Skip to content

Validator accepts stray else with no matching if #170

Description

@myint

#169 found this validation difference between SpaceWasm and Wasmi. Below is Claude's reproduction of the bug as a regression test.

diff --git a/tests/regression/decode-errors.wast b/tests/regression/decode-errors.wast
index f0da065..f06d318 100644
--- a/tests/regression/decode-errors.wast
+++ b/tests/regression/decode-errors.wast
@@ -149,3 +149,16 @@
         (then
           (unreachable)))))
   "result-typed if without else")
+
+;; ---------------------------------------------------------------------------
+;; An `else` opcode (0x05) with no enclosing `if` is invalid and must be
+;; rejected. wat cannot express a stray `else`, so the upstream suite never
+;; covers it; a differential-validation fuzzer (SpaceWasm vs wasmi) found that
+;; SpaceWasm used to accept this and mis-compile the `else` into a branch to the
+;; block end. Regression for that fix.
+;; type (id 1): [] -> []   func (id 3): type 0
+;; code (id 10): one body = `else end`  (0x05 0x0b)
+;; ---------------------------------------------------------------------------
+(assert_invalid
+  (module binary "\00asm\01\00\00\00\01\04\01\60\00\00\03\02\01\00\0a\05\01\03\00\05\0b")
+  "else without matching if")
diff --git a/tests/util/spectest.rs b/tests/util/spectest.rs
index 258489a..66dc526 100644
--- a/tests/util/spectest.rs
+++ b/tests/util/spectest.rs
@@ -947,6 +947,7 @@ fn check_decode_error(err: ParseError, text: String) {
         }
         (ValidationError::TypeMismatch, "type mismatch") => {}
         (ValidationError::BlockResultTypeMismatch, "type mismatch") => {}
+        (ValidationError::InvalidElseBlock, "else without matching if") => {}
         (ValidationError::InvalidLabelIndex, "unknown label") => {}
         (ValidationError::MalformedSectionSize, "unexpected end") => {}
         (ValidationError::GlobalIdxOutOfRange, "unknown global") => {}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions