From ff4a7ff4f9ee1c75bd52353e8f5a5fd000a78d03 Mon Sep 17 00:00:00 2001
From: Takeshi Yoneda <takeshi@tetrate.io>
Date: Fri, 15 Jul 2022 16:07:49 +0900
Subject: [PATCH] interpreter: fixes i32x4/i16x8 bit mask (#704)

Signed-off-by: Takeshi Yoneda <takeshi@tetrate.io>
---
 internal/engine/interpreter/interpreter.go    |   8 +++---
 .../fuzzcases/fuzzcases_test.go               |  23 ++++++++++++++++++
 .../fuzzcases/testdata/704.wasm               | Bin 0 -> 77 bytes
 .../fuzzcases/testdata/704.wat                |  12 +++++++++
 4 files changed, 39 insertions(+), 4 deletions(-)
 create mode 100644 internal/integration_test/fuzzcases/testdata/704.wasm
 create mode 100644 internal/integration_test/fuzzcases/testdata/704.wat

diff --git a/internal/engine/interpreter/interpreter.go b/internal/engine/interpreter/interpreter.go
index 75cbdbcc..283163eb 100644
--- a/internal/engine/interpreter/interpreter.go
+++ b/internal/engine/interpreter/interpreter.go
@@ -2429,23 +2429,23 @@ func (ce *callEngine) callNativeFunc(ctx context.Context, callCtx *wasm.CallCont
 				}
 			case wazeroir.ShapeI16x8:
 				for i := 0; i < 4; i++ {
-					if int8(lo>>(i*16)) < 0 {
+					if int16(lo>>(i*16)) < 0 {
 						res |= 1 << i
 					}
 				}
 				for i := 0; i < 4; i++ {
-					if int8(hi>>(i*16)) < 0 {
+					if int16(hi>>(i*16)) < 0 {
 						res |= 1 << (i + 4)
 					}
 				}
 			case wazeroir.ShapeI32x4:
 				for i := 0; i < 2; i++ {
-					if int8(lo>>(i*32)) < 0 {
+					if int32(lo>>(i*32)) < 0 {
 						res |= 1 << i
 					}
 				}
 				for i := 0; i < 2; i++ {
-					if int8(hi>>(i*32)) < 0 {
+					if int32(hi>>(i*32)) < 0 {
 						res |= 1 << (i + 2)
 					}
 				}
diff --git a/internal/integration_test/fuzzcases/fuzzcases_test.go b/internal/integration_test/fuzzcases/fuzzcases_test.go
index 1eb28c35..51a2e530 100644
--- a/internal/integration_test/fuzzcases/fuzzcases_test.go
+++ b/internal/integration_test/fuzzcases/fuzzcases_test.go
@@ -21,6 +21,8 @@ var (
 	case699 []byte
 	//go:embed testdata/701.wasm
 	case701 []byte
+	//go:embed testdata/704.wasm
+	case704 []byte
 )
 
 func newRuntimeCompiler() wazero.Runtime {
@@ -142,3 +144,24 @@ func Test701(t *testing.T) {
 		})
 	}
 }
+
+func Test704(t *testing.T) {
+	if !platform.CompilerSupported() {
+		return
+	}
+
+	for _, tc := range []struct {
+		name string
+		r    wazero.Runtime
+	}{
+		{name: "compiler", r: newRuntimeCompiler()},
+		{name: "interpreter", r: newRuntimeInterpreter()},
+	} {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			defer tc.r.Close(ctx)
+			_, err := tc.r.InstantiateModuleFromBinary(ctx, case704)
+			require.NoError(t, err)
+		})
+	}
+}
diff --git a/internal/integration_test/fuzzcases/testdata/704.wasm b/internal/integration_test/fuzzcases/testdata/704.wasm
new file mode 100644
index 0000000000000000000000000000000000000000..3e476eb8852fb672f7e4f958dea29b686c8bd3fa
GIT binary patch
literal 77
zcmZQbEY4+QU|?WmVN76PU}j=u;9z9nGGjDh_{;O30TupT!pP#lz>P(s1uVf000sva
A`~Uy|

literal 0
HcmV?d00001

diff --git a/internal/integration_test/fuzzcases/testdata/704.wat b/internal/integration_test/fuzzcases/testdata/704.wat
new file mode 100644
index 00000000..3906166a
--- /dev/null
+++ b/internal/integration_test/fuzzcases/testdata/704.wat
@@ -0,0 +1,12 @@
+(module
+  (func
+    v128.const i8x16 0xff 0x00 0xff 0x00 0xff 0x00 0xff 0x00 0xff 0x00 0xff 0x00 0xff 0x00 0xff 0x00
+    i32x4.bitmask ;; if this checks as i8x16 lane, the result here becomes non-zero, therefore unreachable.
+    (if (then unreachable))
+
+    v128.const i8x16 0xff 0x00 0xff 0x00 0xff 0x00 0xff 0x00 0xff 0x00 0xff 0x00 0xff 0x00 0xff 0x00
+    i16x8.bitmask ;; if this treats as i8x16 lane, the result here becomes non-zero, therefore unreachable.
+    (if (then unreachable))
+  )
+  (start 0)
+)