[Webkit-unassigned] [Bug 252299] New: [Wasm-GC] Uninitialized locals with GC types are not initialized to jsNull()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=252299

            Bug ID: 252299
           Summary: [Wasm-GC] Uninitialized locals with GC types are not
                    initialized to jsNull()
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebAssembly
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: tjc at igalia.com

The following test:

```
//@ runWebAssemblySuite("--useWebAssemblyTypedFunctionReferences=true", "--useWebAssemblyGC=true")

import * as assert from "../assert.js";
import { compile, instantiate } from "./wast-wrapper.js";

function module(bytes, valid = true) {
  let buffer = new ArrayBuffer(bytes.length);
  let view = new Uint8Array(buffer);
    for (let i = 0; i < bytes.length; ++i) {
        print(bytes.charCodeAt(i));
    view[i] = bytes.charCodeAt(i);
  }
  return new WebAssembly.Module(buffer);
}

function arrayGetUninitializedLocal() {

    let m = instantiate(`(module
      (type $a (array (mut i32)))
      (type $s (struct (field $x (mut i32)) (field $y (mut i64))))
      (func (export "arrayGetNull")
        (local (ref null $a)) (drop (array.get $a (local.get 0) (i32.const 0)))
      ))`);

     assert.throws(() => m.exports.arrayGetNull(), WebAssembly.RuntimeError, "array.get to a null reference");
}

arrayGetUninitializedLocal();
```

causes a segfault. This is because of the `LLIntGenerator::addLocal()` method, which only initializes funcref-typed and extern-ref typed locals to the JS null value; not those with struct or array types. It should handle all ref types in the same way.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230215/c6576f1f/attachment-0001.htm>