[clang][WebAssembly] Implement support for table types and appropriate semantic restrictions

[asb]

Summary

This patch isn't yet ready for merging, but I think is ready for high-level review. Note that it assumes something like this has been merged into D122215.

Todo:

• funcref support and test coverage

WebAssembly tables are modeled at the IR level as arrays in address space 1. As the instructions accessing tables take the table index as an immediate, use of tables is very restricted (i.e. it isn't possible to pass as an argument etc). This patch models tables in C as arrays of reference types and adds various semantic restrictions to avoid illegal uses. Some of these restrictions overlap with those for sizeless types, while of course the limitations on passing in parameters and so on go above and beyond that.

I'd really appreciate any high-level feedback / questions / concerns about this approach at this point.

[asb]

Addresses some potential null pointer dereferences.

[asb]

Update to latest version and update summary. As I say there, it would be really helpful to get some feedback at this point.

[rjmccall]

Sounds like you need an RFC thread on the forums describing the underlying WebAssembly feature and your proposed language design for exposing it in C.

[tlively]

clang/test/CodeGen/WebAssembly/table.c

5

Why must tables be declared with 0 size? I would expect declaring any concrete size to work, since the underlying module can declare tables of any size. Also, how will all this work with table growth? Is there some danger of static analysis thinking that a table has an out-of-bound access when in fact it has been grown beyond its original size? Would declaring a sizeless table help there?

clang/test/Sema/wasm-refs-and-tables.c

10

This error message is confusing because it's not really the element type that is the problem, but rather the lack of size declaration on the array itself. Also, as a matter of UX, it would be nice if we could avoid printing __attribute__((address_space(1))) as part of the externref type.

11

Is this a temporary restriction? The underlying Wasm format supports initializers.

12

Why is this?

35

Are we going to be able to work around this to provide a builtin for table.grow?

75

Does this need a separate error message since it isn't a binary expression?

[asb]

Update to address review comments.

@rjmccall: That makes sense - I'll write up an RFC for this. Thanks for taking a look.

clang/test/CodeGen/WebAssembly/table.c

5

That's a limitation in this initial support for tables but needn't be a limitation going forward. We don't currently support generating table initialisers, but I think tables can still be useful without that (so that functionality can be split out to some future patch).

Regarding static analysis: potentially a static analyser will complain until it's taught to ignore tables. Using something other than an array type (either just a pointer or new sizeless type) is definitely an alternative, but in the case of a pointer there's not good story for adding syntax to support initialisation. Introducing a new sizeless type would need a story on indicating the type of the table's contents. Modelling as an array at least gives us those things (and array-like syntax for getting/setting elements, though I'm not sure that's a big factor one way or another). Which all to say I'm totally open to alternatives, but when I started on this I'd understood that arrays were the current preferred approach and when I considered those other options, it didn't feel like the others were clearly better (just different trade-offs!).

clang/test/Sema/wasm-refs-and-tables.c

10

This error message is inherited from the code to support sizeless types. But it's easy enough to cover this case alongside the one for non-zero size, so I've done that. That also covers the initialisation case for the time being.

11

Yes that's right, I've changed the message now to be clearer this is a current restriction rather than a fundamental one.

12

I understood that's what had been agreed as the initial way to expose them, and going beyond that, I don't think there's a clear story on sharing tables between compilation units. So I'd again put this down to the "MVP"-ness of the patch.

35

Yep, D124162 provides the builtins that don't use element segments. Using custom type-checking for those builtins neatly sidesteps this being an issue.

75

Good point, that would be more precise. I've added one now.

[asb]

Re-add full context.

[tlively]

Nice! code looks good to me, but we'll need community signoff on an RFC as @rjmccall mentioned and it would be nice to have a clang maintainer sign off as well.

clang/test/CodeGen/WebAssembly/table.c

5

By "sizeless table" I meant using an array type without a size (not sure if there's a more precise term for that), so something like static __externref_t table[]. I wonder if that would help avoid false positives from static analyzers because they wouldn't be able to reason about sizes.

But starting out with many restrictions and incrementally relaxing them as necessary sounds good 👍

clang/test/Sema/wasm-refs-and-tables.c

12

Sounds good for the MVP. I expect that it will be useful to share tables across compilation units in the future, and I think we might even have support for the necessary table relocations in the backend and linker thanks to @pmatos's work.

[asb]

Rebase, and fix+test missed error case (taking the address of table).

[asb]

In D123510#3465123, @rjmccall wrote:

Sounds like you need an RFC thread on the forums describing the underlying WebAssembly feature and your proposed language design for exposing it in C.

Now posted as https://discourse.llvm.org/t/rfc-webassembly-tables-in-clang/62049

[asb]

Added semantic restrictions for C++ specific constructs.

It would likely make sense to introduce a isWebAssemblyTable method and refacctor to use that.

[asb]

Add a isWebAssemblyTable helper and refactor to use it.

[asb]

Rebase (partial - rebases my patch stack on top of latest LLVM, but still needs a rebase on to Paulo's patch introducing funcref support).

[asb]

Rebase on top of D128440

[asb]

Rebase again.

[pmatos]

@asb This can _also_ be closed since table support landed.

[asb]

Abandoning, as this was ultimately merged into D139010 which has now landed.

clang/include/clang/Basic/DiagnosticSemaKinds.td

 def err_cast_from_randomized_struct : Error<
   "casting from randomized structure pointer type %0 to %1">;
 
 // WebAssembly reference type and table diagnostics
 def err_wasm_reference_pointer : Error<
   "pointers to WebAssembly reference types are illegal">;
 def err_wasm_addrof_reference : Error<
   "cannot take address of WebAssembly reference">;
+def err_cant_init_wasm_table : Error<
+  "WebAssembly table cannot have an initializer">;
+def err_typecheck_wasm_table_must_have_zero_length : Error<
+  "WebAssembly table must be zero-length">;
+def err_wasm_table_in_function : Error<
+  "WebAssembly table cannot be declared within a function">;
+def err_wasm_table_as_function_argument : Error<
+  "cannot use WebAssembly table as a function argument">;
+def err_wasm_table_invalid_uett_operand : Error<
+  "invalid application of '%0' to WebAssembly table">;
+def err_wasm_cast_table : Error<
+  "cannot cast WebAssembly table">;
+def err_wasm_table_assignment : Error<
+  "cannot assign WebAssembly table to a variable">;
+def err_wasm_table_return : Error<
+  "cannot return a WebAssembly table">;
+def err_wasm_table_must_be_static : Error<
+  "WebAssembly table must be static">;
+def err_wasm_multidimensional_ref_array : Error<
+  "multi-dimensional arrays of WebAssembly references are illegal">;
 } // end of sema component.

clang/lib/Sema/SemaCast.cpp

else
       return;
     assert(SrcExpr.isUsable());
   }
   SrcExpr = Self.DefaultFunctionArrayLvalueConversion(SrcExpr.get());
   if (SrcExpr.isInvalid())
     return;
   QualType SrcType = SrcExpr.get()->getType();
 
+  if (SrcType->isPointerType() &&
+      SrcType->getPointeeType()->isWebAssemblyReferenceType()) {
+    Self.Diag(OpRange.getBegin(), diag::err_wasm_cast_table)
+        << SrcExpr.get()->getSourceRange();
+    SrcExpr = ExprError();
+    return;
+  }
+
   assert(!SrcType->isPlaceholderType());
 
   checkAddressSpaceCast(SrcType, DestType);
   if (SrcExpr.isInvalid())
     return;
 
   if (Self.RequireCompleteType(OpRange.getBegin(), DestType,
                                diag::err_typecheck_cast_to_incomplete)) {

clang/lib/Sema/SemaDecl.cpp

if (TSC != TSCS_unspecified) {
       Diag(D.getDeclSpec().getThreadStorageClassSpecLoc(),
            diag::err_opencl_unknown_type_specifier)
           << getLangOpts().getOpenCLVersionString()
           << DeclSpec::getSpecifierName(TSC) << 1;
       NewVD->setInvalidDecl();
     }
   }
 
+  // WebAssembly tables are always in address space 1 (wasm_var). Don't apply
+  // address space if the table has local storage (semantic checks elsewhere
+  // will produce an error anyway).
+  if (const Type *ElTy = NewVD->getType()->getArrayElementTypeNoTypeQual()) {
+    if (ElTy && ElTy->isWebAssemblyReferenceType() &&
+        !NewVD->hasLocalStorage()) {
+      QualType Type = Context.getAddrSpaceQualType(
+          NewVD->getType(), Context.getLangASForBuiltinAddressSpace(1));
+      NewVD->setType(Type);
+    }
+  }
+
   // Handle attributes prior to checking for duplicates in MergeVarDecl
   ProcessDeclAttributes(S, NewVD, D);
 
   // FIXME: This is probably the wrong location to be doing this and we should
   // probably be doing this for more attributes (especially for function
   // pointer attributes such as format, warn_unused_result, etc.). Ideally
   // the code to copy attributes would be generated by TableGen.
   if (R->isFunctionPointerType())
if (NewVD->hasLocalStorage() && T.isObjCGCWeak()
     if (getLangOpts().getGC() != LangOptions::NonGC)
       Diag(NewVD->getLocation(), diag::warn_gc_attribute_weak_on_local);
     else {
       assert(!getLangOpts().ObjCAutoRefCount);
       Diag(NewVD->getLocation(), diag::warn_attribute_weak_on_local);
     }
   }
 
+  // WebAssembly tables must be static with a zero length and can't be
+  // declared within functions.
+  if (const auto *ATy = dyn_cast<ConstantArrayType>(T.getTypePtr())) {
+    if (ATy->getElementType()->isWebAssemblyReferenceType()) {
+      if (getCurScope()->isFunctionScope()) {
+        Diag(NewVD->getLocation(), diag::err_wasm_table_in_function);
+        NewVD->setInvalidDecl();
+        return;
+      }
+      if (NewVD->getStorageClass() != SC_Static) {
+        Diag(NewVD->getLocation(), diag::err_wasm_table_must_be_static);
+        NewVD->setInvalidDecl();
+        return;
+      }
+      if (ATy->getSize().getSExtValue() != 0) {
+        Diag(NewVD->getLocation(),
+             diag::err_typecheck_wasm_table_must_have_zero_length);
+        NewVD->setInvalidDecl();
+        return;
+      }
+    }
+  }
+
   bool isVM = T->isVariablyModifiedType();
   if (isVM || NewVD->hasAttr<CleanupAttr>() ||
       NewVD->hasAttr<BlocksAttr>())
     setFunctionHasBranchProtectedScope();
 
   if ((isVM && NewVD->hasLinkage()) ||
       (T->isVariableArrayType() && NewVD->hasGlobalStorage())) {
     bool SizeIsNegative;
if (getLangOpts().getOpenCLCompatibleVersion() >= 200) {
       if(const PipeType *PipeTy = PT->getAs<PipeType>()) {
         QualType ElemTy = PipeTy->getElementType();
           if (ElemTy->isReferenceType() || ElemTy->isPointerType()) {
             Diag(Param->getTypeSpecStartLoc(), diag::err_reference_pipe_type );
             D.setInvalidType();
           }
       }
     }
+    // WebAssembly tables can't be used as function parameters.
+    if (Context.getTargetInfo().getTriple().isWasm()) {
+      while (PT->isPointerType()) {
+        PT = PT->getPointeeType();
+        if (PT->isWebAssemblyReferenceType() ||
+            PT->getBaseElementTypeUnsafe()->isWebAssemblyReferenceType()) {
+          Diag(Param->getTypeSpecStartLoc(),
+               diag::err_wasm_table_as_function_argument);
+          D.setInvalidType();
+        }
+      }
+    }
   }
 
   // Here we have an function template explicit specialization at class scope.
   // The actual specialization will be postponed to template instatiation
   // time via the ClassScopeFunctionSpecializationDecl node.
   if (isDependentClassScopeExplicitSpecialization) {
     ClassScopeFunctionSpecializationDecl *NewSpec =
                          ClassScopeFunctionSpecializationDecl::Create(
void Sema::AddInitializerToDecl(Decl *RealDecl, Expr *Init, bool DirectInit) {
   VarDecl *VDecl = dyn_cast<VarDecl>(RealDecl);
   if (!VDecl) {
     assert(!isa<FieldDecl>(RealDecl) && "field init shouldn't get here");
     Diag(RealDecl->getLocation(), diag::err_illegal_initializer);
     RealDecl->setInvalidDecl();
     return;
   }
 
+  // WebAssembly tables can't be used to initialise a variable.
+  if (Init && !Init->getType().isNull() && Init->getType()->isArrayType() &&
+      Init->getType()
+          ->getArrayElementTypeNoTypeQual()
+          ->isWebAssemblyReferenceType()) {
+    Diag(Init->getExprLoc(), diag::err_wasm_table_assignment);
+    VDecl->setInvalidDecl();
+    return;
+  }
+
   // C++11 [decl.spec.auto]p6. Deduce the type which 'auto' stands in for.
   if (VDecl->getType()->isUndeducedType()) {
     // Attempt typo correction early so that the type of the init expression can
     // be deduced based on the chosen correction if the original init contains a
     // TypoExpr.
     ExprResult Res = CorrectDelayedTyposInExpr(Init, VDecl);
     if (!Res.isUsable()) {
       // There are unresolved typos in Init, just drop them.
void Sema::AddInitializerToDecl(Decl *RealDecl, Expr *Init, bool DirectInit) {
 
   // The LoaderUninitialized attribute acts as a definition (of undef).
   if (VDecl->hasAttr<LoaderUninitializedAttr>()) {
     Diag(VDecl->getLocation(), diag::err_loader_uninitialized_cant_init);
     VDecl->setInvalidDecl();
     return;
   }
 
+  // WebAssembly tables (arrays of reference types) can't be initialized.
+  if (const Type *ElTy = VDecl->getType()->getArrayElementTypeNoTypeQual()) {
+    if (ElTy && ElTy->isWebAssemblyReferenceType()) {
+      Diag(VDecl->getLocation(), diag::err_cant_init_wasm_table);
+      VDecl->setInvalidDecl();
+      return;
+    }
+  }
+
   // Get the decls type and save a reference for later, since
   // CheckInitializerTypes may change it.
   QualType DclT = VDecl->getType(), SavT = DclT;
 
   // Expressions default to 'id' when we're in a debugger
   // and we are assigning it to a variable of Objective-C pointer type.
   if (getLangOpts().DebuggerCastResultToId && DclT->isObjCObjectPointerType() &&
       Init->getType() == Context.UnknownAnyTy) {

clang/lib/Sema/SemaExpr.cpp

if (ExprKind == UETT_VecStep)
     return CheckVecStepTraitOperandType(*this, ExprTy, E->getExprLoc(),
                                         E->getSourceRange());
 
   // Explicitly list some types as extensions.
   if (!CheckExtensionTraitOperandType(*this, ExprTy, E->getExprLoc(),
                                       E->getSourceRange(), ExprKind))
     return false;
 
+  // WebAssembly tables are always illegal operands to unary expressions and
+  // type traits.
+  if (Context.getTargetInfo().getTriple().isWasm()) {
+    const Type *ElTy = E->getType()->getArrayElementTypeNoTypeQual();
+    if (ElTy && ElTy->isWebAssemblyReferenceType()) {
+      Diag(E->getExprLoc(), diag::err_wasm_table_invalid_uett_operand)
+          << getTraitSpelling(ExprKind);
+      return true;
+    }
+  }
+
   // 'alignof' applied to an expression only requires the base element type of
   // the expression to be complete. 'sizeof' requires the expression's type to
   // be complete (and will attempt to complete it if it's an array of unknown
   // bound).
   if (ExprKind == UETT_AlignOf || ExprKind == UETT_PreferredAlignOf) {
     if (RequireCompleteSizedType(
             E->getExprLoc(), Context.getBaseElementType(E->getType()),
             diag::err_sizeof_alignof_incomplete_or_sizeless_type,
if (RequireCompleteSizedType(
     return true;
 
   if (ExprType->isFunctionType()) {
     Diag(OpLoc, diag::err_sizeof_alignof_function_type)
         << getTraitSpelling(ExprKind) << ExprRange;
     return true;
   }
 
+  // WebAssembly tables are always illegal operands to unary expressions and
+  // type traits.
+  if (Context.getTargetInfo().getTriple().isWasm()) {
+    const Type *ElTy = ExprType->getBaseElementTypeUnsafe();
+    if (ElTy != ExprType.getTypePtr() && ElTy->isWebAssemblyReferenceType()) {
+      Diag(OpLoc, diag::err_wasm_table_invalid_uett_operand)
+          << getTraitSpelling(ExprKind);
+      return true;
+    }
+  }
+
   if (CheckObjCTraitOperandConstraints(*this, ExprType, OpLoc, ExprRange,
                                        ExprKind))
     return true;
 
   return false;
 }
 
 static bool CheckAlignOfExpr(Sema &S, Expr *E, UnaryExprOrTypeTrait ExprKind) {
if (ResultType->isVoidType() && !getLangOpts().CPlusPlus) {
     Diag(LLoc, diag::ext_gnu_subscript_void_type)
       << BaseExpr->getSourceRange();
 
     // C forbids expressions of unqualified void type from being l-values.
     // See IsCForbiddenLValueType.
     if (!ResultType.hasQualifiers())
       VK = VK_PRValue;
   } else if (!ResultType->isDependentType() &&
+             !ResultType->isWebAssemblyReferenceType() &&
              RequireCompleteSizedType(
                  LLoc, ResultType,
                  diag::err_subscript_incomplete_or_sizeless_type, BaseExpr))
     return ExprError();
 
   assert(VK == VK_PRValue || LangOpts.CPlusPlus ||
          !ResultType.isCForbiddenLValueType());
 
ExprResult Sema::BuildResolvedCallExpr(Expr *Fn, NamedDecl *NDecl,
   if (CheckCallReturnType(FuncT->getReturnType(), Fn->getBeginLoc(), TheCall,
                           FDecl))
     return ExprError();
 
   // We know the result type of the call, set it.
   TheCall->setType(FuncT->getCallResultType(Context));
   TheCall->setValueKind(Expr::getValueKindForType(FuncT->getReturnType()));
 
+  // WebAssembly tables can't be used as arguments.
+  if (Context.getTargetInfo().getTriple().isWasm()) {
+    for (const Expr *Arg : Args) {
+      if (Arg) {
+        if (const Type *ElTy =
+                Arg->getType()->getArrayElementTypeNoTypeQual()) {
+          if (ElTy && ElTy->isWebAssemblyReferenceType()) {
+            return ExprError(Diag(Arg->getExprLoc(),
+                                  diag::err_wasm_table_as_function_argument));
+          }
+        }
+      }
+    }
+  }
+
   if (Proto) {
     if (ConvertArgumentsForCall(TheCall, Fn, FDecl, Proto, Args, RParenLoc,
                                 IsExecConfig))
       return ExprError();
   } else {
     assert(isa<FunctionNoProtoType>(FuncT) && "Unknown FunctionType!");
 
     if (FDecl) {
QualType Sema::CheckConditionalOperands(ExprResult &Cond, ExprResult &LHS,
 
   QualType ResTy =
       UsualArithmeticConversions(LHS, RHS, QuestionLoc, ACK_Conditional);
   if (LHS.isInvalid() || RHS.isInvalid())
     return QualType();
 
   QualType LHSTy = LHS.get()->getType();
   QualType RHSTy = RHS.get()->getType();
+  if ((LHSTy->isPointerType() &&
+       LHSTy->getPointeeType()->isWebAssemblyReferenceType()) ||
+      (RHSTy->isPointerType() &&
+       RHSTy->getPointeeType()->isWebAssemblyReferenceType()))
+    return InvalidOperands(QuestionLoc, LHS, RHS);
 
   // Diagnose attempts to convert between __ibm128, __float128 and long double
   // where such conversions currently can't be handled.
   if (unsupportedTypeConversion(*this, LHSTy, RHSTy)) {
     Diag(QuestionLoc,
          diag::err_typecheck_cond_incompatible_operands) << LHSTy << RHSTy
       << LHS.get()->getSourceRange() << RHS.get()->getSourceRange();
     return QualType();
QualType Sema::CheckCompareOperands(ExprResult &LHS, ExprResult &RHS,
   diagnoseTautologicalComparison(*this, Loc, LHS.get(), RHS.get(), Opc);
 
   QualType LHSType = LHS.get()->getType();
   QualType RHSType = RHS.get()->getType();
   if ((LHSType->isArithmeticType() || LHSType->isEnumeralType()) &&
       (RHSType->isArithmeticType() || RHSType->isEnumeralType()))
     return checkArithmeticOrEnumeralCompare(*this, LHS, RHS, Loc, Opc);
 
+  if ((LHSType->isPointerType() &&
+       LHSType->getPointeeType()->isWebAssemblyReferenceType()) ||
+      (RHSType->isPointerType() &&
+       RHSType->getPointeeType()->isWebAssemblyReferenceType()))
+    return InvalidOperands(Loc, LHS, RHS);
+
   const Expr::NullPointerConstantKind LHSNullKind =
       LHS.get()->isNullPointerConstant(Context, Expr::NPC_ValueDependentIsNull);
   const Expr::NullPointerConstantKind RHSNullKind =
       RHS.get()->isNullPointerConstant(Context, Expr::NPC_ValueDependentIsNull);
   bool LHSIsNull = LHSNullKind != Expr::NPCK_NotNull;
   bool RHSIsNull = RHSNullKind != Expr::NPCK_NotNull;
 
   auto computeResultTy = [&]() {
if (const auto *DREHS = dyn_cast<DeclRefExpr>(HS.get())) {
       if (ECDHS && ECDHS->getInitVal() != 0 && ECDHS->getInitVal() != 1)
         EnumConstantInBoolContext = true;
     }
   }
 
   if (EnumConstantInBoolContext)
     Diag(Loc, diag::warn_enum_constant_in_bool_context);
 
+  // WebAssembly tables can't be used with logical operators.
+  QualType LHSTy = LHS.get()->getType();
+  QualType RHSTy = RHS.get()->getType();
+  if ((LHSTy->isArrayType() &&
+       LHSTy->getArrayElementTypeNoTypeQual()->isWebAssemblyReferenceType()) ||
+      (RHSTy->isArrayType() &&
+       RHSTy->getArrayElementTypeNoTypeQual()->isWebAssemblyReferenceType())) {
+    return InvalidOperands(Loc, LHS, RHS);
+  }
+
   // Diagnose cases where the user write a logical and/or but probably meant a
   // bitwise one.  We do this when the LHS is a non-bool integer and the RHS
   // is a constant.
   if (!EnumConstantInBoolContext && LHS.get()->getType()->isIntegerType() &&
       !LHS.get()->getType()->isBooleanType() &&
       RHS.get()->getType()->isIntegerType() && !RHS.get()->isValueDependent() &&
       // Don't warn in macros or template instantiations.
       !Loc.isMacroID() && !inTemplateInstantiation()) {
QualType Sema::CheckAssignmentOperands(Expr *LHSExpr, ExprResult &RHS,
   if (getLangOpts().OpenCL &&
       !getOpenCLOptions().isAvailableOption("cl_khr_fp16", getLangOpts()) &&
       LHSType->isHalfType()) {
     Diag(Loc, diag::err_opencl_half_load_store) << 1
         << LHSType.getUnqualifiedType();
     return QualType();
   }
 
+  // WebAssembly tables can't be used on RHS of an assignment expression.
+  if (RHSType->isArrayType() &&
+      RHSType->getArrayElementTypeNoTypeQual()->isWebAssemblyReferenceType()) {
+    Diag(Loc, diag::err_wasm_table_assignment);
+    return QualType();
+  }
+
   AssignConvertType ConvTy;
   if (CompoundType.isNull()) {
     Expr *RHSCheck = RHS.get();
 
     CheckIdentityFieldAssignment(LHSExpr, RHSCheck, Loc, *this);
 
     QualType LHSTy(LHSType);
     ConvTy = CheckSingleAssignmentConstraints(LHSTy, RHS);
case UO_LNot: // logical negation
     resultType = Input.get()->getType();
 
     // Though we still have to promote half FP to float...
     if (resultType->isHalfType() && !Context.getLangOpts().NativeHalfType) {
       Input = ImpCastExprToType(Input.get(), Context.FloatTy, CK_FloatingCast).get();
       resultType = Context.FloatTy;
     }
 
+    // WebAsembly tables can't be used in unary expressions.
+    if (resultType->isPointerType() &&
+        resultType->getPointeeType()->isWebAssemblyReferenceType()) {
+      return ExprError(Diag(OpLoc, diag::err_typecheck_unary_expr)
+                       << resultType << Input.get()->getSourceRange());
+    }
+
     if (resultType->isDependentType())
       break;
     if (resultType->isScalarType() && !isScopedEnumerationType(resultType)) {
       // C99 6.5.3.3p1: ok, fallthrough;
       if (Context.getLangOpts().CPlusPlus) {
         // C++03 [expr.unary.op]p8, C++0x [expr.unary.op]p9:
         // operand contextually converted to bool.
         Input = ImpCastExprToType(Input.get(), Context.BoolTy,

clang/lib/Sema/SemaStmt.cpp

if (MD->hasRelatedResultType() && MD->getClassInterface()) {
       // type used to type-check the validity of return statements within the
       // method body is a pointer to the type of the class being implemented.
       RelatedRetType = Context.getObjCInterfaceType(MD->getClassInterface());
       RelatedRetType = Context.getObjCObjectPointerType(RelatedRetType);
     }
   } else // If we don't have a function/method context, bail.
     return StmtError();
 
+  if (RetValExp) {
+    if (RetValExp->getType()->isArrayType() &&
+        RetValExp->getType()
+            ->getArrayElementTypeNoTypeQual()
+            ->isWebAssemblyReferenceType()) {
+      Diag(ReturnLoc, diag::err_wasm_table_return);
+      return StmtError();
+    }
+  }
+
   // C++1z: discarded return statements are not considered when deducing a
   // return type.
   if (ExprEvalContexts.back().isDiscardedStatementContext() &&
       FnRetType->getContainedAutoType()) {
     if (RetValExp) {
       ExprResult ER =
           ActOnFinishFullExpr(RetValExp, ReturnLoc, /*DiscardedValue*/ false);
       if (ER.isInvalid())

clang/lib/Sema/SemaType.cpp

if (getLangOpts().CPlusPlus) {
     if (Context.getTargetInfo().getCXXABI().isMicrosoft())
       if (const MemberPointerType *MPTy = T->getAs<MemberPointerType>())
         if (!MPTy->getClass()->isDependentType())
           (void)isCompleteType(Loc, T);
 
   } else {
     // C99 6.7.5.2p1: If the element type is an incomplete or function type,
     // reject it (e.g. void ary[7], struct foo ary[7], void ary[7]())
-    if (RequireCompleteSizedType(Loc, T,
+    if (!T->isWebAssemblyReferenceType() &&
+        RequireCompleteSizedType(Loc, T,
                                  diag::err_array_incomplete_or_sizeless_type))
       return QualType();
   }
 
-  if (T->isSizelessType()) {
+  // Multi-dimensional arrays of WebAssembly references are not allowed.
+  if (Context.getTargetInfo().getTriple().isWasm() && T->isArrayType()) {
+    const Type *BaseTy = T->getBaseElementTypeUnsafe();
+    if (BaseTy->isWebAssemblyReferenceType()) {
+      Diag(Loc, diag::err_wasm_multidimensional_ref_array);
+      return QualType();
+    }
+  }
+
+  if (T->isSizelessType() && !T->isWebAssemblyReferenceType()) {
     Diag(Loc, diag::err_array_incomplete_or_sizeless_type) << 1 << T;
     return QualType();
   }
 
   if (T->isFunctionType()) {
     Diag(Loc, diag::err_illegal_decl_array_of_functions)
       << getPrintableNameForEntity(Entity) << T;
     return QualType();

clang/test/CodeGen/WebAssembly/table.c

+// RUN: %clang_cc1 -triple wasm32 -target-feature +reference-types -o - -emit-llvm %s | FileCheck %s
+// REQUIRES: webassembly-registered-target
+
+// CHECK: @table = internal addrspace(1) global [0 x ptr addrspace(10)] zeroinitializer, align 1
+static __externref_t table[0];
+
+void use() {
+  // Ensure the table isn't discarded as unused.
+  table[0];
+}

clang/test/Sema/wasm-refs-and-tables.c

-// RUN: %clang_cc1 -fsyntax-only -verify -triple wasm32 -target-feature +reference-types %s
+// RUN: %clang_cc1 -fsyntax-only -verify -triple wasm32 -Wno-unused-value -target-feature +reference-types %s
 
 // Note: As WebAssembly references are sizeless types, we don't exhaustively
 // test for cases covered by sizeless-1.c and similar tests.
 
 __externref_t *t1;               // expected-error {{pointers to WebAssembly reference types are illegal}}
 __externref_t **t2;              // expected-error {{pointers to WebAssembly reference types are illegal}}
 __externref_t ******t3;          // expected-error {{pointers to WebAssembly reference types are illegal}}
-static __externref_t t4[3];      // expected-error {{array has sizeless element type '__externref_t'}}
-static __externref_t t5[];       // expected-error {{array has sizeless element type '__externref_t'}}
-static __externref_t t6[] = {0}; // expected-error {{array has sizeless element type '__externref_t'}}
-__externref_t t7[0];             // expected-error {{array has sizeless element type '__externref_t'}}
-static __externref_t t8[0][0];   // expected-error {{array has sizeless element type '__externref_t'}}
+static __externref_t t4[3];      // expected-error {{WebAssembly table must be zero-length}}
+static __externref_t t5[];       // expected-error {{array has sizeless element type '__attribute__((address_space(1))) __externref_t'}}
+static __externref_t t6[] = {0}; // expected-error {{WebAssembly table cannot have an initializer}}
+__externref_t t7[0];             // expected-error {{WebAssembly table must be static}}
+static __externref_t t8[0][0];   // expected-error {{multi-dimensional arrays of WebAssembly references are illegal}}
 
-static __externref_t table[0]; // expected-error {{array has sizeless element type '__externref_t'}}
+static __externref_t table[0];
 
 struct s {
   __externref_t f1;       // expected-error {{field has sizeless type '__externref_t'}}
-  __externref_t f2[0];    // expected-error {{array has sizeless element type '__externref_t'}}
-  __externref_t f3[];     // expected-error {{array has sizeless element type '__externref_t'}}
-  __externref_t f4[0][0]; // expected-error {{array has sizeless element type '__externref_t'}}
+  __externref_t f2[0];    // expected-error {{field has sizeless type '__externref_t'}}
+  __externref_t f3[];     // expected-error {{field has sizeless type '__externref_t'}}
+  __externref_t f4[0][0]; // expected-error {{multi-dimensional arrays of WebAssembly references are illegal}}
   __externref_t *f5;      // expected-error {{pointers to WebAssembly reference types are illegal}}
   __externref_t ****f6;   // expected-error {{pointers to WebAssembly reference types are illegal}}
 };
 
 union u {
   __externref_t f1;       // expected-error {{field has sizeless type '__externref_t'}}
-  __externref_t f2[0];    // expected-error {{array has sizeless element type '__externref_t'}}
-  __externref_t f3[];     // expected-error {{array has sizeless element type '__externref_t'}}
-  __externref_t f4[0][0]; // expected-error {{array has sizeless element type '__externref_t'}}
+  __externref_t f2[0];    // expected-error {{field has sizeless type '__externref_t'}}
+  __externref_t f3[];     // expected-error {{field has sizeless type '__externref_t'}}
+  __externref_t f4[0][0]; // expected-error {{multi-dimensional arrays of WebAssembly references are illegal}}
   __externref_t *f5;      // expected-error {{pointers to WebAssembly reference types are illegal}}
   __externref_t ****f6;   // expected-error {{pointers to WebAssembly reference types are illegal}}
 };
 
-void illegal_argument_1(__externref_t table[]);     // expected-error {{array has sizeless element type '__externref_t'}}
-void illegal_argument_2(__externref_t table[0][0]); // expected-error {{array has sizeless element type '__externref_t'}}
+void illegal_argument_1(__externref_t table[]);     // expected-error {{cannot use WebAssembly table as a function argument}}
+void illegal_argument_2(__externref_t table[0][0]); // expected-error {{multi-dimensional arrays of WebAssembly references are illegal}}
 void illegal_argument_3(__externref_t *table);      // expected-error {{pointers to WebAssembly reference types are illegal}}
 void illegal_argument_4(__externref_t ***table);    // expected-error {{pointers to WebAssembly reference types are illegal}}
 
 __externref_t *illegal_return_1();   // expected-error {{pointers to WebAssembly reference types are illegal}}
 __externref_t ***illegal_return_2(); // expected-error {{pointers to WebAssembly reference types are illegal}}
 
 void varargs(int, ...);
 
 __externref_t func(__externref_t ref) {
   &ref; // expected-error {{cannot take address of WebAssembly reference}}
   int foo = 40;
   (__externref_t *)(&foo);     // expected-error {{pointers to WebAssembly reference types are illegal}}
   (__externref_t ****)(&foo);  // expected-error {{pointers to WebAssembly reference types are illegal}}
   sizeof(ref);                 // expected-error {{invalid application of 'sizeof' to sizeless type '__externref_t'}}
   sizeof(__externref_t);       // expected-error {{invalid application of 'sizeof' to sizeless type '__externref_t'}}
-  sizeof(__externref_t[0]);    // expected-error {{array has sizeless element type '__externref_t'}}
-  sizeof(__externref_t[0][0]); // expected-error {{array has sizeless element type '__externref_t'}}
+  sizeof(__externref_t[0]);    // expected-error {{invalid application of 'sizeof' to WebAssembly table}}
+  sizeof(__externref_t[0][0]); // expected-error {{multi-dimensional arrays of WebAssembly references are illegal}}
   sizeof(__externref_t *);     // expected-error {{pointers to WebAssembly reference types are illegal}}
   sizeof(__externref_t ***);   // expected-error {{pointers to WebAssembly reference types are illegal}};
   // expected-warning@+1 {{'_Alignof' applied to an expression is a GNU extension}}
   _Alignof(ref);                 // expected-error {{invalid application of 'alignof' to sizeless type '__externref_t'}}
   _Alignof(__externref_t);       // expected-error {{invalid application of 'alignof' to sizeless type '__externref_t'}}
-  _Alignof(__externref_t[]);     // expected-error {{array has sizeless element type '__externref_t'}}
-  _Alignof(__externref_t[0][0]); // expected-error {{array has sizeless element type '__externref_t'}}
+  _Alignof(__externref_t[]);     // expected-error {{invalid application of 'alignof' to sizeless type '__externref_t'}}
+  _Alignof(__externref_t[0][0]); // expected-error {{multi-dimensional arrays of WebAssembly references are illegal}}
   _Alignof(__externref_t *);     // expected-error {{pointers to WebAssembly reference types are illegal}}
   _Alignof(__externref_t ***);   // expected-error {{pointers to WebAssembly reference types are illegal}};
   varargs(1, ref);               // expected-error {{cannot pass expression of type '__externref_t' to variadic function}}
 
+  __externref_t lt1[0];           // expected-error {{WebAssembly table cannot be declared within a function}}
+  static __externref_t lt2[0];    // expected-error {{WebAssembly table cannot be declared within a function}}
+  static __externref_t lt3[0][0]; // expected-error {{multi-dimensional arrays of WebAssembly references are illegal}}
+  illegal_argument_1(table);      // expected-error {{cannot use WebAssembly table as a function argument}}
+  varargs(1, table);              // expected-error {{cannot use WebAssembly table as a function argument}}
+  table == 1;                     // expected-error {{invalid operands to binary expression ('__attribute__((address_space(1))) __externref_t[0]' and 'int')}}
+  1 >= table;                     // expected-error {{invalid operands to binary expression ('int' and '__attribute__((address_space(1))) __externref_t[0]')}}
+  !table;                         // expected-error {{invalid argument type '__attribute__((address_space(1))) __externref_t *' to unary expression}}
+  1 && table;                     // expected-error {{invalid operands to binary expression ('int' and '__attribute__((address_space(1))) __externref_t[0]')}}
+  table || 1;                     // expected-error {{invalid operands to binary expression ('__attribute__((address_space(1))) __externref_t[0]' and 'int')}}
+  1 ? table : table;              // expected-error {{invalid operands to binary expression ('__attribute__((address_space(1))) __externref_t[0]' and '__attribute__((address_space(1))) __externref_t[0]')}}
+  (void *)table;                  // expected-error {{cannot cast WebAssembly table}}
+  void *u;
+  u = table;       // expected-error {{cannot assign WebAssembly table to a variable}}
+  void *v = table; // expected-error {{cannot assign WebAssembly table to a variable}}
+
+  table[0];
+  table[0] = ref;
   return ref;
 }
+
+void *ret_void_ptr() {
+  return table; // expected-error {{cannot return a WebAssembly table}}
+}