Bug 254178

Summary: [Wasm-GC] Air assertion failure when casting to nullref
Product: WebKit Reporter: Tim Chevalier <tjc>
Component: WebAssemblyAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 247394    

Description Tim Chevalier 2023-03-20 13:23:01 PDT 
An existing test, https://searchfox.org/wubkat/source/JSTests/wasm/gc/casts.js , fails in the wasm-simd, wasm-bbq, and wasm-air configurations when running the run-jsc-stress-tests script. I'm not sure why the test isn't being run with these configurations in CI.

The output is:
```
wasm.yaml/wasm/gc/casts.js.wasm-simd: ASSERTION FAILED: isSubtype(src.type(), dst.type())
wasm.yaml/wasm/gc/casts.js.wasm-simd: /home/tjc/WebKit/Source/JavaScriptCore/wasm/WasmAirIRGenerator64.cpp(701) : void JSC::Wasm::AirIRGenerator64::emitMove(const JSC::Wasm::TypedTmp&, const JSC::Wasm::TypedTmp&)
```

and the specific test case causing the error is the first one in `testNullCasts()`:

```
        (func (param arrayref) (result nullref)
          (ref.cast none (local.get 0)))
```

I'll submit a PR.
Comment 1 EWS 2023-03-21 14:32:06 PDT 
Committed 261935@main (bd06994b39e7): <https://commits.webkit.org/261935@main>

Reviewed commits have been landed. Closing PR #11730 and removing active labels.
Comment 2 Radar WebKit Bug Importer 2023-03-21 14:33:15 PDT 
<rdar://problem/107021321>