feat: add gc references

- keep references in the 32-bit stack lane
- add i31 operations and reference casts
- implement runtime reference subtyping
- add tagged reference values
- simplify reference table storage

Signed-off-by: Henry <mail@henrygressmann.de>

Author: explodingcamera

crates/cli/src/wast_runner.rs

@@ -791,6 +791,9 @@ enum ExpectedValue {
     RefNull,
     RefFunc,
     RefExtern,
+    RefAny,
+    RefEq,
+    RefI31,
 }
 
 impl ExpectedValue {
@@ -800,6 +803,9 @@ impl ExpectedValue {
             Self::RefNull => matches!(value, WasmValue::Ref(RefValue::Null)),
             Self::RefFunc => matches!(value, WasmValue::Ref(RefValue::Func(_))),
             Self::RefExtern => matches!(value, WasmValue::Ref(RefValue::Extern(_))),
+            Self::RefAny => matches!(value, WasmValue::Ref(RefValue::Any(_))),
+            Self::RefEq => matches!(value, WasmValue::Ref(RefValue::Any(value)) if value.as_i31().is_some()),
+            Self::RefI31 => matches!(value, WasmValue::Ref(RefValue::Any(value)) if value.as_i31().is_some()),
         }
     }
 }
@@ -817,7 +823,9 @@ fn wastret2tinywasmvalues(ret: wast::WastRet) -> Result<Vec<ExpectedValue>> {
 }
 
 fn wastretcore2tinywasmvalue(ret: wast::core::WastRetCore) -> Result<ExpectedValue> {
-    use wast::core::WastRetCore::{F32, F64, I32, I64, RefExtern, RefFunc, RefNull, V128};
+    use wast::core::WastRetCore::{
+        F32, F64, I32, I64, RefAny, RefEq, RefExtern, RefFunc, RefI31, RefI31Shared, RefNull, V128,
+    };
     Ok(match ret {
         F32(f) => ExpectedValue::Exact(nanpattern2tinywasmvalue(f)?),
         F64(f) => ExpectedValue::Exact(nanpattern2tinywasmvalue(f)?),
@@ -832,6 +840,9 @@ fn wastretcore2tinywasmvalue(ret: wast::core::WastRetCore) -> Result<ExpectedVal
         RefFunc(v) => {
             bail!("unsupported arg type: reffunc: {:?}", v);
         }
+        RefAny => ExpectedValue::RefAny,
+        RefEq => ExpectedValue::RefEq,
+        RefI31 | RefI31Shared => ExpectedValue::RefI31,
         a => {
             bail!("unsupported arg type {:?}", a);
         }

crates/parser/src/conversion.rs

@@ -324,6 +324,9 @@ pub(crate) fn process_const_operators(ops: OperatorsReader<'_>) -> Result<Box<[C
             wasmparser::Operator::RefFunc { function_index } => {
                 ConstInstruction::Ref(RefValue::Func(FuncRef::new(function_index)))
             }
+            wasmparser::Operator::RefI31 => ConstInstruction::RefI31,
+            wasmparser::Operator::AnyConvertExtern => ConstInstruction::AnyConvertExtern,
+            wasmparser::Operator::ExternConvertAny => ConstInstruction::ExternConvertAny,
             wasmparser::Operator::I32Const { value } => ConstInstruction::I32Const(value),
             wasmparser::Operator::I64Const { value } => ConstInstruction::I64Const(value),
             wasmparser::Operator::F32Const { value } => ConstInstruction::F32Const(f32::from_bits(value.bits())),

crates/parser/src/macros.rs

@@ -37,6 +37,27 @@ pub(crate) mod visit {
             $(lowering_ops!(@effect $inputs => $outputs $visit);)*
             lowering_ops!($($rest)*);
         };
+        (unsupported $args:tt { $($visit:ident),* $(,)? } $($rest:tt)*) => {
+            $(lowering_ops!(@unsupported $args $visit);)*
+            lowering_ops!($($rest)*);
+        };
+        (heap $nullable:literal $inputs:tt => $outputs:tt {
+            $($visit:ident => $instr:ident),* $(,)?
+        } $($rest:tt)*) => {
+            $(
+                fn $visit(&mut self, heap_type: wasmparser::HeapType) -> Self::Output {
+                    let ty = convert_heap_type(heap_type, $nullable)?;
+                    lowering_ops!(@emit self fixed $inputs => $outputs Instruction::$instr(ty))
+                }
+            )*
+            lowering_ops!($($rest)*);
+        };
+
+        (@unsupported [$($argty:ty),*] $visit:ident) => {
+            fn $visit(&mut self $(, _: $argty)*) -> Self::Output {
+                Err(crate::ParseError::UnsupportedOperator(stringify!($visit).to_string()))
+            }
+        };
 
         (@fixed [$($input:ident),*] => [$($output:ident),*]
             $visit:ident $(($($arg:ident: $ty:ty),+))? => $instr:ident
@@ -128,6 +149,7 @@ pub(crate) mod visit {
         (@@relaxed_simd $($rest:tt)* ) => {};
         (@@tail_call $($rest:tt)* ) => {};
         (@@function_references $($rest:tt)* ) => {};
+        (@@gc $($rest:tt)* ) => {};
 
         (@@$proposal:ident $op:ident $({ $($arg:ident: $argty:ty),* })? => $visit:ident ($($ann:tt)*)) => {
             fn $visit(&mut self $($(,_: $argty)*)?) -> Self::Output {

crates/parser/src/optimize.rs

@@ -858,6 +858,7 @@ fn instruction_target_mut(instr: &mut Instruction) -> Option<&mut u32> {
         | Instruction::JumpIfNonZero64(ip)
         | Instruction::JumpIfRefNull(ip)
         | Instruction::JumpIfRefNonNull(ip)
+        | Instruction::BrOnCast(ip, _, _)
         | Instruction::JumpCmpStackConst32 { target_ip: ip, .. }
         | Instruction::JumpCmpStackConst64 { target_ip: ip, .. }
         | Instruction::JumpIfLocalZero32 { target_ip: ip, .. }

crates/parser/src/visit.rs

@@ -343,8 +343,18 @@ impl<'a> wasmparser::VisitOperator<'a> for FunctionBuilder<'_> {
         fixed [] => [] { visit_data_drop(segment: u32) => DataDrop, visit_elem_drop(segment: u32) => ElemDrop }
         fixed [] => [S32] { visit_i32_const(value: i32) => Const32, visit_ref_func(function: u32) => RefFunc }
         fixed [] => [S64] { visit_i64_const(value: i64) => Const64 }
+        heap false [] => [S32] { visit_ref_null => RefNull }
+        heap false [S32] => [S32] {
+            visit_ref_test_non_null => RefTest, visit_ref_cast_non_null => RefCast,
+        }
+        heap true [S32] => [S32] {
+            visit_ref_test_nullable => RefTest, visit_ref_cast_nullable => RefCast,
+        }
         fixed [S32] => [S32] {
-            visit_i32_eqz => I32Eqz, visit_ref_is_null => RefIsNull, visit_i32_clz => I32Clz,
+            visit_ref_is_null => RefIsNull, visit_ref_as_non_null => RefAsNonNull, visit_ref_i31 => RefI31,
+            visit_i31_get_s => I31GetS, visit_i31_get_u => I31GetU,
+            visit_any_convert_extern => AnyConvertExtern, visit_extern_convert_any => ExternConvertAny,
+            visit_i32_eqz => I32Eqz, visit_i32_clz => I32Clz,
             visit_i32_ctz => I32Ctz, visit_i32_popcnt => I32Popcnt, visit_i32_extend8_s => I32Extend8S,
             visit_i32_extend16_s => I32Extend16S, visit_i32_trunc_f32_s => I32TruncF32S,
             visit_i32_trunc_f32_u => I32TruncF32U, visit_f32_convert_i32_s => F32ConvertI32S,
@@ -377,7 +387,8 @@ impl<'a> wasmparser::VisitOperator<'a> for FunctionBuilder<'_> {
             visit_i64_trunc_sat_f32_u => I64TruncSatF32U,
         }
         fixed [S32, S32] => [S32] {
-            visit_i32_eq => I32Eq, visit_i32_ne => I32Ne, visit_i32_lt_s => I32LtS, visit_i32_lt_u => I32LtU,
+            visit_ref_eq => RefEq, visit_i32_eq => I32Eq, visit_i32_ne => I32Ne,
+            visit_i32_lt_s => I32LtS, visit_i32_lt_u => I32LtU,
             visit_i32_gt_s => I32GtS, visit_i32_gt_u => I32GtU, visit_i32_le_s => I32LeS,
             visit_i32_le_u => I32LeU, visit_i32_ge_s => I32GeS, visit_i32_ge_u => I32GeU,
             visit_f32_eq => F32Eq, visit_f32_ne => F32Ne, visit_f32_lt => F32Lt, visit_f32_gt => F32Gt,
@@ -424,6 +435,16 @@ impl<'a> wasmparser::VisitOperator<'a> for FunctionBuilder<'_> {
         table [S32, Addr] => [Addr] { visit_table_grow(table: u32) => TableGrow }
         table [Addr, S32, Addr] => [] { visit_table_fill(table: u32) => TableFill }
         table [Addr, S32, S32] => [] { visit_table_init(elem_index: u32, table: u32) => TableInit }
+        unsupported [] { visit_array_len }
+        unsupported [u32] {
+            visit_struct_new, visit_struct_new_default, visit_array_new, visit_array_new_default,
+            visit_array_get, visit_array_get_s, visit_array_get_u, visit_array_set, visit_array_fill,
+        }
+        unsupported [u32, u32] {
+            visit_struct_get, visit_struct_get_s, visit_struct_get_u, visit_struct_set,
+            visit_array_new_fixed, visit_array_new_data, visit_array_new_elem, visit_array_copy,
+            visit_array_init_data, visit_array_init_elem,
+        }
     }
 
     fn visit_call(&mut self, function_index: u32) -> Self::Output {
@@ -722,14 +743,22 @@ impl<'a> wasmparser::VisitOperator<'a> for FunctionBuilder<'_> {
         self.emit(&[dst, src, len], &[], Instruction::MemoryCopy { dst_mem, src_mem })
     }
 
-    // Reference Types
-    fn visit_ref_null(&mut self, ty: wasmparser::HeapType) -> Self::Output {
-        let instruction = Instruction::RefNull(convert_heap_type(ty, false)?);
-        self.emit(&[], &[OperandSize::S32], instruction)
+    fn visit_br_on_cast(
+        &mut self,
+        relative_depth: u32,
+        _from_ref_type: wasmparser::RefType,
+        to_ref_type: wasmparser::RefType,
+    ) -> Self::Output {
+        self.emit_cast_branch(relative_depth, to_ref_type, false)
     }
 
-    fn visit_ref_as_non_null(&mut self) -> Self::Output {
-        self.emit(&[OperandSize::S32], &[OperandSize::S32], Instruction::RefAsNonNull)
+    fn visit_br_on_cast_fail(
+        &mut self,
+        relative_depth: u32,
+        _from_ref_type: wasmparser::RefType,
+        to_ref_type: wasmparser::RefType,
+    ) -> Self::Output {
+        self.emit_cast_branch(relative_depth, to_ref_type, true)
     }
 
     fn visit_br_on_null(&mut self, relative_depth: u32) -> Self::Output {
@@ -975,6 +1004,23 @@ impl wasmparser::VisitSimdOperator<'_> for FunctionBuilder<'_> {
 }
 
 impl FunctionBuilder<'_> {
+    fn emit_cast_branch(
+        &mut self,
+        relative_depth: u32,
+        target: wasmparser::RefType,
+        branch_on_fail: bool,
+    ) -> Result<()> {
+        self.pop_expect(OperandSize::S32)?;
+        let target = convert_heap_type(target.heap_type(), target.is_nullable())?;
+        let conditional_ip = self.instructions.len();
+        self.instructions.push(Instruction::BrOnCast(0, target, branch_on_fail));
+        self.push_sizes(&[OperandSize::S32])?;
+        self.emit_dropkeep_to_label(relative_depth)?;
+        self.emit_branch_jump_or_return(relative_depth)?;
+        self.patch_jump(conditional_ip, self.instructions.len());
+        Ok(())
+    }
+
     fn is_unreachable(&self) -> bool {
         self.control_stack.last().is_none_or(|frame| frame.unreachable)
     }
@@ -1112,7 +1158,8 @@ impl FunctionBuilder<'_> {
             | Instruction::JumpIfZero32(ip)
             | Instruction::JumpIfNonZero32(ip)
             | Instruction::JumpIfRefNull(ip)
-            | Instruction::JumpIfRefNonNull(ip) => {
+            | Instruction::JumpIfRefNonNull(ip)
+            | Instruction::BrOnCast(ip, _, _) => {
                 *ip = target as u32;
             }
             _ => {}

crates/tinywasm/src/error.rs

@@ -172,6 +172,12 @@ pub enum Trap {
     /// A null function reference was called.
     NullFunctionReference,
 
+    /// A null i31 reference was unwrapped.
+    NullI31Reference,
+
+    /// A reference cast failed.
+    CastFailure,
+
     /// Indirect call type mismatch
     IndirectCallTypeMismatch {
         /// The expected type
@@ -201,6 +207,8 @@ impl Trap {
             Self::UninitializedElement { .. } => "uninitialized element",
             Self::NullReference => "null reference",
             Self::NullFunctionReference => "null function reference",
+            Self::NullI31Reference => "null i31 reference",
+            Self::CastFailure => "cast failure",
             Self::IndirectCallTypeMismatch { .. } => "indirect call type mismatch",
             Self::HostFunction(_) => "host function trap",
             Self::InvalidStore => "invalid store",
@@ -303,6 +311,8 @@ impl Display for Trap {
             }
             Self::NullReference => write!(f, "null reference"),
             Self::NullFunctionReference => write!(f, "null function reference"),
+            Self::NullI31Reference => write!(f, "null i31 reference"),
+            Self::CastFailure => write!(f, "cast failure"),
             Self::InvalidStore => write!(f, "invalid store"),
             #[cfg(feature = "debug")]
             Self::IndirectCallTypeMismatch { expected, actual } => {

crates/tinywasm/src/imports.rs

@@ -157,45 +157,9 @@ impl Imports {
         Ok(())
     }
 
-    fn ref_subtype(state: &crate::store::State, actual: RefType, expected: RefType) -> bool {
-        if actual.is_nullable() && !expected.is_nullable() {
-            return false;
-        }
-        match (actual.type_index(), expected.type_index()) {
-            (Some(actual), Some(expected)) => actual == expected,
-            (Some(actual), None) => match expected.abstract_heap_type() {
-                Some(AbstractHeapType::Func) => state.get_type(actual).as_func().is_some(),
-                Some(AbstractHeapType::Struct) => state.get_type(actual).as_struct().is_some(),
-                Some(AbstractHeapType::Array) => state.get_type(actual).as_array().is_some(),
-                _ => false,
-            },
-            (None, Some(_)) => matches!(actual.abstract_heap_type(), Some(AbstractHeapType::NoFunc)),
-            (None, None) => {
-                actual.abstract_heap_type() == expected.abstract_heap_type()
-                    || actual.is_func() && matches!(expected.abstract_heap_type(), Some(AbstractHeapType::Func))
-                    || actual.is_extern() && matches!(expected.abstract_heap_type(), Some(AbstractHeapType::Extern))
-                    || actual.is_exn() && matches!(expected.abstract_heap_type(), Some(AbstractHeapType::Exn))
-            }
-        }
-    }
-
-    fn value_subtype(state: &crate::store::State, actual: WasmType, expected: WasmType) -> bool {
-        match (actual, expected) {
-            (WasmType::Ref(actual), WasmType::Ref(expected)) => Self::ref_subtype(state, actual, expected),
-            _ => actual == expected,
-        }
-    }
-
-    fn compare_table_types(
-        state: &crate::store::State,
-        import: &Import,
-        actual: &TableType,
-        expected: &TableType,
-    ) -> Result<()> {
+    fn compare_table_types(import: &Import, actual: &TableType, expected: &TableType) -> Result<()> {
         Self::compare_types(import, &actual.arch(), &expected.arch())?;
-        if !Self::ref_subtype(state, actual.element_type, expected.element_type)
-            || !Self::ref_subtype(state, expected.element_type, actual.element_type)
-        {
+        if actual.element_type != expected.element_type {
             return Err(LinkingError::incompatible_import_type(import).into());
         }
         if actual.size_initial < expected.size_initial {
@@ -285,8 +249,8 @@ impl Imports {
                     let global = store.state.get_global(global_addr);
                     let expected = ty.with_ty(crate::store::canonicalize_value_type(ty.ty, type_addrs));
                     let compatible = global.ty.mutable == ty.mutable
-                        && Self::value_subtype(&store.state, global.ty.ty, expected.ty)
-                        && (!ty.mutable || Self::value_subtype(&store.state, expected.ty, global.ty.ty));
+                        && store.state.value_type_is_subtype(global.ty.ty, expected.ty)
+                        && (!ty.mutable || store.state.value_type_is_subtype(expected.ty, global.ty.ty));
                     if !compatible {
                         cold_path();
                         return Err(LinkingError::incompatible_import_type(import).into());
@@ -302,7 +266,7 @@ impl Imports {
                         MemoryArch::I32 => TableType::new(element_type, ty.size_initial, ty.size_max),
                         MemoryArch::I64 => TableType::new64(element_type, ty.size_initial, ty.size_max),
                     };
-                    Self::compare_table_types(&store.state, import, &kind, &expected)?;
+                    Self::compare_table_types(import, &kind, &expected)?;
                     imports.tables.push(table_addr);
                 }
                 (ExternVal::Memory(memory_addr), ImportKind::Memory(ty)) => {
@@ -316,7 +280,8 @@ impl Imports {
                     if let Some(func) = &func_handle {
                         func.item.validate_store(store)?;
                     }
-                    if store.state.get_func(func_addr).type_addr != *expected_type_addr {
+                    if !store.state.type_addr_is_subtype(store.state.get_func(func_addr).type_addr, *expected_type_addr)
+                    {
                         cold_path();
                         return Err(LinkingError::incompatible_import_type(import).into());
                     }