Skip to content

Validate type references by index#2584

Merged
sbc100 merged 1 commit into
WebAssembly:mainfrom
zherczeg:ref_index_fix
Apr 27, 2025
Merged

Validate type references by index#2584
sbc100 merged 1 commit into
WebAssembly:mainfrom
zherczeg:ref_index_fix

Conversation

@zherczeg

Copy link
Copy Markdown
Collaborator

This patch is another bugfix.

Comment thread src/shared-validator.cc
}

Result SharedValidator::EndTypeSection() {
Result result = Result::Ok;

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a new event in SharedValidator. This check could be done in OnFuncType, but then we needed the OnTypeCount event, which is also not used by the validator.

Since the Google v8 engine has separate reference types for array/struct, we might need to check the reference type in the future as well, and we cannot do that before reading all types.

Comment thread src/shared-validator.cc

for (auto func_type : func_types_) {
for (auto type : func_type.second.params) {
result |= CheckReferenceType(Location(), type, "params");

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't have the locations at this point.

Comment thread src/wast-parser.cc Outdated
@zherczeg

Copy link
Copy Markdown
Collaborator Author

The parser also validates the references to provide nice error locations, which is a double check when the validator is used. However the check in the parser has an advantage: implicit function type indicies are not accepted, which I think is a user friendly thing.

Comment thread test/gen-wasm.py
Comment thread test/parse/bad-references.txt
Comment thread src/wast-parser.cc Outdated
Comment thread src/wast-parser.cc
Comment thread src/shared-validator.cc Outdated
@zherczeg

Copy link
Copy Markdown
Collaborator Author

Btw, I agree that the current max: error message is not the best, but we should improve it everywhere for consistency. Perhaps the value - 1 for max: could be better with a special string when the value is zero. Please decide it, and I will update the code.

@zherczeg zherczeg force-pushed the ref_index_fix branch 3 times, most recently from 547b2db to 5f9d5a3 Compare April 17, 2025 06:41
@zherczeg

Copy link
Copy Markdown
Collaborator Author

Thank you for the review, I have updated the patch.

@sbc100

sbc100 commented Apr 17, 2025

Copy link
Copy Markdown
Member

Btw, I agree that the current max: error message is not the best, but we should improve it everywhere for consistency. Perhaps the value - 1 for max: could be better with a special string when the value is zero. Please decide it, and I will update the code.

Leaving as is, for consistency, seems fine to me.

@zherczeg

Copy link
Copy Markdown
Collaborator Author

Is there anything I need to do?

Comment thread src/wast-parser.cc
if (type.is_index()) {
// TODO: Incorrect values can be misinterpreted by the parser.
if (type.index() >= static_cast<Index>(Type::Void)) {
if (IsIndexLikelyType(type.index())) {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From the code that follows it looks like we are trying to distinguish reference types from function types? Is that right? How about something like IsReferenceType? I'm not really sure what IsIndexLikelyType means here... perhaps I'm misunderstanding?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is not just reference type, it is currently any type. The ParseValueType encodes the value type as index.

For example: the binary code of (func $f (param i64 (ref 0xfffffffe))) is

; func type 0
000000b: 60                                        ; func
000000c: 02                                        ; num params
000000d: 7e                                        ; i64
000000e: 7e                                        ; i64
000000f: 00                                        ; num results

The i64 is encoded as 0xfffffffe, which is stored in the index. Also, the (ref 0xfffffffe) is converted to i64, because currently it is impossible to tell the difference (at the moment). The function_ref patch will fix this issue.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SGTM then.

@zherczeg

Copy link
Copy Markdown
Collaborator Author

Rebased this patch (no change). Can you land it? Thank you!

Also fix a reference parsing bug when named locals are used.
@zherczeg

Copy link
Copy Markdown
Collaborator Author

@sbc100 could you land this approved patch? Thank you!

@sbc100 sbc100 merged commit 96dfd60 into WebAssembly:main Apr 27, 2025
@zherczeg zherczeg deleted the ref_index_fix branch April 28, 2025 04:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants