Bug 243265 - [WASM-Function-References] Assertion failure when a function returns (ref <idx>) to JS
Summary: [WASM-Function-References] Assertion failure when a function returns (ref <id...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebAssembly (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks: 247393
  Show dependency treegraph
 
Reported: 2022-07-27 14:12 PDT by Asumu Takikawa
Modified: 2022-11-02 17:08 PDT (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Asumu Takikawa 2022-07-27 14:12:31 PDT
A test case like the following will currently raise an assertion error:

```
//@ runWebAssemblySuite("--useWebAssemblyTypedFunctionReferences=true", "--useWebAssemblyGC=false")

import * as assert from "../assert.js";
import { compile, instantiate } from "./wast-wrapper.js";

let m1 = instantiate(`
  (module
    (type (func))
    (type (func (result (ref 0))))
    (elem declare funcref (ref.func 0))
    (func)
    (func (export "f") (type 1) (ref.func 0))
  )
`);

instantiate(`
  (module
    (type (func))
    (type (func (result (ref 0))))
    (func (import "m" "f") (type 1))
  )
`, { m: { f: m1.exports.f } });
```

This will instead raise a parse error if typed funcrefs are turned off (the default).

The assertion failure comes from a ref-with-index type not being supported in `WasmToJS.cpp` in processing the result of an exported Wasm function. I think it should be possible to support this case, it just requires checking if the type index points to a function signature or not. For non-function signatures, it should probably error for now.
Comment 1 Asumu Takikawa 2022-08-03 11:24:20 PDT
Pull request: https://github.com/WebKit/WebKit/pull/2983
Comment 2 Radar WebKit Bug Importer 2022-08-03 14:13:16 PDT
<rdar://problem/98075013>
Comment 3 EWS 2022-08-24 11:47:47 PDT
Committed 253734@main (0c946f31a451): <https://commits.webkit.org/253734@main>

Reviewed commits have been landed. Closing PR #2983 and removing active labels.