Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wasmparser: Fix subtyping depth indexing #1968

Merged
merged 1 commit into from
Jan 8, 2025

Conversation

tanishiking
Copy link
Contributor

@tanishiking tanishiking commented Jan 7, 2025

fix: #1967

This patch addresses an issue in subtyping depth checking where set_subtyping_depth indexes the depth by CoreTypeId, but get_subtyping_depth accesses it using CoreTypeId#index (u32). This leads to "IndexMap: index out of bounds" error when validating WasmGC components with subtypes.

@alexcrichton
Copy link
Member

Thanks for the report, the investigation, and a PR! I believe this is the right fix as well. Playing around with this locally this is a small test case to trigger the bug from before and this PR fixes it. If you'd like to include that here I'd be happy to flag this for merge:

diff --git a/tests/local/component-model/gc.wast b/tests/local/component-model/gc.wast
index 1b409903f..d7a47456e 100644
--- a/tests/local/component-model/gc.wast
+++ b/tests/local/component-model/gc.wast
@@ -124,3 +124,12 @@
     ))
   )
   "sub type cannot have a final super type")
+
+(component
+  (type $t (resource (rep i32)))
+  (core func (canon resource.drop $t))
+  (core module
+    (type $t1 (sub (func)))
+    (type (sub $t1 (func)))
+  )
+)

fix: bytecodealliance#1967

This patch addresses an issue in subtyping depth checking
where `set_subtyping_depth` indexes the depth by `CoreTypeId`,
but `get_subtyping_depth` accesses it using `CoreTypeId#index` (`u32`).
This leads to "IndexMap: index out of bounds" error when validating
WasmGC components with subtypes.
@tanishiking tanishiking marked this pull request as ready for review January 8, 2025 01:09
@tanishiking
Copy link
Contributor Author

Thank you so much for taking a look & minimizing the reproduction @alexcrichton !
I added the test case you mentioned :)

@alexcrichton alexcrichton added this pull request to the merge queue Jan 8, 2025
Merged via the queue into bytecodealliance:main with commit a43321d Jan 8, 2025
30 checks passed
@tanishiking tanishiking deleted the fix-subtype branch January 8, 2025 01:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants