Skip to content

Fix invalid tag index when parsing declarative element segments with … #9093

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tlively merged 3 commits into from
Sep 14, 2026
+38 −3
Merged

Fix invalid tag index when parsing declarative element segments with … #9093

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0e92cd6
Fix invalid tag index when parsing declarative element segments with …
ArkadySkv Sep 10, 2026
093de6d
Reformatted to match the style in
ArkadySkv Sep 13, 2026
44379ab
newline at end of test file
tlively Sep 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions src/wasm/wasm-binary.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5333,8 +5333,15 @@ void WasmBinaryReader::readElementSegments() {

if (isDeclarative) {
// Declared segments are needed in wasm text and binary, but not in
// Binaryen IR; skip over the segment
[[maybe_unused]] auto type = getU32LEB();
// Binaryen IR; skip over the segment.
if (usesExpressions) {
[[maybe_unused]] auto type = getType();
} else {
auto elemKind = getU32LEB();
if (elemKind != 0x0) {
throwError("unexpected passive segment elemkind, expected 0, got " + std::to_string(elemKind));
}
}
auto num = getU32LEB();
for (Index i = 0; i < num; i++) {
if (usesExpressions) {
Expand Down Expand Up @@ -5369,7 +5376,7 @@ void WasmBinaryReader::readElementSegments() {
} else {
auto elemKind = getU32LEB();
if (elemKind != 0x0) {
throwError("Invalid kind (!= funcref(0)) since !usesExpressions.");
throwError("unexpected passive segment elemkind, expected 0, got " + std::to_string(elemKind));
}
}
}
Expand Down
28 changes: 28 additions & 0 deletions test/spec/gc-elem-declare.wast
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
;; Binary spec test for declarative element segments with GC reftypes.
;; Before the fix, parsing this module failed with "invalid tag index".
;; See https://github.com/WebAssembly/binaryen/issues/8540

(module binary
"\00asm" "\01\00\00\00" ;; magic + version

"\01\1b" ;; Type section, 27 bytes
"\01" ;; 1 rec group
"\4e\06" ;; rec group of size 6
"\5e\77\00" ;; type 0: (array i16)
"\50\00\5f\00" ;; type 1: (sub (struct))
"\5e\72\01" ;; type 2: (array (mut nullexternref))
"\50\00\60\01\7e\00" ;; type 3: (sub (func (param i64)))
"\5e\7d\01" ;; type 4: (array (mut f32))
"\50\00\5e\7b\01" ;; type 5: (sub (array (mut v128)))

"\03\03\02\03\03" ;; Function section: 2 funcs, both type 3

"\09\0f\03" ;; Element section, 15 bytes
"\07\63\02\00" ;; segment 0: declare (ref null 2), 0 exprs
"\07\63\03\01\d0\03\0b" ;; segment 1: declare (ref null 3) (ref.null 3)
"\07\71\00" ;; segment 2: declare nullref, 0 exprs

"\0a\07\02" ;; Code section, 7 bytes
"\02\00\0b" ;; function 0: empty body
"\02\00\0b" ;; function 1: empty body
)
Loading