From f4ac63f513ab5332ea35c8cc8ece7a7d4fb7778f Mon Sep 17 00:00:00 2001
From: Alex Crichton <alex@alexcrichton.com>
Date: Tue, 2 Apr 2024 10:56:49 -0500
Subject: [PATCH] Fix a panic using tables with the wrong type (#8283)

This commit fixes an accidental issue introduced in #8018 where using an
element segment which had been dropped with an `externref` table would
cause a panic. The panic happened due to an assertion that tables are
being used with the right type of item and that was being mismatched.
The underlying issue was that dropped element segments are modeled as an
empty element segment but the empty element segment was using the
"functions" encoding as opposed to the "expressions" encoding. This
meant that code later assumed that due to the use of functions the table
must be a table-of-functions, but this was not correct for
externref-based tables.

The fix in this commit is to instead model the encoding as an
"expressions" list which means that the table type is dispatched on to
call the appropriate initializer.

There is no memory safety issue with this mistake as the assertion was
specifically targetted at preventing memory safety. This does, however,
enable any WebAssembly module to panic a host.

Closes #8281
---
 crates/runtime/src/instance.rs                |  7 +++-
 ...nref-table-dropped-segment-issue-8281.wast | 39 +++++++++++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 tests/misc_testsuite/externref-table-dropped-segment-issue-8281.wast

diff --git a/crates/runtime/src/instance.rs b/crates/runtime/src/instance.rs
index 9ad701432c04..61902beecb97 100644
--- a/crates/runtime/src/instance.rs
+++ b/crates/runtime/src/instance.rs
@@ -805,7 +805,12 @@ impl Instance {
         // disconnected from the lifetime of `self`.
         let module = self.module().clone();
 
-        let empty = TableSegmentElements::Functions(Box::new([]));
+        // NB: fall back to an expressions-based list of elements which doesn't
+        // have static type information (as opposed to `Functions`) since we
+        // don't know just yet what type the table has. The type will be be
+        // inferred in the next step within `table_init_segment`.
+        let empty = TableSegmentElements::Expressions(Box::new([]));
+
         let elements = match module.passive_elements_map.get(&elem_index) {
             Some(index) if !self.dropped_elements.contains(elem_index) => {
                 &module.passive_elements[*index]
diff --git a/tests/misc_testsuite/externref-table-dropped-segment-issue-8281.wast b/tests/misc_testsuite/externref-table-dropped-segment-issue-8281.wast
new file mode 100644
index 000000000000..723c03c801e3
--- /dev/null
+++ b/tests/misc_testsuite/externref-table-dropped-segment-issue-8281.wast
@@ -0,0 +1,39 @@
+(module
+  (table $t 0 0 externref)
+
+  (func (export "f1")
+    (i32.const 0)
+    (i32.const 0)
+    (i32.const 0)
+    (table.init $t $declared)
+  )
+
+  (func (export "f2")
+    (i32.const 0)
+    (i32.const 0)
+    (i32.const 0)
+    (table.init $t $passive)
+
+    (elem.drop $passive)
+
+    (i32.const 0)
+    (i32.const 0)
+    (i32.const 0)
+    (table.init $t $passive)
+  )
+
+  (func (export "f3")
+    (i32.const 0)
+    (i32.const 0)
+    (i32.const 0)
+    (table.init $t $active)
+  )
+
+  (elem $declared declare externref)
+  (elem $passive externref)
+  (elem $active (i32.const 0) externref)
+)
+
+(assert_return (invoke "f1"))
+(assert_return (invoke "f2"))
+(assert_return (invoke "f3"))