From bdba9a2b54ca68d7b706864e17415d7aa0ec0ff6 Mon Sep 17 00:00:00 2001
From: Daniel Lehmann <[email protected]>
Date: Wed, 09 Sep 2026 15:45:14 +0200
Subject: [PATCH] [compiler][wasm] Fix null check for abstract ref.cast in JS inlining

When inlining a Wasm function into JS in TurboFan, ParseRefCast for
abstract array casts omitted a null check when null_succeeds was false.
When passed WasmNull, the subsequent HasInstanceType check dereferenced
the map of WasmNull (which resides on a guard page), causing a SEGV.

This change delegates abstract array casts in ParseRefCast to
WasmTypeCastAbstract, unifying them with concrete casts and ensuring
WasmGCLowering handles null checks and instance type checks. It also
factors out repeated null check queries into Value::null_check().

[email protected]

TAG=agy
CONV=ae44a1bc-4aad-4057-9192-5e342b9721be

Fixed: 558539954
Change-Id: Ia38436f9a26f480f9e9ffdb7327dfd47800ae92d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8378401
Reviewed-by: Matthias Liedtke <[email protected]>
Commit-Queue: Daniel Lehmann <[email protected]>
Cr-Commit-Position: refs/heads/main@{#109751}
---
diff --git a/src/compiler/wasm-inlining-into-js.cc b/src/compiler/wasm-inlining-into-js.cc
index a8ef32e..560e9b4 100644
--- a/src/compiler/wasm-inlining-into-js.cc
+++ b/src/compiler/wasm-inlining-into-js.cc
@@ -27,6 +27,10 @@
   struct Value {
     Node* node = nullptr;
     wasm::ValueType type = wasm::kWasmBottom;
+
+    CheckForNull null_check() const {
+      return type.is_nullable() ? kWithNullCheck : kWithoutNullCheck;
+    }
   };
 
  public:
@@ -219,10 +223,8 @@
       return {};
     }
     const bool is_signed = opcode == wasm::kExprStructGetS;
-    const CheckForNull null_check =
-        struct_val.type.is_nullable() ? kWithNullCheck : kWithoutNullCheck;
     Node* member = gasm_.StructGet(struct_val.node, struct_type, field_index,
-                                   is_signed, null_check);
+                                   is_signed, struct_val.null_check());
     SetSourcePosition(member);
     return TypeNode(member, struct_type->field(field_index).Unpacked());
   }
@@ -237,10 +239,8 @@
       is_inlineable_ = false;
       return;
     }
-    const CheckForNull null_check =
-        wasm_struct.type.is_nullable() ? kWithNullCheck : kWithoutNullCheck;
     gasm_.StructSet(wasm_struct.node, value.node, struct_type, field_index,
-                    null_check);
+                    wasm_struct.null_check());
     SetSourcePosition(gasm_.effect());
   }
 
@@ -254,29 +254,14 @@
         is_inlineable_ = false;
         return {};
       }
-      auto done = gasm_.MakeLabel();
-      // Abstract cast to array.
-      if (input.type.is_nullable() && null_succeeds) {
-        gasm_.GotoIf(gasm_.IsNull(input.node, input.type), &done);
-      }
-      gasm_.TrapIf(gasm_.IsSmi(input.node), TrapId::kTrapIllegalCast);
-      gasm_.TrapUnless(gasm_.HasInstanceType(input.node, WASM_ARRAY_TYPE),
-                       TrapId::kTrapIllegalCast);
-      SetSourcePosition(gasm_.effect());
-      gasm_.Goto(&done);
-      gasm_.Bind(&done);
-      // Add TypeGuard for graph typing.
-      TFGraph* graph = mcgraph_->graph();
-      wasm::ValueType result_type = wasm::ValueType::Generic(
+      wasm::ValueType target_type = wasm::ValueType::Generic(
           wasm::GenericKind::kArray,
           null_succeeds ? wasm::kNullable : wasm::kNonNullable,
           SharedFlag{false});
-      Node* type_guard =
-          graph->NewNode(mcgraph_->common()->TypeGuard(
-                             Type::Wasm(result_type, module_, graph->zone())),
-                         input.node, gasm_.effect(), gasm_.control());
-      gasm_.InitializeEffectControl(type_guard, gasm_.control());
-      return TypeNode(type_guard, result_type);
+      Node* cast =
+          gasm_.WasmTypeCastAbstract(input.node, {input.type, target_type});
+      SetSourcePosition(cast);
+      return TypeNode(cast, target_type);
     }
     wasm::ModuleTypeIndex target_type_index{static_cast<uint32_t>(heap_index)};
     if (module_->has_signature(target_type_index)) {
@@ -311,9 +296,7 @@
                wasm::IndependentHeapType{wasm::GenericKind::kArray,
                                          wasm::kNullable, SharedFlag{true}},
                module_));
-    const CheckForNull null_check =
-        input.type.is_nullable() ? kWithNullCheck : kWithoutNullCheck;
-    Node* len = gasm_.ArrayLength(input.node, null_check);
+    Node* len = gasm_.ArrayLength(input.node, input.null_check());
     SetSourcePosition(len);
     return TypeNode(len, wasm::kWasmI32);
   }
@@ -327,10 +310,8 @@
       return {};
     }
     const bool is_signed = opcode == WasmOpcode::kExprArrayGetS;
-    const CheckForNull null_check =
-        array.type.is_nullable() ? kWithNullCheck : kWithoutNullCheck;
     // Perform bounds check.
-    Node* length = gasm_.ArrayLength(array.node, null_check);
+    Node* length = gasm_.ArrayLength(array.node, array.null_check());
     SetSourcePosition(length);
     gasm_.TrapUnless(gasm_.Uint32LessThan(index.node, length),
                      TrapId::kTrapArrayOutOfBounds);
@@ -349,10 +330,8 @@
       is_inlineable_ = false;
       return;
     }
-    const CheckForNull null_check =
-        array.type.is_nullable() ? kWithNullCheck : kWithoutNullCheck;
     // Perform bounds check.
-    Node* length = gasm_.ArrayLength(array.node, null_check);
+    Node* length = gasm_.ArrayLength(array.node, array.null_check());
     SetSourcePosition(length);
     gasm_.TrapUnless(gasm_.Uint32LessThan(index.node, length),
                      TrapId::kTrapArrayOutOfBounds);
diff --git a/test/mjsunit/regress/wasm/regress-558539954.js b/test/mjsunit/regress/wasm/regress-558539954.js
new file mode 100644
index 0000000..90fd14c
--- /dev/null
+++ b/test/mjsunit/regress/wasm/regress-558539954.js
@@ -0,0 +1,183 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --turbo-inline-js-wasm-calls
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+let array_type = builder.addArray(kWasmI32);
+let struct_type = builder.addStruct([makeField(kWasmI32, true)]);
+
+let make_array = builder.addFunction('make_array', makeSig([], [kWasmExternRef])).exportFunc();
+make_array.addBody([
+  kExprI32Const, 10,
+  kGCPrefix, kExprArrayNewDefault, array_type,
+  kGCPrefix, kExprExternConvertAny,
+]);
+
+let make_struct = builder.addFunction('make_struct', makeSig([], [kWasmExternRef])).exportFunc();
+make_struct.addBody([
+  kExprI32Const, 42,
+  kGCPrefix, kExprStructNew, struct_type,
+  kGCPrefix, kExprExternConvertAny,
+]);
+
+// 1. Abstract cast: ref.cast array
+let abstract_cast = builder.addFunction('abstract_cast', makeSig([kWasmExternRef], [kWasmExternRef])).exportFunc();
+abstract_cast.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprAnyConvertExtern,
+  kGCPrefix, kExprRefCast, kArrayRefCode,
+  kGCPrefix, kExprExternConvertAny,
+]);
+
+// 2. Abstract cast: ref.cast null array
+let abstract_cast_null = builder.addFunction('abstract_cast_null', makeSig([kWasmExternRef], [kWasmExternRef])).exportFunc();
+abstract_cast_null.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprAnyConvertExtern,
+  kGCPrefix, kExprRefCastNull, kArrayRefCode,
+  kGCPrefix, kExprExternConvertAny,
+]);
+
+// 3. Concrete cast: ref.cast <array_type>
+let concrete_cast = builder.addFunction('concrete_cast', makeSig([kWasmExternRef], [kWasmExternRef])).exportFunc();
+concrete_cast.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprAnyConvertExtern,
+  kGCPrefix, kExprRefCast, array_type,
+  kGCPrefix, kExprExternConvertAny,
+]);
+
+// 4. Concrete cast: ref.cast null <array_type>
+let concrete_cast_null = builder.addFunction('concrete_cast_null', makeSig([kWasmExternRef], [kWasmExternRef])).exportFunc();
+concrete_cast_null.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprAnyConvertExtern,
+  kGCPrefix, kExprRefCastNull, array_type,
+  kGCPrefix, kExprExternConvertAny,
+]);
+
+// 5. Abstract cast then array.len
+let cast_then_len = builder.addFunction('cast_then_len', makeSig([kWasmExternRef], [kWasmI32])).exportFunc();
+cast_then_len.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprAnyConvertExtern,
+  kGCPrefix, kExprRefCast, kArrayRefCode,
+  kGCPrefix, kExprArrayLen,
+]);
+
+let cast_null_then_len = builder.addFunction('cast_null_then_len', makeSig([kWasmExternRef], [kWasmI32])).exportFunc();
+cast_null_then_len.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprAnyConvertExtern,
+  kGCPrefix, kExprRefCastNull, kArrayRefCode,
+  kGCPrefix, kExprArrayLen,
+]);
+
+// 6. Direct array.len and struct.get with nullable parameter
+let array_len = builder.addFunction('array_len', makeSig([wasmRefNullType(array_type)], [kWasmI32])).exportFunc();
+array_len.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprArrayLen,
+]);
+
+let struct_get = builder.addFunction('struct_get', makeSig([wasmRefNullType(struct_type)], [kWasmI32])).exportFunc();
+struct_get.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprStructGet, struct_type, 0,
+]);
+
+const instance = builder.instantiate();
+const wasm_array = instance.exports.make_array();
+const wasm_struct = instance.exports.make_struct();
+
+function testOptimized(run, fctToOptimize) {
+  %DeoptimizeFunction(fctToOptimize);
+  %PrepareFunctionForOptimization(fctToOptimize);
+  run();
+  %OptimizeFunctionOnNextCall(fctToOptimize);
+  run();
+  assertOptimized(fctToOptimize);
+}
+
+// Test abstract cast (non-nullable)
+function test_abstract(x) {
+  return instance.exports.abstract_cast(x);
+}
+testOptimized(() => {
+  assertSame(wasm_array, test_abstract(wasm_array));
+  assertThrows(() => test_abstract(null), WebAssembly.RuntimeError, /illegal cast/);
+  assertThrows(() => test_abstract(undefined), WebAssembly.RuntimeError, /illegal cast/);
+  assertThrows(() => test_abstract({}), WebAssembly.RuntimeError, /illegal cast/);
+  assertThrows(() => test_abstract(123), WebAssembly.RuntimeError, /illegal cast/);
+}, test_abstract);
+
+// Test abstract cast (nullable)
+function test_abstract_null(x) {
+  return instance.exports.abstract_cast_null(x);
+}
+testOptimized(() => {
+  assertSame(wasm_array, test_abstract_null(wasm_array));
+  assertEquals(null, test_abstract_null(null));
+  assertThrows(() => test_abstract_null(undefined), WebAssembly.RuntimeError, /illegal cast/);
+  assertThrows(() => test_abstract_null({}), WebAssembly.RuntimeError, /illegal cast/);
+  assertThrows(() => test_abstract_null(123), WebAssembly.RuntimeError, /illegal cast/);
+}, test_abstract_null);
+
+// Test concrete cast (non-nullable)
+function test_concrete(x) {
+  return instance.exports.concrete_cast(x);
+}
+testOptimized(() => {
+  assertSame(wasm_array, test_concrete(wasm_array));
+  assertThrows(() => test_concrete(null), WebAssembly.RuntimeError, /illegal cast/);
+  assertThrows(() => test_concrete(wasm_struct), WebAssembly.RuntimeError, /illegal cast/);
+}, test_concrete);
+
+// Test concrete cast (nullable)
+function test_concrete_null(x) {
+  return instance.exports.concrete_cast_null(x);
+}
+testOptimized(() => {
+  assertSame(wasm_array, test_concrete_null(wasm_array));
+  assertEquals(null, test_concrete_null(null));
+  assertThrows(() => test_concrete_null(wasm_struct), WebAssembly.RuntimeError, /illegal cast/);
+}, test_concrete_null);
+
+// Test cast then array.len
+function test_cast_len(x) {
+  return instance.exports.cast_then_len(x);
+}
+testOptimized(() => {
+  assertEquals(10, test_cast_len(wasm_array));
+  assertThrows(() => test_cast_len(null), WebAssembly.RuntimeError, /illegal cast/);
+}, test_cast_len);
+
+function test_cast_null_len(x) {
+  return instance.exports.cast_null_then_len(x);
+}
+testOptimized(() => {
+  assertEquals(10, test_cast_null_len(wasm_array));
+  assertThrows(() => test_cast_null_len(null), WebAssembly.RuntimeError, /null pointer/);
+}, test_cast_null_len);
+
+// Test direct array.len on null
+function test_len(x) {
+  return instance.exports.array_len(x);
+}
+testOptimized(() => {
+  assertEquals(10, test_len(wasm_array));
+  assertThrows(() => test_len(null), WebAssembly.RuntimeError, /null pointer/);
+}, test_len);
+
+// Test direct struct.get on null
+function test_get(x) {
+  return instance.exports.struct_get(x);
+}
+testOptimized(() => {
+  assertEquals(42, test_get(wasm_struct));
+  assertThrows(() => test_get(null), WebAssembly.RuntimeError, /null pointer/);
+}, test_get);

diff --git a/test/mjsunit/regress/wasm/regress-558539954.js b/test/mjsunit/regress/wasm/regress-558539954.js
new file mode 100644
index 0000000..90fd14c
--- /dev/null
+++ b/test/mjsunit/regress/wasm/regress-558539954.js
@@ -0,0 +1,183 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --turbo-inline-js-wasm-calls
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+let array_type = builder.addArray(kWasmI32);
+let struct_type = builder.addStruct([makeField(kWasmI32, true)]);
+
+let make_array = builder.addFunction('make_array', makeSig([], [kWasmExternRef])).exportFunc();
+make_array.addBody([
+  kExprI32Const, 10,
+  kGCPrefix, kExprArrayNewDefault, array_type,
+  kGCPrefix, kExprExternConvertAny,
+]);
+
+let make_struct = builder.addFunction('make_struct', makeSig([], [kWasmExternRef])).exportFunc();
+make_struct.addBody([
+  kExprI32Const, 42,
+  kGCPrefix, kExprStructNew, struct_type,
+  kGCPrefix, kExprExternConvertAny,
+]);
+
+// 1. Abstract cast: ref.cast array
+let abstract_cast = builder.addFunction('abstract_cast', makeSig([kWasmExternRef], [kWasmExternRef])).exportFunc();
+abstract_cast.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprAnyConvertExtern,
+  kGCPrefix, kExprRefCast, kArrayRefCode,
+  kGCPrefix, kExprExternConvertAny,
+]);
+
+// 2. Abstract cast: ref.cast null array
+let abstract_cast_null = builder.addFunction('abstract_cast_null', makeSig([kWasmExternRef], [kWasmExternRef])).exportFunc();
+abstract_cast_null.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprAnyConvertExtern,
+  kGCPrefix, kExprRefCastNull, kArrayRefCode,
+  kGCPrefix, kExprExternConvertAny,
+]);
+
+// 3. Concrete cast: ref.cast <array_type>
+let concrete_cast = builder.addFunction('concrete_cast', makeSig([kWasmExternRef], [kWasmExternRef])).exportFunc();
+concrete_cast.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprAnyConvertExtern,
+  kGCPrefix, kExprRefCast, array_type,
+  kGCPrefix, kExprExternConvertAny,
+]);
+
+// 4. Concrete cast: ref.cast null <array_type>
+let concrete_cast_null = builder.addFunction('concrete_cast_null', makeSig([kWasmExternRef], [kWasmExternRef])).exportFunc();
+concrete_cast_null.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprAnyConvertExtern,
+  kGCPrefix, kExprRefCastNull, array_type,
+  kGCPrefix, kExprExternConvertAny,
+]);
+
+// 5. Abstract cast then array.len
+let cast_then_len = builder.addFunction('cast_then_len', makeSig([kWasmExternRef], [kWasmI32])).exportFunc();
+cast_then_len.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprAnyConvertExtern,
+  kGCPrefix, kExprRefCast, kArrayRefCode,
+  kGCPrefix, kExprArrayLen,
+]);
+
+let cast_null_then_len = builder.addFunction('cast_null_then_len', makeSig([kWasmExternRef], [kWasmI32])).exportFunc();
+cast_null_then_len.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprAnyConvertExtern,
+  kGCPrefix, kExprRefCastNull, kArrayRefCode,
+  kGCPrefix, kExprArrayLen,
+]);
+
+// 6. Direct array.len and struct.get with nullable parameter
+let array_len = builder.addFunction('array_len', makeSig([wasmRefNullType(array_type)], [kWasmI32])).exportFunc();
+array_len.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprArrayLen,
+]);
+
+let struct_get = builder.addFunction('struct_get', makeSig([wasmRefNullType(struct_type)], [kWasmI32])).exportFunc();
+struct_get.addBody([
+  kExprLocalGet, 0,
+  kGCPrefix, kExprStructGet, struct_type, 0,
+]);
+
+const instance = builder.instantiate();
+const wasm_array = instance.exports.make_array();
+const wasm_struct = instance.exports.make_struct();
+
+function testOptimized(run, fctToOptimize) {
+  %DeoptimizeFunction(fctToOptimize);
+  %PrepareFunctionForOptimization(fctToOptimize);
+  run();
+  %OptimizeFunctionOnNextCall(fctToOptimize);
+  run();
+  assertOptimized(fctToOptimize);
+}
+
+// Test abstract cast (non-nullable)
+function test_abstract(x) {
+  return instance.exports.abstract_cast(x);
+}
+testOptimized(() => {
+  assertSame(wasm_array, test_abstract(wasm_array));
+  assertThrows(() => test_abstract(null), WebAssembly.RuntimeError, /illegal cast/);
+  assertThrows(() => test_abstract(undefined), WebAssembly.RuntimeError, /illegal cast/);
+  assertThrows(() => test_abstract({}), WebAssembly.RuntimeError, /illegal cast/);
+  assertThrows(() => test_abstract(123), WebAssembly.RuntimeError, /illegal cast/);
+}, test_abstract);
+
+// Test abstract cast (nullable)
+function test_abstract_null(x) {
+  return instance.exports.abstract_cast_null(x);
+}
+testOptimized(() => {
+  assertSame(wasm_array, test_abstract_null(wasm_array));
+  assertEquals(null, test_abstract_null(null));
+  assertThrows(() => test_abstract_null(undefined), WebAssembly.RuntimeError, /illegal cast/);
+  assertThrows(() => test_abstract_null({}), WebAssembly.RuntimeError, /illegal cast/);
+  assertThrows(() => test_abstract_null(123), WebAssembly.RuntimeError, /illegal cast/);
+}, test_abstract_null);
+
+// Test concrete cast (non-nullable)
+function test_concrete(x) {
+  return instance.exports.concrete_cast(x);
+}
+testOptimized(() => {
+  assertSame(wasm_array, test_concrete(wasm_array));
+  assertThrows(() => test_concrete(null), WebAssembly.RuntimeError, /illegal cast/);
+  assertThrows(() => test_concrete(wasm_struct), WebAssembly.RuntimeError, /illegal cast/);
+}, test_concrete);
+
+// Test concrete cast (nullable)
+function test_concrete_null(x) {
+  return instance.exports.concrete_cast_null(x);
+}
+testOptimized(() => {
+  assertSame(wasm_array, test_concrete_null(wasm_array));
+  assertEquals(null, test_concrete_null(null));
+  assertThrows(() => test_concrete_null(wasm_struct), WebAssembly.RuntimeError, /illegal cast/);
+}, test_concrete_null);
+
+// Test cast then array.len
+function test_cast_len(x) {
+  return instance.exports.cast_then_len(x);
+}
+testOptimized(() => {
+  assertEquals(10, test_cast_len(wasm_array));
+  assertThrows(() => test_cast_len(null), WebAssembly.RuntimeError, /illegal cast/);
+}, test_cast_len);
+
+function test_cast_null_len(x) {
+  return instance.exports.cast_null_then_len(x);
+}
+testOptimized(() => {
+  assertEquals(10, test_cast_null_len(wasm_array));
+  assertThrows(() => test_cast_null_len(null), WebAssembly.RuntimeError, /null pointer/);
+}, test_cast_null_len);
+
+// Test direct array.len on null
+function test_len(x) {
+  return instance.exports.array_len(x);
+}
+testOptimized(() => {
+  assertEquals(10, test_len(wasm_array));
+  assertThrows(() => test_len(null), WebAssembly.RuntimeError, /null pointer/);
+}, test_len);
+
+// Test direct struct.get on null
+function test_get(x) {
+  return instance.exports.struct_get(x);
+}
+testOptimized(() => {
+  assertEquals(42, test_get(wasm_struct));
+  assertThrows(() => test_get(null), WebAssembly.RuntimeError, /null pointer/);
+}, test_get);