Closed Bug 1638446 Opened 10 months ago Closed 10 months ago

Remove bottom-type and align validation of ref.func again


(Core :: Javascript: WebAssembly, task, P2)




Tracking Status
firefox78 --- fixed


(Reporter: rhunt, Assigned: rhunt)




(2 files)

I missed this in the work to remove subtyping, but the bottom type used for validating br_table has been removed [1]. I put up a PR to re-add the test that would have caught this.


Adding another small patch here for another fix to get spec-tests passing.

Summary: Remove bottom type → Remove bottom-type and align validation of ref.func again

This commit removes the bottom type from wasm instruction validation. This type was
added in reference-types to avoid the need for lub or glb calculations for the br_table
and select instructions. Now that subtyping is removed, the typed select instruction
was kept but the bottom type was removed.

The only place where a bottom type is observable is in validation of the br_table
instruction when the input value to pass to the branches is stack polymorphic.

With a bottom-type we check that the input type is a subtype of each branch target type
referenced by br_table without fixing the input type to the branch target type. Without
a bottom-type, we do the same but fix the input type as we check branch target types.

This was omitted from the original upstream spec-tests that changed validation to treat
the whole module environment as pre-declaring ref.func indices, and added after our
commit landed.

Depends on D75988

Pushed by
Remove bottom type from wasm validation. r=lth
Change wasm start function to not pre-declare a valid ref.func index. r=lth
Closed: 10 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla78
You need to log in before you can comment on or make changes to this bug.