WebAssembly / WebAssembly/binaryen
wasm-as/wasm-dis seem to miscompile ref.null with type-index heap type
@tlively is already working on this.
Since Aug 21, 2024.
- Dominant language
- WebAssembly
- Stars
- 8.6k
- Forks
- 885
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 69
Description
I've noticed some seemingly incorrect behavior in binaryen working with one of the cases from the br_if.wast spec test on the wasm-3.0 branch:
(module
(type $t (func))
(func $f (param (ref null $t)) (result funcref) (local.get 0))
(func (result funcref)
(ref.null $t)
(i32.const 0)
(br_if 0) ;; only leaves funcref on the stack
(call $f)
)
)
(see https://github.com/WebAssembly/gc/issues/516 for discussion about this issue).
Using wasm-as version 118 and building this with --enable-reference-types and --enable-gc, I notice:
- In the assembled binary,
ref.null $tbecomesd0 73, which corresponds to(ref.null nofunc)instead of(ref.null $t). - This test is expected to fail to validate, but
wasm-asdoesn't report a validation failure.
Likewise, disassembling the assembled binary from the spec tests:
\x00\x61\x73\x6d\x01\x00\x00\x00\x01\x8e\x80\x80\x80\x00\x03\x60\x00\x00\x60\x01\x63\x00\x01\x70\x60\x00\x01\x70\x03\x83\x80\x80\x80\x00\x02\x01\x02\x0a\x99\x80\x80\x80\x00\x02\x84\x80\x80\x80\x00\x00\x20\x00\x0b\x8a\x80\x80\x80\x00\x00\xd0\x00\x41\x00\x0d\x00\x10\x00\x0b
(I typically use echo -ne "\x00\x61\x73\x6d..." to convert this to binary)
...wasm-dis disassembles the ref.null in this binary, encoded as d0 00, as (ref.null nofunc). Instead, I think heap type 00 should be interpreted as a type index.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.