Repository navigation
Conversation
Active element segments (and table initializers) can initialize table slots using global.get expressions referencing either module-defined immutable globals or imported globals. Previously, Analyzer::prepare() only checked for RefFunc items when populating FlatTableInfo::typeFuncs and FlatTableInfo::typeElems, so active element segments whose items were global.gets were omitted from typeElems, causing RemoveUnusedModuleElements to delete the element segment and its referenced global even when a reachable call_indirect could call through that table slot. Fix this by tracing through module-defined immutable globals in notePossibleFunc so chains ending in RefFunc populate typeFuncs and typeElems directly, preserving called functions' bodies and maintaining type precision when a defined global has a broader declared type like funcref. For remaining function-typed items in active element segments whose concrete target is unknown (such as imported globals), propagateUnknownFuncElem pre-propagates the segment into typeElems for the item's heap type, its supertypes, and (when inexact) its subtypes using a lazily cached subtypes() helper. Fixes #9366.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the RemoveUnusedModuleElements pass to trace through module-defined immutable globals to find underlying constant expressions and introduces propagateUnknownFuncElem to handle unknown function elements. It also refactors SubTypes computation to be lazily computed and cached. The review feedback highlights a potential null pointer dereference and infinite loop risk when tracing through GlobalGet chains, and suggests optimizing subtype iterations by using iterSubTypes instead of methods that allocate and return vectors by value.
Record inexact unknown function segment items in FlatTableInfo::inexactTypeElems and match them by walking call_indirect supertypes instead of eagerly expanding to all subtypes via SubTypes(*module). Also rename _subTypes/subtypes() to subTypes/getSubTypes(), clarify comments in notePossibleFunc, and add shared function global tests.
There was a problem hiding this comment.
Code Review
This pull request enhances the RemoveUnusedModuleElements pass to trace through module-defined immutable globals and handle inexact unknown function items (such as imported globals) when identifying used element segments. It also introduces lazy subtype computation and adds comprehensive test cases. The review feedback identifies a potential null pointer dereference when resolving globals, which could lead to a segmentation fault, and suggests adding a null check.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Active element segments (and table initializers) can initialize table slots using global.get expressions referencing either module-defined immutable globals or imported globals. Previously, Analyzer::prepare() only checked for RefFunc items when populating FlatTableInfo::typeFuncs and FlatTableInfo::typeElems, so active element segments whose items were global.gets were omitted from typeElems, causing RemoveUnusedModuleElements to delete the element segment and its referenced global even when a reachable call_indirect could call through that table slot.
Fix this by tracing through module-defined immutable globals in notePossibleFunc so chains ending in RefFunc populate typeFuncs and typeElems directly, preserving called functions' bodies and maintaining type precision when a defined global has a broader declared type like funcref. For remaining function-typed items in active element segments whose concrete target is unknown (such as imported globals), propagateUnknownFuncElem pre-propagates the segment into typeElems for the item's heap type and its supertypes. Elements with inexact types are also recorded and keep their element segments alive when there are indirect calls to their subtypes.
Fixes #9366.