Validator: Check subtyping in CallIndirect [DO NOT LAND]

src/wasm/wasm-validator.cpp

@@ -209,6 +209,19 @@ struct ValidationInfo {
     fail(text, curr, func);
     return false;
   }
+
+  // HeapType 'left' should be a subtype of 'right'.
+  bool shouldBeSubType(HeapType left,
+                       HeapType right,
+                       Expression* curr,
+                       const char* text,
+                       Function* func = nullptr) {
+    if (HeapType::isSubType(left, right)) {
+      return true;
+    }
+    fail(text, curr, func);
+    return false;
+  }
 };
 
 struct FunctionValidator : public WalkerPass<PostWalker<FunctionValidator>> {
@@ -530,6 +543,13 @@ struct FunctionValidator : public WalkerPass<PostWalker<FunctionValidator>> {
     return info.shouldBeSubType(left, right, curr, text, getFunction());
   }
 
+  bool shouldBeSubType(HeapType left,
+                       HeapType right,
+                       Expression* curr,
+                       const char* text) {
+    return info.shouldBeSubType(left, right, curr, text, getFunction());
+  }
+
   void validateAlignment(
     size_t align, Type type, Index bytes, bool isAtomic, Expression* curr);
   void validateMemBytes(uint8_t bytes, Type type, Expression* curr);
@@ -958,11 +978,15 @@ void FunctionValidator::visitCallIndirect(CallIndirect* curr) {
 
   if (curr->target->type != Type::unreachable) {
     auto* table = getModule()->getTableOrNull(curr->table);
-    shouldBeTrue(!!table, curr, "call-indirect table must exist");
-    if (table) {
-      shouldBeTrue(table->type.isFunction(),
-                   curr,
-                   "call-indirect table must be of function type.");
+    if (shouldBeTrue(!!table, curr, "call-indirect table must exist")) {
+      if (shouldBeTrue(table->type.isFunction(),
+                       curr,
+                       "call-indirect table must be of function type.")) {
+        shouldBeSubType(curr->heapType,
+                        table->type.getHeapType(),
+                        curr,
+                        "call-indirect cast type must be a subtype of table");
+      }
     }
   }
 

test/lit/validation/call-indirect-subtyping.wast

@@ -0,0 +1,22 @@
+;; Check that we fail to validate a call_indirect whose cast type is not a
+;; subtype of the table type.
+
+;; RUN: not wasm-opt -all %s -o - -S 2>&1 | filecheck %s
+
+;; CHECK: call-indirect cast type must be a subtype of table
+
+(module
+ (rec
+  (type $type-A (sub (func)))
+  (type $type-B (sub (func)))
+ )
+
+ (table $table-A 1 1 (ref null $type-A))
+
+ (func $test
+  (call_indirect $table-A (type $type-B)
+   (i32.const 0)
+  )
+ )
+)
+