fix(#378): fail honestly on out-of-layout local — never guess a frame offset - #379
Merged
Conversation
… offset select_with_stack's LocalGet/LocalSet/LocalTee handlers, when a local was absent from the computed frame layout, fell through to a GUESSED stack offset `(local_idx-4)*4` (the pre-#204/#223 layout). Under the current compute_local_layout that guess is wrong, so if the branch ever fired (layout bug or malformed wasm past validation) it silently emitted a load/store to the wrong slot — the same silent-miscompile class as the decoder `_ => None` (#369/#374) and the encoder index-drop (#206). Replace all three guesses with a loud Err (loud-skips the function), naming the local index — the GI-FPU-001 / #180 "never emit plausible-but-wrong output" contract. Frozen-safe: the branch is dead on valid input (every declared local is in the layout), so the three fixtures stay bit-identical (control_step 0x00210A55, flight_seam 0x07FDF307, div_const 338/338) and the full workspace suite is green with NO test triggering the new Err — confirming it was unreachable defensive code that could only ever have silently miscompiled. No cycle/size delta; this is correctness/honesty hardening, not an optimization. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #378.
Fail honestly, never guess
select_with_stack'sLocalGet/LocalSet/LocalTeehandlers emitted a guessed stack offset(local_idx-4)*4for a local absent from the computed frame layout ("shouldn't happen for valid wasm, fall back to legacy behaviour"). That guess is the pre-#204/#223 layout — wrong under the currentcompute_local_layout— so if the branch ever fired it would silently load/store the wrong stack slot rather than fail. Same silent-miscompile family as the decoder_ => None(#369/#374) and the encoder index-drop (#206).All three sites now return a loud
Err(loud-skips the function), naming the local index — the GI-FPU-001 / #180 "never emit plausible-but-wrong output" contract.Verification
0x00210A55, flight_seam0x07FDF307, div_const 338/338 (the branch is dead on valid input, so no emitted code changes).cargo test --workspace --exclude synth-verify) with no test triggering the newErr— proving the path was unreachable defensive code that could only ever have silently miscompiled.No cycle/size delta — this is correctness/honesty hardening, not an optimization (which is why it's not an oracle-gate cleanup filing). One reversible change, three symmetric sites.
🤖 Generated with Claude Code