binaryen icon indicating copy to clipboard operation
binaryen copied to clipboard

wasm-as/wasm-dis seem to miscompile ref.null with type-index heap type

Open ddegazio opened this issue 6 months ago • 8 comments

I've noticed some seemingly incorrect behavior in binaryen working with one of the cases from the br_if.wast spec test on the wasm-3.0 branch:

(module
  (type $t (func))
  (func $f (param (ref null $t)) (result funcref) (local.get 0))
  (func (result funcref)
    (ref.null $t)
    (i32.const 0)
    (br_if 0)  ;; only leaves funcref on the stack
    (call $f)
  )
)

(see https://github.com/WebAssembly/gc/issues/516 for discussion about this issue).

Using wasm-as version 118 and building this with --enable-reference-types and --enable-gc, I notice:

  1. In the assembled binary, ref.null $t becomes d0 73, which corresponds to (ref.null nofunc) instead of (ref.null $t).
  2. This test is expected to fail to validate, but wasm-as doesn't report a validation failure.

Likewise, disassembling the assembled binary from the spec tests:

\x00\x61\x73\x6d\x01\x00\x00\x00\x01\x8e\x80\x80\x80\x00\x03\x60\x00\x00\x60\x01\x63\x00\x01\x70\x60\x00\x01\x70\x03\x83\x80\x80\x80\x00\x02\x01\x02\x0a\x99\x80\x80\x80\x00\x02\x84\x80\x80\x80\x00\x00\x20\x00\x0b\x8a\x80\x80\x80\x00\x00\xd0\x00\x41\x00\x0d\x00\x10\x00\x0b

(I typically use echo -ne "\x00\x61\x73\x6d..." to convert this to binary)

...wasm-dis disassembles the ref.null in this binary, encoded as d0 00, as (ref.null nofunc). Instead, I think heap type 00 should be interpreted as a type index.

ddegazio avatar Aug 21 '24 18:08 ddegazio