. The normal path includes the operandless param, which is enough to stop the infinite looping.