binaryen
binaryen copied to clipboard
wasm-as/wasm-dis seem to miscompile ref.null with type-index heap type
I've noticed some seemingly incorrect behavior in binaryen working with one of the cases from the br_if.wast
spec test on the wasm-3.0 branch:
(module
(type $t (func))
(func $f (param (ref null $t)) (result funcref) (local.get 0))
(func (result funcref)
(ref.null $t)
(i32.const 0)
(br_if 0) ;; only leaves funcref on the stack
(call $f)
)
)
(see https://github.com/WebAssembly/gc/issues/516 for discussion about this issue).
Using wasm-as
version 118 and building this with --enable-reference-types
and --enable-gc
, I notice:
- In the assembled binary,
ref.null $t
becomesd0 73
, which corresponds to(ref.null nofunc)
instead of(ref.null $t)
. - This test is expected to fail to validate, but
wasm-as
doesn't report a validation failure.
Likewise, disassembling the assembled binary from the spec tests:
\x00\x61\x73\x6d\x01\x00\x00\x00\x01\x8e\x80\x80\x80\x00\x03\x60\x00\x00\x60\x01\x63\x00\x01\x70\x60\x00\x01\x70\x03\x83\x80\x80\x80\x00\x02\x01\x02\x0a\x99\x80\x80\x80\x00\x02\x84\x80\x80\x80\x00\x00\x20\x00\x0b\x8a\x80\x80\x80\x00\x00\xd0\x00\x41\x00\x0d\x00\x10\x00\x0b
(I typically use echo -ne "\x00\x61\x73\x6d..."
to convert this to binary)
...wasm-dis
disassembles the ref.null
in this binary, encoded as d0 00
, as (ref.null nofunc)
. Instead, I think heap type 00
should be interpreted as a type index.