Bug 252299

Summary: [Wasm-GC] Uninitialized locals with GC types are not initialized to jsNull()
Product: WebKit Reporter: Tim Chevalier <tjc>
Component: WebAssemblyAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 247394    

Description Tim Chevalier 2023-02-14 22:49:33 PST
The following test:

```
//@ runWebAssemblySuite("--useWebAssemblyTypedFunctionReferences=true", "--useWebAssemblyGC=true")

import * as assert from "../assert.js";
import { compile, instantiate } from "./wast-wrapper.js";

function module(bytes, valid = true) {
  let buffer = new ArrayBuffer(bytes.length);
  let view = new Uint8Array(buffer);
    for (let i = 0; i < bytes.length; ++i) {
        print(bytes.charCodeAt(i));
    view[i] = bytes.charCodeAt(i);
  }
  return new WebAssembly.Module(buffer);
}

function arrayGetUninitializedLocal() {

    let m = instantiate(`(module
      (type $a (array (mut i32)))
      (type $s (struct (field $x (mut i32)) (field $y (mut i64))))
      (func (export "arrayGetNull")
        (local (ref null $a)) (drop (array.get $a (local.get 0) (i32.const 0)))
      ))`);

     assert.throws(() => m.exports.arrayGetNull(), WebAssembly.RuntimeError, "array.get to a null reference");
}

arrayGetUninitializedLocal();
```

causes a segfault. This is because of the `LLIntGenerator::addLocal()` method, which only initializes funcref-typed and extern-ref typed locals to the JS null value; not those with struct or array types. It should handle all ref types in the same way.
Comment 1 Tim Chevalier 2023-02-14 23:06:54 PST
Pull request: https://github.com/WebKit/WebKit/pull/10133
Comment 2 EWS 2023-02-16 11:56:45 PST
Committed 260389@main (7ce4006e3d05): <https://commits.webkit.org/260389@main>

Reviewed commits have been landed. Closing PR #10133 and removing active labels.
Comment 3 Radar WebKit Bug Importer 2023-02-16 11:57:19 PST
<rdar://problem/105558525>