Data segment overlaps

[jfbastien]

Data segments aren't well defined.

• If they overlap, does it fail?
• If so, what's the exception?
• When is it thrown? Some of these issues can be known at Module time (if it was an i32.const), and others at Instance time (if it was a global).
• If they're out of bounds, does it fail?

[binji]

This is specified in JS.md, but probably should be mentioned elsewhere too.

Segments may overlap and, if they do, the final value is the last value written in order.

If, after evaluating the offset initializer expression of every Data and Element Segment, any of the segments do not fit in their respective Memory or Table, throw a RangeError.

[jfbastien]

What if the initializer is a constant, and it's known at Module time that it's out of bounds? The failure still occurs at Instance time?

[jfbastien]

Oh also, what if there's a Data section but no memory (neither imported, nor in a section)?

[jfbastien]

I'm also not sure we specify that data segments are initialized before start is called.

[jfbastien]

Oh, and if linking fails, is an imported memory changed by data segments? Or do data segments get populated after link succeeds, but before start is called?

[jfbastien]

Oh and if initializing segments fails halfway, I assume it's visible up to when it failed? i.e. if the first segment is valid but the second isn't, then the first is set, second isn't?

And what if a segment is only partly valid? i.e. it starts in range but ends out of range. Do we see a partial write, or none of that segment's write? I'd rather not do partial, but that's what wasm does when executing.

[jfbastien]

Another one: what if there's an empty data section, and no memory (neither imported, nor memory section)? Is that an error at Module creation time?

[jfbastien]

This is fun. What if the memory exists but is zero-sized, and we initialize with an empty data segment?

[rossberg]

@jfbastien, have you checked the spec interpreter and test suite?

• If they overlap, does it fail?
• If so, what's the exception?
• When is it thrown? Some of these issues can be known at Module time (if it was an i32.const), and others at Instance time (if it was a global).

What @binji says, no failure (a new module could be linked in at any later time, so that would require engines to track what parts of tables have been initialised).

We are missing more tests for the element stuff. Contributions welcome.

• If they're out of bounds, does it fail?

Yes, that's a linking error. JS.md currently says it causes a RangeError, but see #889 for possible revision.

What if the initializer is a constant, and it's known at Module time that it's out of bounds? The failure still occurs at Instance time?

Yes, it's not worth making a special case and analysis for that.

Oh also, what if there's a Data section but no memory (neither imported, nor in a section)?

Validation error, see the the tests here:

https://github.com/WebAssembly/spec/blob/master/interpreter/test/memory.wast#L26

I'm also not sure we specify that data segments are initialized before start is called.
Oh, and if linking fails, is an imported memory changed by data segments? Or do data segments get populated after link succeeds, but before start is called?

Both JS.md and the interpreter are explicit that link-time type-checking is performed before initialisation. There is a simple test here that checks that the memory remains unchanged:

https://github.com/WebAssembly/spec/blob/master/interpreter/test/linking.wast#L232

Obviously, we could use more tests. Contributions welcome.

Oh and if initializing segments fails halfway, I assume it's visible up to when it failed? i.e. if the first segment is valid but the second isn't, then the first is set, second isn't?
And what if a segment is only partly valid? i.e. it starts in range but ends out of range. Do we see a partial write, or none of that segment's write? I'd rather not do partial, but that's what wasm does when executing.

JS.md specifies that bounds checks for all data and elem segments occur before any of them take effect:

If, after evaluating the offset initializer expression of every Data and Element Segment, any of the > segments do not fit in their respective Memory or Table, throw a RangeError.

Apply all Data and Element segments to their respective Memory or Table in the order in which they appear in the module.

The interpreter actually disagrees and evaluates them linearly, without prior checks. I'll change that to match JS.md.

Another one: what if there's an empty data section, and no memory (neither imported, nor memory section)? Is that an error at Module creation time?

Still a validation error, see the tests linked to above.

This is fun. What if the memory exists but is zero-sized, and we initialize with an empty data segment?

That's okay and implied by the wording, see also the test here:

https://github.com/WebAssembly/spec/blob/master/interpreter/test/memory.wast#L6

[rossberg]

Btw, the more interesting corner case is the one tested at

https://github.com/WebAssembly/spec/blob/master/interpreter/test/memory.wast#L67

It checks that a zero-size segment is okay even when it is completely out of bounds. The rationale there was that the check simply is supposed to rule out invalid memory writes, and this doesn't perform any. But arguably it would be cleaner to have a stricter check requiring that the end address is within bounds (which implies that the start address is). That's slightly simpler to test, too, so I'd suggest changing that.

[rossberg]

See WebAssembly/spec#399 for the bounds checks before mutation issue. Includes the corner case change pointed out in the previous comment.