Bug 252299 - [Wasm-GC] Uninitialized locals with GC types are not initialized to jsNull()
Summary: [Wasm-GC] Uninitialized locals with GC types are not initialized to jsNull()
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebAssembly (show other bugs)
Version: WebKit Local Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks: 247394
  Show dependency treegraph
 
Reported: 2023-02-14 22:49 PST by Tim Chevalier
Modified: 2023-02-16 11:57 PST (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tim Chevalier 2023-02-14 22:49:33 PST
The following test:

```
//@ runWebAssemblySuite("--useWebAssemblyTypedFunctionReferences=true", "--useWebAssemblyGC=true")

import * as assert from "../assert.js";
import { compile, instantiate } from "./wast-wrapper.js";

function module(bytes, valid = true) {
  let buffer = new ArrayBuffer(bytes.length);
  let view = new Uint8Array(buffer);
    for (let i = 0; i < bytes.length; ++i) {
        print(bytes.charCodeAt(i));
    view[i] = bytes.charCodeAt(i);
  }
  return new WebAssembly.Module(buffer);
}

function arrayGetUninitializedLocal() {

    let m = instantiate(`(module
      (type $a (array (mut i32)))
      (type $s (struct (field $x (mut i32)) (field $y (mut i64))))
      (func (export "arrayGetNull")
        (local (ref null $a)) (drop (array.get $a (local.get 0) (i32.const 0)))
      ))`);

     assert.throws(() => m.exports.arrayGetNull(), WebAssembly.RuntimeError, "array.get to a null reference");
}

arrayGetUninitializedLocal();
```

causes a segfault. This is because of the `LLIntGenerator::addLocal()` method, which only initializes funcref-typed and extern-ref typed locals to the JS null value; not those with struct or array types. It should handle all ref types in the same way.
Comment 1 Tim Chevalier 2023-02-14 23:06:54 PST
Pull request: https://github.com/WebKit/WebKit/pull/10133
Comment 2 EWS 2023-02-16 11:56:45 PST
Committed 260389@main (7ce4006e3d05): <https://commits.webkit.org/260389@main>

Reviewed commits have been landed. Closing PR #10133 and removing active labels.
Comment 3 Radar WebKit Bug Importer 2023-02-16 11:57:19 PST
<rdar://problem/105558525>