Bug 293107 – Wasm module compile error when a function contains `ref.null` after `return`

• Status: RESOLVED
• Resolution: FIXED
• Component: WebAssembly

Created attachment 475263 [details]
return_ref_null.js

Commit version: 9d02067f5de4b0402f58d6c83039e206439a8a8c
System: Ubuntu 20.04.6 LTS, x86_64

The following Wasm module contains three types and a function that includes `ref.null` after `return`.
```
;; return_ref_null.wat
(module
  (type $0 (func))
  (type $1 (func))
  (type $2 (func))
  (func
    (return)
    (ref.null $2)
    (drop)
  )
)
```
It is a valid Wasm module, so it must succeed to parse and validate.
However, when running `return_ref_null.js`, the equivalent JavaScript file, JavaScriptCore raises compile error.

```
$ jsc return_ref_null.js
Exception: Error: Wasm validate failure
module@return_ref_null.js:64:20
global code@return_ref_null.js:215:17
--> CompileError: WebAssembly.Module doesn't parse at byte 5: can't get inline type for Block in unreachable context, in function at index 0
```

The bug is reproduced only when there are at least 3 types.

Oh, I forgot to mention one thing.
The compile error occurs when`ref.null` has immediate with type index larger than 2.

Additionally note: It doesn't have to be `return`. Same bug happens when `ref.null`  appears after `br`, `unreachable`, and `throw_ref`.

[Radar WebKit Bug Importer]

<rdar://problem/151905390>

[Sosuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/46164

[EWS]

Committed 295644@main (d8a5f39bad4f): <https://commits.webkit.org/295644@main>

Reviewed commits have been landed. Closing PR #46164 and removing active labels.