moonbitlang / core / 4727

91%

Build Type

push

github

Committed by bobzhang

Commit Message

Fix replace_lane corrupting a high lane on negative indices

i8x16/i16x8/i32x4_replace_lane guarded the low-half branch with
`lane >= 0 && lane < N/2` but the high-half branch with only `lane < N`.
A negative lane therefore skipped the first branch and still satisfied the
second, splicing `replacement` into a high-word lane instead of leaving the
value unchanged (e.g. i8x16_replace_lane(v, x, -1) rewrote lane 15, since
(-1 & 7) = 7). v128_load{8,16,32}_lane inherit this via delegation. The
positive out-of-range case was already a correct no-op; only negatives
leaked. (i64x2_replace_lane was unaffected -- it uses exact == checks.)

Lower-bound the high-half branch (e.g. `lane >= 8 && lane < 16`) so any
out-of-range index falls through to the unchanged `else value`, matching
the documented contract. Add a regression test over negative and
too-large runtime lane indices (runtime lane forces the fallback path on
every backend).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Coverage Stats

3 of 3 new or added lines in 1 file covered. (100.0%)

1 existing line in 1 file now uncovered.

15154 of 16661 relevant lines covered (90.95%)

197378.29 hits per line