[Webkit-unassigned] [Bug 252719] New: [Wasm-GC] Air and B3 generate struct.get/set code with wrong offsets

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=252719

            Bug ID: 252719
           Summary: [Wasm-GC] Air and B3 generate struct.get/set code with
                    wrong offsets
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebAssembly
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: tjc at igalia.com

The following test:

```
//@ runWebAssemblySuite("--useWebAssemblyTypedFunctionReferences=true", "--useWebAssemblyGC=true")

import * as assert from "../assert.js";
import { compile, instantiate } from "./wast-wrapper.js";

function module(bytes, valid = true) {
  let buffer = new ArrayBuffer(bytes.length);
  let view = new Uint8Array(buffer);
  for (let i = 0; i < bytes.length; ++i) {
    view[i] = bytes.charCodeAt(i);
  }
  return new WebAssembly.Module(buffer);
}

let iterations = 10;

function testIntFields() {

  let m = instantiate(`
    (module
      (type $s (struct (field i32) (field i32)))

      (func $new (export "new") (result (ref $s))
         (struct.new_canon $s (i32.const 1) (i32.const 5)))

      (func (export "len0") (result i32)
         (struct.get $s 0 (call $new)))
      (func (export "len1") (result i32)
         (struct.get $s 1 (call $new))))`);

    for (var i = 0; i < 10; i++) {
        assert.eq(m.exports.len0(), 1);
        assert.eq(m.exports.len1(), 5);
    }
}
testIntFields();
```

fails, because the `addStructGet` and `addStructSet` methods in `WasmAirIRGeneratorBase.h` emit a load of `s.m_payload.m_storage` (if `s` is the struct object being operated on) followed by a load or store with the offset for the field being read from/written to. This is incorrect because the field offset is relative to `s.m_payload.m_storage.data()`, not `s.m_payload.m_storage`. 

I'll be submitting a PR.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230222/ec66bbf1/attachment.htm>