| Summary: | [Wasm-GC] Update element segments to account for typed funcrefs and GC types | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Tim Chevalier <tjc> |
| Component: | WebAssembly | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Local Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| See Also: |
https://bugs.webkit.org/show_bug.cgi?id=251041 https://bugs.webkit.org/show_bug.cgi?id=252349 |
||
| Bug Depends on: | |||
| Bug Blocks: | 247394, 253029 | ||
externrefs also aren't allowed in element segments, and should be: ``` (module (elem $elem0 externref (ref.null extern))) ``` fails with: ``` Exception: CompileError: WebAssembly.Module doesn't parse at byte 17: reftype in element section should be funcref (evaluating 'new WebAssembly.Module(binary)') ``` but is accepted by the reference interpreter. This should also work:
```
(module
(type $fty (func (result i32)))
(func $f (result i32)
(i32.const 2))
(elem $e (ref $fty) (ref.func $f)))
```
As it is, the element segment type is restricted to either `funcref` or `externref`.
Pull request: https://github.com/WebKit/WebKit/pull/21647 Committed 271952@main (7e71e7282468): <https://commits.webkit.org/271952@main> Reviewed commits have been landed. Closing PR #21647 and removing active labels. |
The following test: ``` function testElem() { let m = instantiate(` (module (type $bvec (array i8)) (elem $e (ref $bvec) (array.new_canon $bvec (i32.const 7) (i32.const 3))))`); } ``` fails with: ``` Exception: CompileError: WebAssembly.Module doesn't parse at byte 30: opcode for exp in element section's should be either ref.func or ref.null 0th element's 0th index (evaluating 'new WebAssembly.Module(binary)') ``` This is because `SectionParser::parseElementSegmentVectorOfExpressions()` requires the members of the elements vector to be either a `RefFunc` or `RefNull`. The test should compile (this is taken from https://github.com/WebAssembly/gc/blob/main/test/core/gc/array.wast#L203 ) A related bug is https://bugs.webkit.org/show_bug.cgi?id=251041 , but that one covers tables rather than element segments.