WebKit Bugzilla
New
Browse
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
RESOLVED FIXED
268870
[Wasm-GC] Fix handling of bottom type in struct ops
https://bugs.webkit.org/show_bug.cgi?id=268870
Summary
[Wasm-GC] Fix handling of bottom type in struct ops
Asumu Takikawa
Reported
2024-02-06 15:57:39 PST
Some validation functions don't handle the bottom type (ref null none) or other types quite right due to assuming that a struct index is present. (values of the bottom type inhabit all of the concrete types) A test case: ``` diff --git a/JSTests/wasm/gc/structs.js b/JSTests/wasm/gc/structs.js index e1b24e9b1572..4a67c6748580 100644 --- a/JSTests/wasm/gc/structs.js +++ b/JSTests/wasm/gc/structs.js @@ -751,6 +751,19 @@ function testStructGet() { WebAssembly.RuntimeError, "struct.get to a null reference" ); + + // Bottom is type valid but throws due to null. + assert.throws( + () => instantiate(` + (module + (type (struct (field i32))) + (func (export "f") (result i32) + (struct.get 0 0 (ref.null none))) + ) + `).exports.f(), + WebAssembly.RuntimeError, + "struct.get to a null reference" + ); } ```
Attachments
Add attachment
proposed patch, testcase, etc.
Asumu Takikawa
Comment 1
2024-02-07 11:49:37 PST
Pull request:
https://github.com/WebKit/WebKit/pull/24019
EWS
Comment 2
2024-02-13 10:14:34 PST
Committed
274556@main
(d27f9e79585d): <
https://commits.webkit.org/274556@main
> Reviewed commits have been landed. Closing PR #24019 and removing active labels.
Radar WebKit Bug Importer
Comment 3
2024-02-13 10:15:16 PST
<
rdar://problem/122890975
>
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug