WebAssembly / WebAssembly/wabt
Type funcref crash due to ref type getting read as "any" type instead of a ref type
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 8.1k
- Forks
- 827
- Avg merge
- 4d 6h
- Merged PRs (30d)
- 18
Description
A test like the following currently crashes in type-checking:
;;; TOOL: wat2wasm
;;; ARGS: --enable-function-references
;;; ERROR: 1
(module
(type $f32-f32-1 (func (param f32) (result f32)))
(type $f32-f32-2 (func (param f32) (result f32)))
(func $foo (param $f (ref $f32-f32-1)) (result f32)
(call_ref (f32.const 42.0) (local.get $f))
)
(func $bar (type $f32-f32-2)
(f32.const 1.0)
)
(func (export "main") (result f32)
;; $f32-f32-1 and $f32-f32-2 should be equal
(call $foo (ref.func $bar))
)
(elem declare funcref (ref.func $bar))
)
(;; STDERR ;;;
;;; STDERR ;;)
Error:
- test/typecheck/funcref-equality.txt (roundtrip)
b'Signal raised running "wat2wasm": SIGABRT\nwat2wasm: ../../../src/type.h:132: wabt::Index wabt::Type::GetReferenceIndex() const: Assertion `enum_ == Enum::Reference\' failed.\n'
I think the immediate reason is that type checking should account for subtyping, and make sure to compare heap types instead of assuming all reference types have an index (i.e., are a "concrete reference type" as described in the GC spec).
More generally, I think the type-checker needs to also be extended to look at the type section (or a more abstract "type store") to look up type indices when checking equality of concrete types. Alternatively, concrete ref types should be stored pre-canonicalized as a pointer (this would depend on https://github.com/WebAssembly/wabt/pull/1828) to a representative type in the canonicalized type store.
These are all needed eventually for GC support too.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with test/typecheck/funcref-equality.txt and reproduce the wat2wasm crash using the function-references example. Read src/type.h around Type::GetReferenceIndex() and trace the type-checking path that compares the two function reference types. Done means the test no longer aborts and equivalent reference types are checked correctly, including the stated subtyping and type-index considerations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100