Skip to content

Bug: Function inlining produces invalid WASM #31

@avrabe

Description

@avrabe

Problem

The inline optimization pass produces invalid WASM that fails validation.

Reproduction

# Test with simple file
python3 /tmp/test_idempotence.py /tmp/test_inline.wasm --passes inline

Result:

  • Input: 83 bytes, ✅ valid
  • Output: 108 bytes, ❌ INVALID
  • Error: type mismatch: values remaining on stack at end of block (at offset 0x59)

Test Case

(module
  (func $add_two (param $x i32) (result i32)
    local.get $x
    i32.const 2
    i32.add
  )
  
  (func $main (param $a i32) (result i32)
    local.get $a
    call $add_two  ;; This gets inlined incorrectly
    call $add_two
  )
  
  (export "main" (func $main))
)

Root Cause

The inline pass (from PR #29) has a bug in stack management:

  1. ✅ Correctly identifies inlining opportunities
  2. ✅ Substitutes function body at call site
  3. Leaves extra values on stack or corrupts stack discipline

Impact

Severity: HIGH

  • Affects loom.wasm self-optimization
  • Produces invalid WASM that cannot be executed
  • All other 9 optimization passes work correctly

Systematic Test Results

Pass Valid Output Idempotent
inline
precompute
constant-folding
cse
advanced
branches
dce
merge-blocks
vacuum
simplify-locals

See Issue #30 for full test methodology.

Recommendation

Immediate action: Disable inline pass by default until fixed.

// In optimize_module, comment out inline pass:
// loom_core::optimize::inline_functions(&mut module)?;

Related

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions