1847234 - br_on_cast validation issues

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, task, P2)

Description

[Ryan Hunt [:rhunt]]

I discovered two unrelated issues while debugging a test case with the br_on_cast instruction.

1. We allow any flag bits to be set outside of the first two. This is a future compatibility hazard that we try to avoid, we should error if any are set. [1]
2. The fallback top type for unreachable code is 'anyref' [2]. I'm not sure if this is sound if we're doing a func cast?

Ben, can you take a look?

[1] https://searchfox.org/mozilla-central/rev/892475f3ba2b959aeaef19d1d8602494e3f2ae32/js/src/wasm/WasmOpIter.h#3748
[2] https://searchfox.org/mozilla-central/rev/892475f3ba2b959aeaef19d1d8602494e3f2ae32/js/src/wasm/WasmOpIter.h#3809

Comment 1

[Ryan Hunt [:rhunt]]

Attachment: Bug 1847234 - wasm: Fix br_on_cast validation. r?bvisness

• Error on bits set in flags that we don't recognize
• Fallback to immediate source type for source type when in unreachable code

Depends on D188644

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7645d9e3e972
wasm: Fix br_on_cast validation. r=bvisness

Comment 3

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/7645d9e3e972