[wasm-opt] Assertion after parse exception crash: 'unknown misc operation' Error (version_122)

[erxiaozhou]

Description
Encountered a parsing crash when processing a valid WebAssembly file with wasm-opt. Details below:

Environment

• Binaryen version: version_122 (precompiled binary release)
• OS: Ubuntu 20.04
• Command used:

  wasm-opt working.wasm --all-features --debug -o tt.wasm

Error Log

Immediate crash occurs with this output:

reading...
reading binary from working.wasm
Loading working.wasm...
[parse exception: unknown misc operation (at 0:2506)]
Assertion failed: *currp (/src/src/wasm-traversal.h: pushTask: 286)
[1] 2134627 abort ./downloaded_release/binaryen-version_122/bin/wasm-opt -o tt.wasm --debug

Additional Context

• Attached repro file:

working.zip

• WASM generation toolchain: Generated by a fuzzer.

Would appreciate guidance on:

1. The root cause of the "unknown misc operation" error.
2. Whether specific flags are needed to handle this case

Thank you for your assistance!

[kripken]

The error is from here:

binaryen/src/wasm/wasm-binary.cpp

Line 3600 in 626e212

return Err{"unknown misc operation"};

The fuzz binary has the "misc" prefix (used by various post-MVP instructions) and an invalid code afterwards, so this errors.

Without --debug this looks perfectly correct to me - it errors and halts. It is weird that adding --debug leads to that assertion also being hit, since the error is a fatal one.

As this is just in --debug mode (a debug mode for developers) this is not a user-facing bug, but it would be good to understand what's going on. Let's leave this open for that.

[erxiaozhou]

The error is from here:

binaryen/src/wasm/wasm-binary.cpp

Line 3600 in 626e212

return Err{"unknown misc operation"};
The fuzz binary has the "misc" prefix (used by various post-MVP instructions) and an invalid code afterwards, so this errors.

Without --debug this looks perfectly correct to me - it errors and halts. It is weird that adding --debug leads to that assertion also being hit, since the error is a fatal one.

As this is just in --debug mode (a debug mode for developers) this is not a user-facing bug, but it would be good to understand what's going on. Let's leave this open for that.

Thank you for your assistance! However, I still have some confusion.
I use wasm-validate and the other wasm runtimes to verify the case is valid.
But wasm-opt fails to parse it. Does it mean wasm-opt cannot process some
valid case? Or is there a bug in wasm-opt's parsing? As someone just starting
with wasm-reduce and wasm-opt, I want to confirm if I'm missing fundamental
workflow knowledge here. Your guidance would help me a lot.

[kripken]

Yes, it is probably some instruction wasm-opt does not have support for yet. Looks like it is 0xfc 0x0d (misc prefix + 0x0d), which the spec says is elem.drop,

https://webassembly.github.io/spec/core/binary/instructions.html#table-instructions

[tlively]

#7209 tracks the implementation of elem.drop (or lack thereof).

[erxiaozhou]

Thank you!