Bug 246049 - [Wasm-GC] Fix handling of recursive types using shorthand encoding
Summary: [Wasm-GC] Fix handling of recursive types using shorthand encoding
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebAssembly (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks: 247394
  Show dependency treegraph
 
Reported: 2022-10-04 16:20 PDT by Asumu Takikawa
Modified: 2022-11-30 12:21 PST (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Asumu Takikawa 2022-10-04 16:20:04 PDT
Recent Wasm GC patches added support for recursive types. There are different ways to encode a recursion group, and currently some shorthands are not handled correctly.

Examples (these test cases would go in `JSTests/wasm/gc/rec.js`):

```
  /*
   * This test needs to be in binary format, as it tests the specific encoding
   * of the recursion group. This one omits the explicit `rec`.
   *
   *  (module
   *    (rec (type (array (ref 0))))
   *    (func (result (ref null 0)) (ref.null 0)))
   */
  new WebAssembly.Instance(module("\x00\x61\x73\x6d\x01\x00\x00\x00\x01\x8a\x80\x80\x80\x00\x02\x5e\x6b\x00\x00\x60\x00\x01\x6c\x00\x03\x82\x80\x80\x80\x00\x01\x01\x0a\x8a\x80\x80\x80\x00\x
01\x84\x80\x80\x80\x00\x00\xd0\x00\x0b"))

  // Same test as above but using a non-shorthand encoding.
  new WebAssembly.Instance(module("\x00\x61\x73\x6d\x01\x00\x00\x00\x01\x8c\x80\x80\x80\x00\x02\x4f\x01\x5e\x6b\x00\x00\x60\x00\x01\x6c\x00\x03\x82\x80\x80\x80\x00\x01\x01\x0a\x8a\x80\x80\x80\x00\x01\x84\x80\x80\x80\x00\x00\xd0\x00\x0b"))
```

Currently the second example works as expected with no errors. It uses an explicit `rec` operator in the binary format ("\x4f"). The first example fails with a parse error, because the `rec` operator is left implicit in the binary format.

Error for first example:

```
Exception: CompileError: WebAssembly.Module doesn't parse at byte 18: can't get array's element Type (evaluating 'new WebAssembly.Module(buffer)')
```

This can be fixed by either uniformly representing all types as recursive groups when GC is turned on and parsing them as such, or by parsing structural types assuming the possibility that they will be recursive and adding a recursion group around them if recursion variable shows up in the type.
Comment 1 Asumu Takikawa 2022-10-06 19:18:08 PDT
Pull request: https://github.com/WebKit/WebKit/pull/5124
Comment 2 Radar WebKit Bug Importer 2022-10-11 16:21:17 PDT
<rdar://problem/101055691>
Comment 3 EWS 2022-10-12 17:43:46 PDT
Committed 255460@main (cc59ec0dd950): <https://commits.webkit.org/255460@main>

Reviewed commits have been landed. Closing PR #5124 and removing active labels.