RESOLVED FIXED 268870
[Wasm-GC] Fix handling of bottom type in struct ops
https://bugs.webkit.org/show_bug.cgi?id=268870
Summary [Wasm-GC] Fix handling of bottom type in struct ops
Asumu Takikawa
Reported 2024-02-06 15:57:39 PST
Some validation functions don't handle the bottom type (ref null none) or other types quite right due to assuming that a struct index is present. (values of the bottom type inhabit all of the concrete types) A test case: ``` diff --git a/JSTests/wasm/gc/structs.js b/JSTests/wasm/gc/structs.js index e1b24e9b1572..4a67c6748580 100644 --- a/JSTests/wasm/gc/structs.js +++ b/JSTests/wasm/gc/structs.js @@ -751,6 +751,19 @@ function testStructGet() { WebAssembly.RuntimeError, "struct.get to a null reference" ); + + // Bottom is type valid but throws due to null. + assert.throws( + () => instantiate(` + (module + (type (struct (field i32))) + (func (export "f") (result i32) + (struct.get 0 0 (ref.null none))) + ) + `).exports.f(), + WebAssembly.RuntimeError, + "struct.get to a null reference" + ); } ```
Attachments
Asumu Takikawa
Comment 1 2024-02-07 11:49:37 PST
EWS
Comment 2 2024-02-13 10:14:34 PST
Committed 274556@main (d27f9e79585d): <https://commits.webkit.org/274556@main> Reviewed commits have been landed. Closing PR #24019 and removing active labels.
Radar WebKit Bug Importer
Comment 3 2024-02-13 10:15:16 PST
Note You need to log in before you can comment on or make changes to this bug.