Validate RefAsNonNull

src/wasm/wasm-validator.cpp

@@ -2230,10 +2230,19 @@ void FunctionValidator::visitRefIsNull(RefIsNull* curr) {
 }
 
 void FunctionValidator::visitRefAs(RefAs* curr) {
+ if (curr->value->type != Type::unreachable &&
+ !shouldBeTrue(
+ curr->value->type.isRef(), curr, "ref.as value must be reference")) {
+ return;
+ }
  switch (curr->op) {
- default:
- // TODO: validate all the other ref.as_*
+ case RefAsNonNull: {
+ shouldBeTrue(
+ getModule()->features.hasReferenceTypes(),
+ curr,
+ "ref.as requires reference-types [--enable-reference-types]");
  break;
+ }
  case AnyConvertExtern: {
  shouldBeTrue(getModule()->features.hasGC(),
  curr,

src/wasm/wasm.cpp

@@ -1223,7 +1223,13 @@ void ArrayInitElem::finalize() {
 }
 
 void RefAs::finalize() {
- if (value->type == Type::unreachable) {
+ // An unreachable child means we are unreachable. Also set ourselves to
+ // unreachable when the child is invalid (say, it is an i32 or some other non-
+ // reference), which avoids getHeapType() erroring right after us (in this
+ // situation, the validator will report an error later).
+ // TODO: Remove that part when we solve the validation issue more generally,
+ // see https://github.com/WebAssembly/binaryen/issues/6781
+ if (!value->type.isRef()) {
  type = Type::unreachable;
  return;
  }

test/lit/validation/non-ref.wast

@@ -0,0 +1,13 @@
+;; RUN: not wasm-opt %s -all 2>&1 | filecheck %s
+
+;; CHECK: ref.as value must be reference
+
+(module
+ (func $test
+ (drop
+ (ref.as_non_null
+ (i32.const 42)
+ )
+ )
+ )
+)