From 0b8d476aee5821b749ebaf3c45cbb860124f4449 Mon Sep 17 00:00:00 2001
From: Andreas Haas <ahaas@chromium.org>
Date: Tue, 7 May 2019 16:19:28 +0200
Subject: [PATCH] [wasm] Fix sub-typing of global imports

Incorrect sub-typing caused some spec tests to fail. The rules in the
spec are here:
https://webassembly.github.io/reference-types/core/exec/modules.html#globals

R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: Ic0924b98a39395e351fec901c47a9debfe56be9d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1598763
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61314}
---
 src/wasm/module-instantiate.cc      | 19 +++++++++++++++----
 test/mjsunit/wasm/anyref-globals.js | 28 ++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/src/wasm/module-instantiate.cc b/src/wasm/module-instantiate.cc
index f89d2a7570..e9bf4bb39e 100644
--- a/src/wasm/module-instantiate.cc
+++ b/src/wasm/module-instantiate.cc
@@ -692,6 +692,12 @@ void InstanceBuilder::WriteGlobalValue(const WasmGlobal& global,
       TRACE("%lf", num);
       break;
     }
+    case kWasmAnyRef:
+    case kWasmAnyFunc:
+    case kWasmExceptRef: {
+      tagged_globals_->set(global.offset, *value->GetRef());
+      break;
+    }
     default:
       UNREACHABLE();
   }
@@ -970,13 +976,18 @@ bool InstanceBuilder::ProcessImportedWasmGlobalObject(
     Handle<WasmInstanceObject> instance, int import_index,
     Handle<String> module_name, Handle<String> import_name,
     const WasmGlobal& global, Handle<WasmGlobalObject> global_object) {
-  if (global_object->type() != global.type) {
-    ReportLinkError("imported global does not match the expected type",
+  if (global_object->is_mutable() != global.mutability) {
+    ReportLinkError("imported global does not match the expected mutability",
                     import_index, module_name, import_name);
     return false;
   }
-  if (global_object->is_mutable() != global.mutability) {
-    ReportLinkError("imported global does not match the expected mutability",
+
+  bool is_sub_type = ValueTypes::IsSubType(global.type, global_object->type());
+  bool is_same_type = global_object->type() == global.type;
+  bool valid_type = global.mutability ? is_same_type : is_sub_type;
+
+  if (!valid_type) {
+    ReportLinkError("imported global does not match the expected type",
                     import_index, module_name, import_name);
     return false;
   }
diff --git a/test/mjsunit/wasm/anyref-globals.js b/test/mjsunit/wasm/anyref-globals.js
index c0d9de4e69..95c8d3e9e1 100644
--- a/test/mjsunit/wasm/anyref-globals.js
+++ b/test/mjsunit/wasm/anyref-globals.js
@@ -528,3 +528,31 @@ function dummy_func() {
   assertEquals(obj2, instance2.exports.reexport2.value);
   assertEquals(obj3, instance2.exports.reexport3.value);
 })();
+
+(function TestImportImmutableAnyFuncGlobalAsAnyRef() {
+  print(arguments.callee.name);
+  let builder1 = new WasmModuleBuilder();
+  const g3 = builder1.addGlobal(kWasmAnyFunc, true).exportAs("e3");
+  builder1.addGlobal(kWasmAnyRef, false).exportAs("e1"); // Dummy.
+  builder1.addGlobal(kWasmAnyFunc, false).exportAs("e2"); // Dummy.
+  const instance1 = builder1.instantiate();
+
+  let builder2 = new WasmModuleBuilder();
+  const i1 = builder2.addImportedGlobal('exports', 'e1', kWasmAnyRef, false);
+  const i2 = builder2.addImportedGlobal('exports', 'e2', kWasmAnyRef, false);
+  builder2.instantiate(instance1);
+})();
+
+(function TestImportMutableAnyFuncGlobalAsAnyRefFails() {
+  print(arguments.callee.name);
+  let builder1 = new WasmModuleBuilder();
+  const g3 = builder1.addGlobal(kWasmAnyFunc, true).exportAs("e3");
+  builder1.addGlobal(kWasmAnyRef, true).exportAs("e1"); // Dummy.
+  builder1.addGlobal(kWasmAnyFunc, true).exportAs("e2"); // Dummy.
+  const instance1 = builder1.instantiate();
+
+  let builder2 = new WasmModuleBuilder();
+  const i1 = builder2.addImportedGlobal('exports', 'e1', kWasmAnyRef, true);
+  const i2 = builder2.addImportedGlobal('exports', 'e2', kWasmAnyRef, true);
+  assertThrows(() => builder2.instantiate(instance1), WebAssembly.LinkError);
+})();