WebAssembly / WebAssembly/wabt

Type funcref crash due to ref type getting read as "any" type instead of a ref type

Open
#1,881 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
8.1k
Forks
827
Avg merge
4d 6h
Merged PRs (30d)
18

Description

A test like the following currently crashes in type-checking:

;;; TOOL: wat2wasm
;;; ARGS: --enable-function-references
;;; ERROR: 1
(module
  (type $f32-f32-1 (func (param f32) (result f32)))
  (type $f32-f32-2 (func (param f32) (result f32)))

  (func $foo (param $f (ref $f32-f32-1)) (result f32)
    (call_ref (f32.const 42.0) (local.get $f))
  )

  (func $bar (type $f32-f32-2)
    (f32.const 1.0)
  )

  (func (export "main") (result f32)
    ;; $f32-f32-1 and $f32-f32-2 should be equal
    (call $foo (ref.func $bar))
  )

  (elem declare funcref (ref.func $bar))
)

(;; STDERR ;;;
;;; STDERR ;;)

Error:

- test/typecheck/funcref-equality.txt (roundtrip)                                   
  b'Signal raised running "wat2wasm": SIGABRT\nwat2wasm: ../../../src/type.h:132: wabt::Index wabt::Type::GetReferenceIndex() const: Assertion `enum_ == Enum::Reference\' failed.\n'

I think the immediate reason is that type checking should account for subtyping, and make sure to compare heap types instead of assuming all reference types have an index (i.e., are a "concrete reference type" as described in the GC spec).

More generally, I think the type-checker needs to also be extended to look at the type section (or a more abstract "type store") to look up type indices when checking equality of concrete types. Alternatively, concrete ref types should be stored pre-canonicalized as a pointer (this would depend on https://github.com/WebAssembly/wabt/pull/1828) to a representative type in the canonicalized type store.

These are all needed eventually for GC support too.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with test/typecheck/funcref-equality.txt and reproduce the wat2wasm crash using the function-references example. Read src/type.h around Type::GetReferenceIndex() and trace the type-checking path that compares the two function reference types. Done means the test no longer aborts and equivalent reference types are checked correctly, including the stated subtyping and type-index considerations.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.