[Webkit-unassigned] [Bug 254178] New: [Wasm-GC] Air assertion failure when casting to nullref

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=254178

            Bug ID: 254178
           Summary: [Wasm-GC] Air assertion failure when casting to
                    nullref
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebAssembly
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: tjc at igalia.com

An existing test, https://searchfox.org/wubkat/source/JSTests/wasm/gc/casts.js , fails in the wasm-simd, wasm-bbq, and wasm-air configurations when running the run-jsc-stress-tests script. I'm not sure why the test isn't being run with these configurations in CI.

The output is:
```
wasm.yaml/wasm/gc/casts.js.wasm-simd: ASSERTION FAILED: isSubtype(src.type(), dst.type())
wasm.yaml/wasm/gc/casts.js.wasm-simd: /home/tjc/WebKit/Source/JavaScriptCore/wasm/WasmAirIRGenerator64.cpp(701) : void JSC::Wasm::AirIRGenerator64::emitMove(const JSC::Wasm::TypedTmp&, const JSC::Wasm::TypedTmp&)
```

and the specific test case causing the error is the first one in `testNullCasts()`:

```
        (func (param arrayref) (result nullref)
          (ref.cast none (local.get 0)))
```

I'll submit a PR.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230320/bb3356fb/attachment.htm>