Bug 268870
Summary: | [Wasm-GC] Fix handling of bottom type in struct ops | ||
---|---|---|---|
Product: | WebKit | Reporter: | Asumu Takikawa <asumu> |
Component: | WebAssembly | Assignee: | Nobody <webkit-unassigned> |
Status: | RESOLVED FIXED | ||
Severity: | Normal | CC: | webkit-bug-importer |
Priority: | P2 | Keywords: | InRadar |
Version: | WebKit Nightly Build | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Bug Depends on: | |||
Bug Blocks: | 247394 |
Asumu Takikawa
Some validation functions don't handle the bottom type (ref null none) or other types quite right due to assuming that a struct index is present.
(values of the bottom type inhabit all of the concrete types)
A test case:
```
diff --git a/JSTests/wasm/gc/structs.js b/JSTests/wasm/gc/structs.js
index e1b24e9b1572..4a67c6748580 100644
--- a/JSTests/wasm/gc/structs.js
+++ b/JSTests/wasm/gc/structs.js
@@ -751,6 +751,19 @@ function testStructGet() {
WebAssembly.RuntimeError,
"struct.get to a null reference"
);
+
+ // Bottom is type valid but throws due to null.
+ assert.throws(
+ () => instantiate(`
+ (module
+ (type (struct (field i32)))
+ (func (export "f") (result i32)
+ (struct.get 0 0 (ref.null none)))
+ )
+ `).exports.f(),
+ WebAssembly.RuntimeError,
+ "struct.get to a null reference"
+ );
}
```
Attachments | ||
---|---|---|
Add attachment proposed patch, testcase, etc. |
Asumu Takikawa
Pull request: https://github.com/WebKit/WebKit/pull/24019
EWS
Committed 274556@main (d27f9e79585d): <https://commits.webkit.org/274556@main>
Reviewed commits have been landed. Closing PR #24019 and removing active labels.
Radar WebKit Bug Importer
<rdar://problem/122890975>