[WebAssembly, LowerTypeTests] Fix control-flow integrity support

[ddcc]

Summary

Turns out this has been broken for WebAssembly since s2wasm was removed. This patch fixes it by:

• LowerTypeTests: Increment index for imported symbols, and remove unsupported absolute symbols
• WebAssemblyTargetStreamer: Support pre-assigned table indices, and add relative offset

[ddcc]

llvm/lib/MC/WasmObjectWriter.cpp

622

Not sure if this is entirely correct, please take a look. My understanding is that D79462 introduced a bug where it fails to add the offset from a relative symbol. Without these changes, I get the following error from the lld side:

wasm-ld: warning: unexpected existing value for R_WASM_MEMORY_ADDR_SLEB: existing=8420 expected=8452

After some debugging, it appears that this is a relative symbol, where the +32 offset gets missed since only the base is examined.

RelEntry.Symbol->getVariableValue(false): .L__unnamed_1+32
symbol: Name=.L_ZTV3Foo.0, Kind=WASM_SYMBOL_TYPE_DATA, Flags=2, Segment=62, Offset=32, Size=20
WasmObjectWriter::writeObject: Ref = {Segment = 62, Offset = 32, Size = 20}
WasmObjectWriter::getProvisionalValue: Ref = {Segment = 62, Offset = 0, Size = 52}

[ddcc]

Fix Twine issue

[dschuff]

Hi, nice to hear from you, and thanks for the patch! I'm going to have to try to page-in all the vague knowledge I have about CFI, because I think it would be really good to get this working for real.

One thing that's happened since you did all of this originally is multiple-table support; the reference-types proposal includes multiple tables, has been standardized, and will soon be (or is already?) available in all the browsers. IIRC you originally did both a version with and without multiple-tables, but I forget how much of that was in s2wasm vs in LLVM. IMO we should just make CFI require multiple tables, and then we can dedicate as many tables for whatever purposes we like.
I assume that we'll still need the core functionality of this CL, which is having the table layout be determined at IPO time rather than being assigned by the objectWriter/linker?

Can you remind me of what the state was for multiple-table support when you originally wrote all this?

[dschuff]

oh, and @sbc100 and @aardappel should probably be the ones to review the MC bits.

[ddcc]

In D87258#2261190, @dschuff wrote:

One thing that's happened since you did all of this originally is multiple-table support; the reference-types proposal includes multiple tables, has been standardized, and will soon be (or is already?) available in all the browsers. IIRC you originally did both a version with and without multiple-tables, but I forget how much of that was in s2wasm vs in LLVM. IMO we should just make CFI require multiple tables, and then we can dedicate as many tables for whatever purposes we like.
I assume that we'll still need the core functionality of this CL, which is having the table layout be determined at IPO time rather than being assigned by the objectWriter/linker?

Can you remind me of what the state was for multiple-table support when you originally wrote all this?

This CL is still using a single table, so it relies on the LowerTypeTests pass pre-assigning table indices into !wasm.index metadata, then generating arithmetic checks at each call site based on the valid index range for each type. Later, the ASMPrinter and MCSymbol components propagate and assign those table indices during object generation.

The multiple table implementation was in D22246, which wasn't merged. I recall the design was more complicated and experimental because there were a couple of remaining issues:

1. Depending on how we assign table indices, false negatives may occur with certain CFI checks. Suppose we put function "void F1(struct Foo*)" at index 1 in table A, function "void F2(struct void *)" at index 1 in table B, and there's an indirect call site CS that dispatches using the latter type, but may call either F1 or F2. Normally, the CFI pass would only allow CS to call F2 (because they have the same type), and not F1 (because it has a different type, even if this may be considered a false positive). But if the backend generates indices that could alias across tables, then we won't detect this and allow both to go through. The WebAssembly runtime signature check on indirect calls doesn't help, because both functions will have the same lowered type as a pointer is just an i64.
2. It was difficult to keep track of which table should be used for which call site in LLVM IR. The Clang front-end generates calls to the type test intrinsic (which contains the type metadata) somewhere between e.g. a function pointer load and its indirect call, but there's no direct link to the indirect call in the IR. But, the LowerTypeTests pass needs to somehow find and tag all the call sites and valid call targets of the same type with a unique identifier. Both the single and multiple table design are using metadata for tagging things, but this probably isn't fully correct since metadata may be removed by intermediate optimizations?

In general, with the multiple table approach, LowerTypeTests would need to do the tagging and then remove all the type test intrinsics since we don't need additional arithmetic checks. Later, somewhere in the backend, we would need to place and generate (table, index) pairs for all valid call targets of the same type, and fixup each indirect call to refer to the correct table. I don't see support for e.g. a table reference on the call_indirect instruction, so it looks like all of this backend machinery would need to be implemented as well?

[sbc100]

So is the idea that the table indexes would be reserved also by the linker?

Right now wasm-ld completely ignores the table elements in the object files and generates contiguous table entries when if finds TABLE_INDEX relocations.

llvm/lib/MC/WasmObjectWriter.cpp

548

Would the read better if you flipped the if/else and remove the negation?

622

This looks correct to me. Is the reason we have not been seeing because we have -fdata-sections on by default so all symbols are in their own section?

I would hope we could land this separately with its own test(s). Do you have a way to trigger this bug?

[dschuff]

Thanks @ddcc for the summary. Given that, I do think it makes sense to fix the current implementation before worrying about multiple tables.

[dschuff]

(And yes, you are right that using metadata for this isn't strictly correct since metadata can be dropped. And I think you are also correct that we haven't added multiple table support for MC or the instruction definitions either).

[ddcc]

Currently, I am seeing some false positive CFI failures that only occur with WebAssembly and not native, so I still need to look into what's causing that.

In D87258#2261903, @sbc100 wrote:

So is the idea that the table indexes would be reserved also by the linker?

Right now wasm-ld completely ignores the table elements in the object files and generates contiguous table entries when if finds TABLE_INDEX relocations.

Ah, so under LTO, the output from WasmObjectWriter is linked by lld with libc, etc, which writes the final output? I was hoping to avoid changing the object format to explicitly assign table element indices, since that would involve amending the specification, by just emitting the table elements in the correct order. Would it be sufficient to have WasmObjectWriter::recordRelocation also ensure that TABLE_INDEX relocations are inserted into CodeRelocations in the correct assigned order? Right now I only push them to the front of CodeRelocations to avoid conflicts when assigning indices with subsequent elements.

In D87258#2262098, @dschuff wrote:

Thanks @ddcc for the summary. Given that, I do think it makes sense to fix the current implementation before worrying about multiple tables.

Sounds good, I don't think I have the time right now for the full multiple table design.

In D87258#2262100, @dschuff wrote:

(And yes, you are right that using metadata for this isn't strictly correct since metadata can be dropped. And I think you are also correct that we haven't added multiple table support for MC or the instruction definitions either).

One option would be to mutate the function type so that it is in a separate address space, instead of using the !wasm.index metadata. But this may cause problems if we don't clean up all associated function pointers to perform additional address space casts where necessary. Another options could be using function prefix data? Otherwise, I don't see any suitable function attributes that we could reuse, but I also haven't used either of the these options before, so I don't know what would be best.

llvm/lib/MC/WasmObjectWriter.cpp

548

Ok, will do.

622

I'll take a look at extracting this part out and writing a testcase for it. Currently, it only occurs when I compile a local test application with CFI enabled using emsdk. I'm not sure where it's happening, but either Clang or LowerTypeTests is inserting references to a function inside the vtable for the Foo class.

[ddcc]

Fix undefined arithmetic range ops in LowerTypeTests, split WebAssembly relative symbol bugfix into D87407

[ddcc]

Switch to absolute_symbol metadata, which is undroppable, instead of wasm.index

[ddcc]

In D87258#2262409, @ddcc wrote:

In D87258#2261903, @sbc100 wrote:

So is the idea that the table indexes would be reserved also by the linker?

Right now wasm-ld completely ignores the table elements in the object files and generates contiguous table entries when if finds TABLE_INDEX relocations.

Ah, so under LTO, the output from WasmObjectWriter is linked by lld with libc, etc, which writes the final output? I was hoping to avoid changing the object format to explicitly assign table element indices, since that would involve amending the specification, by just emitting the table elements in the correct order. Would it be sufficient to have WasmObjectWriter::recordRelocation also ensure that TABLE_INDEX relocations are inserted into CodeRelocations in the correct assigned order? Right now I only push them to the front of CodeRelocations to avoid conflicts when assigning indices with subsequent elements.

@sbc100 I have a local prototype that reorders CodeRelocations such that symbols with an assigned index appear first, but it seems that there's a conflicting object format requirement that relocations appear in offset order. What would be the best way to propagate assigned indices through to wasm-ld, either implicitly or explicitly?

[ddcc]

ping

[dschuff]

Just a cross-reference, table-number relocs are being added in D90948

llvm/include/llvm/MC/MCSymbolWasm.h

 //===- MCSymbolWasm.h -  ----------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 #ifndef LLVM_MC_MCSYMBOLWASM_H
class MCSymbolWasm : public MCSymbol {
   mutable bool IsUsedInInitArray = false;
   mutable bool IsUsedInGOT = false;
   Optional<StringRef> ImportModule;
   Optional<StringRef> ImportName;
   Optional<StringRef> ExportName;
   wasm::WasmSignature *Signature = nullptr;
   Optional<wasm::WasmGlobalType> GlobalType;
   Optional<wasm::WasmEventType> EventType;
+  Optional<uint64_t> TableIndex;
 
   /// An expression describing how to calculate the size of a symbol. If a
   /// symbol has no size this field will be NULL.
   const MCExpr *SymbolSize = nullptr;
 
 public:
   MCSymbolWasm(const StringMapEntry<bool> *Name, bool isTemporary)
       : MCSymbol(SymbolKindWasm, Name, isTemporary) {}
public:
   }
   void setGlobalType(wasm::WasmGlobalType GT) { GlobalType = GT; }
 
   const wasm::WasmEventType &getEventType() const {
     assert(EventType.hasValue());
     return EventType.getValue();
   }
   void setEventType(wasm::WasmEventType ET) { EventType = ET; }
+
+  bool hasTableIndex() const { return isFunction() && TableIndex; }
+  uint64_t getTableIndex() const {
+    assert(TableIndex.hasValue());
+    return TableIndex.getValue();
+  }
+  void setTableIndex(uint64_t idx) { TableIndex = idx; }
 };
 
 } // end namespace llvm
 
 #endif // LLVM_MC_MCSYMBOLWASM_H

llvm/include/llvm/MC/MCWasmObjectWriter.h

 //===-- llvm/MC/MCWasmObjectWriter.h - Wasm Object Writer -------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
class MCWasmObjectTargetWriter : public MCObjectTargetWriter {
   const unsigned IsEmscripten : 1;
 
 protected:
   explicit MCWasmObjectTargetWriter(bool Is64Bit_, bool IsEmscripten);
 
 public:
   virtual ~MCWasmObjectTargetWriter();
 
+  // When we create the indirect function table we start at 1, so that there is
+  // an empty slot at 0 and therefore calling a null function pointer will trap.
+  static const uint32_t InitialTableOffset = 1;
+
   Triple::ObjectFormatType getFormat() const override { return Triple::Wasm; }
   static bool classof(const MCObjectTargetWriter *W) {
     return W->getFormat() == Triple::Wasm;
   }
 
   virtual unsigned getRelocType(const MCValue &Target,
                                 const MCFixup &Fixup) const = 0;
 

llvm/lib/MC/WasmObjectWriter.cpp

 //===- lib/MC/WasmObjectWriter.cpp - Wasm File Writer ---------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // This file implements Wasm object file writer information.
 //
 //===----------------------------------------------------------------------===//
 
 #include "llvm/ADT/STLExtras.h"
-#include "llvm/ADT/SmallPtrSet.h"
+#include "llvm/ADT/SmallSet.h"
 #include "llvm/BinaryFormat/Wasm.h"
 #include "llvm/Config/llvm-config.h"
 #include "llvm/MC/MCAsmBackend.h"
 #include "llvm/MC/MCAsmLayout.h"
 #include "llvm/MC/MCAssembler.h"
 #include "llvm/MC/MCContext.h"
 #include "llvm/MC/MCExpr.h"
 #include "llvm/MC/MCFixupKindInfo.h"

 #include <vector>
 
 using namespace llvm;
 
 #define DEBUG_TYPE "mc"
 
 namespace {
 
-// Went we ceate the indirect function table we start at 1, so that there is
-// and emtpy slot at 0 and therefore calling a null function pointer will trap.
-static const uint32_t InitialTableOffset = 1;
-
 // For patching purposes, we need to remember where each section starts, both
 // for patching up the section size field, and for patching up references to
 // locations within the section.
 struct SectionBookkeeping {
   // Where the size of the section is written.
   uint64_t SizeOffset;
   // Where the section header ends (without custom section name).
   uint64_t PayloadOffset;

 
 #if !defined(NDEBUG)
 raw_ostream &operator<<(raw_ostream &OS, const WasmRelocationEntry &Rel) {
   Rel.print(OS);
   return OS;
 }
 #endif
 
+struct WasmTablePair {
+  uint32_t TableIndex;
+  uint32_t FunctionIndex;
+
+  WasmTablePair(uint32_t TIdx, uint32_t FIdx)
+      : TableIndex(TIdx), FunctionIndex(FIdx) {}
+
+  bool operator<(const WasmTablePair &Other) const {
+    return this->TableIndex < Other.TableIndex;
+  }
+
+  bool operator==(const WasmTablePair &Other) const {
+    return this->TableIndex == Other.TableIndex;
+  }
+};
+
 // Write X as an (unsigned) LEB value at offset Offset in Stream, padded
 // to allow patching.
 template <int W>
 void writePatchableLEB(raw_pwrite_stream &Stream, uint64_t X, uint64_t Offset) {
   uint8_t Buffer[W];
   unsigned SizeLen = encodeULEB128(X, Buffer, W);
   assert(SizeLen == W);
   Stream.pwrite((char *)Buffer, SizeLen, Offset);
private:
 
   void writeValueType(wasm::ValType Ty) { W.OS << static_cast<char>(Ty); }
 
   void writeTypeSection(ArrayRef<WasmSignature> Signatures);
   void writeImportSection(ArrayRef<wasm::WasmImport> Imports, uint64_t DataSize,
                           uint32_t NumElements);
   void writeFunctionSection(ArrayRef<WasmFunction> Functions);
   void writeExportSection(ArrayRef<wasm::WasmExport> Exports);
-  void writeElemSection(ArrayRef<uint32_t> TableElems);
+  void writeElemSection(const SmallSet<WasmTablePair, 4> &TableElems);
   void writeDataCountSection();
   uint32_t writeCodeSection(const MCAssembler &Asm, const MCAsmLayout &Layout,
                             ArrayRef<WasmFunction> Functions);
   uint32_t writeDataSection(const MCAsmLayout &Layout);
   void writeEventSection(ArrayRef<wasm::WasmEventType> Events);
   void writeGlobalSection(ArrayRef<wasm::WasmGlobal> Globals);
   void writeRelocSection(uint32_t SectionIndex, StringRef Name,
                          std::vector<WasmRelocationEntry> &Relocations);
if (RefA->getKind() == MCSymbolRefExpr::VK_GOT)
     SymA->setUsedInGOT();
 
   WasmRelocationEntry Rec(FixupOffset, SymA, C, Type, &FixupSection);
   LLVM_DEBUG(dbgs() << "WasmReloc: " << Rec << "\n");
 
   if (FixupSection.isWasmData()) {
     DataRelocations.push_back(Rec);
   } else if (FixupSection.getKind().isText()) {
+    // Insert symbols with pre-assigned indices at the front, to avoid
+    // subsequent conflict if an index has already been assigned
+    if (Rec.Symbol->hasTableIndex())
+      CodeRelocations.insert(CodeRelocations.begin(), Rec);
+    else
       CodeRelocations.push_back(Rec);
   } else if (FixupSection.getKind().isMetadata()) {
     CustomSectionsRelocations[&FixupSection].push_back(Rec);
   } else {
     llvm_unreachable("unexpected section type");
   }
 }
 
 // Compute a value to write into the code at the location covered
WasmObjectWriter::getProvisionalValue(const WasmRelocationEntry &RelEntry,
   case wasm::R_WASM_TABLE_INDEX_SLEB64:
   case wasm::R_WASM_TABLE_INDEX_I32:
   case wasm::R_WASM_TABLE_INDEX_I64: {
     // Provisional value is table address of the resolved symbol itself
     const MCSymbolWasm *Base =
         cast<MCSymbolWasm>(Layout.getBaseSymbol(*RelEntry.Symbol));
     assert(Base->isFunction());
     if (RelEntry.Type == wasm::R_WASM_TABLE_INDEX_REL_SLEB)
-      return TableIndices[Base] - InitialTableOffset;
+      return TableIndices[Base] - MCWasmObjectTargetWriter::InitialTableOffset;
     else
       return TableIndices[Base];
   }
   case wasm::R_WASM_TYPE_INDEX_LEB:
     // Provisional value is same as the index
     return getRelocationIndexValue(RelEntry);
   case wasm::R_WASM_FUNCTION_INDEX_LEB:
   case wasm::R_WASM_GLOBAL_INDEX_LEB:
const MCSymbolWasm *Base =
         cast<MCSymbolWasm>(Layout.getBaseSymbol(*RelEntry.Symbol));
     // For undefined symbols, use zero
     if (!Base->isDefined())
       return 0;
     const wasm::WasmDataReference &BaseRef = DataLocations[Base];
     const wasm::WasmDataReference &SymRef = DataLocations[RelEntry.Symbol];
     const WasmDataSegment &Segment = DataSegments[BaseRef.Segment];
     // Ignore overflow. LLVM allows address arithmetic to silently wrap.
     return Segment.Offset + BaseRef.Offset + SymRef.Offset + RelEntry.Addend;
   }
   default:
     llvm_unreachable("invalid relocation type");
   }
 }
 
 static void addData(SmallVectorImpl<char> &DataBytes,
                     MCSectionWasm &DataSection) {
for (const wasm::WasmExport &Export : Exports) {
     writeString(Export.Name);
     W.OS << char(Export.Kind);
     encodeULEB128(Export.Index, W.OS);
   }
 
   endSection(Section);
 }
 
-void WasmObjectWriter::writeElemSection(ArrayRef<uint32_t> TableElems) {
+void WasmObjectWriter::writeElemSection(
+    const SmallSet<WasmTablePair, 4> &TableElems) {
   if (TableElems.empty())
     return;
 
   SectionBookkeeping Section;
   startSection(Section, wasm::WASM_SEC_ELEM);
 
   encodeULEB128(1, W.OS); // number of "segments"
   encodeULEB128(0, W.OS); // the table index
 
   // init expr for starting offset
   W.OS << char(wasm::WASM_OPCODE_I32_CONST);
-  encodeSLEB128(InitialTableOffset, W.OS);
+  encodeSLEB128(MCWasmObjectTargetWriter::InitialTableOffset, W.OS);
   W.OS << char(wasm::WASM_OPCODE_END);
 
   encodeULEB128(TableElems.size(), W.OS);
-  for (uint32_t Elem : TableElems)
-    encodeULEB128(Elem, W.OS);
+  for (auto &P : TableElems)
+    encodeULEB128(P.FunctionIndex, W.OS);
 
   endSection(Section);
 }
 
 void WasmObjectWriter::writeDataCountSection() {
   if (DataSegments.empty())
     return;
 

 uint64_t WasmObjectWriter::writeObject(MCAssembler &Asm,
                                        const MCAsmLayout &Layout) {
   uint64_t StartOffset = W.OS.tell();
 
   LLVM_DEBUG(dbgs() << "WasmObjectWriter::writeObject\n");
 
   // Collect information from the available symbols.
   SmallVector<WasmFunction, 4> Functions;
-  SmallVector<uint32_t, 4> TableElems;
+  SmallSet<WasmTablePair, 4> TableElems;
   SmallVector<wasm::WasmImport, 4> Imports;
   SmallVector<wasm::WasmExport, 4> Exports;
   SmallVector<wasm::WasmEventType, 1> Events;
   SmallVector<wasm::WasmGlobal, 1> Globals;
   SmallVector<wasm::WasmSymbolInfo, 4> SymbolInfos;
   SmallVector<std::pair<uint16_t, uint32_t>, 2> InitFuncs;
   std::map<StringRef, std::vector<WasmComdatEntry>> Comdats;
   uint64_t DataSize = 0;
auto HandleReloc = [&](const WasmRelocationEntry &Rel) {
           Rel.Type != wasm::R_WASM_TABLE_INDEX_SLEB &&
           Rel.Type != wasm::R_WASM_TABLE_INDEX_SLEB64 &&
           Rel.Type != wasm::R_WASM_TABLE_INDEX_REL_SLEB)
         return;
       assert(Rel.Symbol->isFunction());
       const MCSymbolWasm *Base =
           cast<MCSymbolWasm>(Layout.getBaseSymbol(*Rel.Symbol));
       uint32_t FunctionIndex = WasmIndices.find(Base)->second;
-      uint32_t TableIndex = TableElems.size() + InitialTableOffset;
-      if (TableIndices.try_emplace(Base, TableIndex).second) {
+      uint32_t TableIndex =
+          Rel.Symbol->hasTableIndex()
+              ? Rel.Symbol->getTableIndex()
+              : TableElems.size() +
+                    MCWasmObjectTargetWriter::InitialTableOffset;
+      auto P = TableIndices.try_emplace(Base, TableIndex);
+      if (P.second) {
         LLVM_DEBUG(dbgs() << "  -> adding " << Base->getName()
                           << " to table: " << TableIndex << "\n");
-        TableElems.push_back(FunctionIndex);
+        if (!TableElems.insert(WasmTablePair(TableIndex, FunctionIndex)).second)
+          report_fatal_error(Twine(Base->getName()) + ": table index " +
+                             Twine(TableIndex) + " has already been assigned!");
         registerFunctionType(*Base);
+      } else if (Rel.Symbol->hasTableIndex() && P.first->second != TableIndex) {
+        report_fatal_error(Twine(Rel.Symbol->getName()) +
+                           ": symbol has conflicting table indices " +
+                           Twine(P.first->second) + ", " + Twine(TableIndex));
       }
     };
 
     for (const WasmRelocationEntry &RelEntry : CodeRelocations)
       HandleReloc(RelEntry);
     for (const WasmRelocationEntry &RelEntry : DataRelocations)
       HandleReloc(RelEntry);
   }

llvm/lib/Target/WebAssembly/MCTargetDesc/WebAssemblyTargetStreamer.h

 //==-- WebAssemblyTargetStreamer.h - WebAssembly Target Streamer -*- C++ -*-==//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 ///

 /// This part is for Wasm object output
 class WebAssemblyTargetWasmStreamer final : public WebAssemblyTargetStreamer {
 public:
   explicit WebAssemblyTargetWasmStreamer(MCStreamer &S);
 
   void emitLocal(ArrayRef<wasm::ValType> Types) override;
   void emitEndFunc() override;
   void emitFunctionType(const MCSymbolWasm *Sym) override {}
-  void emitIndIdx(const MCExpr *Value) override;
+  void emitIndIdx(const MCExpr *Value) override {}
   void emitGlobalType(const MCSymbolWasm *Sym) override {}
   void emitEventType(const MCSymbolWasm *Sym) override {}
   void emitImportModule(const MCSymbolWasm *Sym,
                         StringRef ImportModule) override {}
   void emitImportName(const MCSymbolWasm *Sym,
                       StringRef ImportName) override {}
   void emitExportName(const MCSymbolWasm *Sym,
                       StringRef ExportName) override {}

llvm/lib/Target/WebAssembly/MCTargetDesc/WebAssemblyTargetStreamer.cpp

 //==-- WebAssemblyTargetStreamer.cpp - WebAssembly Target Streamer Methods --=//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 ///
for (auto Pair : Grouped) {
     Streamer.emitULEB128IntValue(Pair.second);
     emitValueType(Pair.first);
   }
 }
 
 void WebAssemblyTargetWasmStreamer::emitEndFunc() {
   llvm_unreachable(".end_func is not needed for direct wasm output");
 }
-
-void WebAssemblyTargetWasmStreamer::emitIndIdx(const MCExpr *Value) {
-  llvm_unreachable(".indidx encoding not yet implemented");
-}

llvm/lib/Target/WebAssembly/WebAssemblyAsmPrinter.cpp

 //===-- WebAssemblyAsmPrinter.cpp - WebAssembly LLVM assembly writer ------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 ///

 #include "llvm/ADT/SmallSet.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/BinaryFormat/Wasm.h"
 #include "llvm/CodeGen/Analysis.h"
 #include "llvm/CodeGen/AsmPrinter.h"
 #include "llvm/CodeGen/MachineConstantPool.h"
 #include "llvm/CodeGen/MachineInstr.h"
 #include "llvm/CodeGen/MachineModuleInfoImpls.h"
+#include "llvm/IR/ConstantRange.h"
 #include "llvm/IR/DataLayout.h"
 #include "llvm/IR/DebugInfoMetadata.h"
 #include "llvm/IR/GlobalVariable.h"
 #include "llvm/IR/Metadata.h"
 #include "llvm/MC/MCContext.h"
 #include "llvm/MC/MCSectionWasm.h"
 #include "llvm/MC/MCStreamer.h"
 #include "llvm/MC/MCSymbol.h"
if (F.isDeclarationForLinker()) {
       }
       // FIXME: this was originally intended for post-linking and was only used
       // for imports that were only called indirectly (i.e. s2wasm could not
       // infer the type from a call). With object files it applies to all
       // imports. so fix the names and the tests, or rethink how import
       // delcarations work in asm files.
       getTargetStreamer()->emitFunctionType(Sym);
 
+      // Set/emit the assigned function index for CFI.
+      if (F.isAbsoluteSymbolRef()) {
+        assert(F.getAbsoluteSymbolRange()->isSingleElement());
+        auto *V =
+            cast<ConstantAsMetadata>(
+                F.getMetadata(LLVMContext::MD_absolute_symbol)->getOperand(0))
+                ->getValue();
+        Sym->setTableIndex(cast<ConstantInt>(V)->getZExtValue());
+
+        getTargetStreamer()->emitIndIdx(AsmPrinter::lowerConstant(V));
+      }
+
       if (TM.getTargetTriple().isOSBinFormatWasm() &&
           F.hasFnAttribute("wasm-import-module")) {
         StringRef Name =
             F.getFnAttribute("wasm-import-module").getValueAsString();
         Sym->setImportModule(storeName(Name));
         getTargetStreamer()->emitImportModule(Sym, Name);
       }
       if (TM.getTargetTriple().isOSBinFormatWasm() &&
void WebAssemblyAsmPrinter::emitFunctionBodyStart() {
   auto *WasmSym = cast<MCSymbolWasm>(CurrentFnSym);
   WasmSym->setSignature(Signature.get());
   addSignature(std::move(Signature));
   WasmSym->setType(wasm::WASM_SYMBOL_TYPE_FUNCTION);
 
   // FIXME: clean up how params and results are emitted (use signatures)
   getTargetStreamer()->emitFunctionType(WasmSym);
 
-  // Emit the function index.
-  if (MDNode *Idx = F.getMetadata("wasm.index")) {
-    assert(Idx->getNumOperands() == 1);
+  // Set/emit the assigned function index for CFI.
+  if (F.isAbsoluteSymbolRef()) {
+    assert(F.getAbsoluteSymbolRange()->isSingleElement());
+    auto *V = cast<ConstantAsMetadata>(
+                  F.getMetadata(LLVMContext::MD_absolute_symbol)->getOperand(0))
+                  ->getValue();
+    WasmSym->setTableIndex(cast<ConstantInt>(V)->getZExtValue());
 
-    getTargetStreamer()->emitIndIdx(AsmPrinter::lowerConstant(
-        cast<ConstantAsMetadata>(Idx->getOperand(0))->getValue()));
+    getTargetStreamer()->emitIndIdx(AsmPrinter::lowerConstant(V));
   }
 
   SmallVector<wasm::ValType, 16> Locals;
   valTypesFromMVTs(MFI->getLocals(), Locals);
   getTargetStreamer()->emitLocal(Locals);
 
   AsmPrinter::emitFunctionBodyStart();
 }

llvm/lib/Transforms/IPO/LowerTypeTests.cpp

 //===- LowerTypeTests.cpp - type metadata lowering pass -------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //

 #include "llvm/IR/ModuleSummaryIndexYAML.h"
 #include "llvm/IR/Operator.h"
 #include "llvm/IR/PassManager.h"
 #include "llvm/IR/Type.h"
 #include "llvm/IR/Use.h"
 #include "llvm/IR/User.h"
 #include "llvm/IR/Value.h"
 #include "llvm/InitializePasses.h"
+#include "llvm/MC/MCWasmObjectWriter.h"
 #include "llvm/Pass.h"
 #include "llvm/Support/Allocator.h"
 #include "llvm/Support/Casting.h"
 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/Error.h"
 #include "llvm/Support/ErrorHandling.h"
 #include "llvm/Support/FileSystem.h"
class LowerTypeTestsModule {
   PointerType *Int8PtrTy = Type::getInt8PtrTy(M.getContext());
   ArrayType *Int8Arr0Ty = ArrayType::get(Type::getInt8Ty(M.getContext()), 0);
   IntegerType *Int32Ty = Type::getInt32Ty(M.getContext());
   PointerType *Int32PtrTy = PointerType::getUnqual(Int32Ty);
   IntegerType *Int64Ty = Type::getInt64Ty(M.getContext());
   IntegerType *IntPtrTy = M.getDataLayout().getIntPtrType(M.getContext(), 0);
 
   // Indirect function call index assignment counter for WebAssembly
-  uint64_t IndirectIndex = 1;
+  uint64_t IndirectIndex = MCWasmObjectTargetWriter::InitialTableOffset;
 
   // Mapping from type identifiers to the call sites that test them, as well as
   // whether the type identifier needs to be exported to ThinLTO backends as
   // part of the regular LTO phase of the ThinLTO pipeline (see exportTypeId).
   struct TypeIdUserInfo {
     std::vector<CallInst *> CallSites;
     bool IsExported = false;
   };
Value *LowerTypeTestsModule::lowerTypeTestCall(Metadata *TypeId, CallInst *CI,
   // We need to check that the offset both falls within our range and is
   // suitably aligned. We can check both properties at the same time by
   // performing a right rotate by log2(alignment) followed by an integer
   // comparison against the bitset size. The rotate will move the lower
   // order bits that need to be zero into the higher order bits of the
   // result, causing the comparison to fail if they are nonzero. The rotate
   // also conveniently gives us a bit offset to use during the load from
   // the bitset.
+  Value *BitOffset;
+  if (!TIL.AlignLog2->isZeroValue()) {
     Value *OffsetSHR =
         B.CreateLShr(PtrOffset, ConstantExpr::getZExt(TIL.AlignLog2, IntPtrTy));
     Value *OffsetSHL = B.CreateShl(
         PtrOffset, ConstantExpr::getZExt(
                        ConstantExpr::getSub(
                            ConstantInt::get(Int8Ty, DL.getPointerSizeInBits(0)),
                            TIL.AlignLog2),
                        IntPtrTy));
-  Value *BitOffset = B.CreateOr(OffsetSHR, OffsetSHL);
+    BitOffset = B.CreateOr(OffsetSHR, OffsetSHL);
+  } else
+    BitOffset = PtrOffset;
 
   Value *OffsetInRange = B.CreateICmpULE(BitOffset, TIL.SizeM1);
 
   // If the bit set is all ones, testing against it is unnecessary.
   if (TIL.TheKind == TypeTestResolution::AllOnes)
     return OffsetInRange;
 
   // See if the intrinsic is used in the following common pattern:

 /// Returns a pointer to the location in which to store the bitmask, if
 /// applicable.
 uint8_t *LowerTypeTestsModule::exportTypeId(StringRef TypeId,
                                             const TypeIdLowering &TIL) {
   TypeTestResolution &TTRes =
       ExportSummary->getOrInsertTypeIdSummary(TypeId).TTRes;
   TTRes.TheKind = TIL.TheKind;
 
-  auto ExportGlobal = [&](StringRef Name, Constant *C) {
-    GlobalAlias *GA =
-        GlobalAlias::create(Int8Ty, 0, GlobalValue::ExternalLinkage,
-                            "__typeid_" + TypeId + "_" + Name, C, &M);
-    GA->setVisibility(GlobalValue::HiddenVisibility);
+  auto ExportGlobal = [&](StringRef Name, Constant *C, bool useAlias) {
+    GlobalValue *GV;
+    const auto GVName = ("__typeid_" + TypeId + "_" + Name).str();
+    if (useAlias)
+      GV = GlobalAlias::create(Int8Ty, 0, GlobalValue::ExternalLinkage, GVName,
+                               C, &M);
+    else
+      GV = new GlobalVariable(M, C->getType(), true,
+                              GlobalValue::ExternalLinkage, C, GVName);
+    GV->setVisibility(GlobalValue::HiddenVisibility);
   };
 
   auto ExportConstant = [&](StringRef Name, uint64_t &Storage, Constant *C) {
     if (shouldExportConstantsAsAbsoluteSymbols())
-      ExportGlobal(Name, ConstantExpr::getIntToPtr(C, Int8PtrTy));
+      ExportGlobal(Name, ConstantExpr::getIntToPtr(C, Int8PtrTy), true);
     else
       Storage = cast<ConstantInt>(C)->getZExtValue();
   };
 
-  if (TIL.TheKind != TypeTestResolution::Unsat)
-    ExportGlobal("global_addr", TIL.OffsetedGlobal);
+  if (TIL.TheKind != TypeTestResolution::Unsat) {
+    auto *CE = dyn_cast<ConstantExpr>(TIL.OffsetedGlobal);
+    if (CE && CE->getOpcode() == Instruction::IntToPtr) {
+      assert(!shouldExportConstantsAsAbsoluteSymbols());
+      ExportGlobal("global_addr", CE->getOperand(0), false);
+    } else
+      ExportGlobal("global_addr", TIL.OffsetedGlobal, true);
+  }
 
   if (TIL.TheKind == TypeTestResolution::ByteArray ||
       TIL.TheKind == TypeTestResolution::Inline ||
       TIL.TheKind == TypeTestResolution::AllOnes) {
     ExportConstant("align", TTRes.AlignLog2, TIL.AlignLog2);
     ExportConstant("size_m1", TTRes.SizeM1, TIL.SizeM1);
 
     uint64_t BitSize = cast<ConstantInt>(TIL.SizeM1)->getZExtValue() + 1;
     if (TIL.TheKind == TypeTestResolution::Inline)
       TTRes.SizeM1BitWidth = (BitSize <= 32) ? 5 : 6;
     else
       TTRes.SizeM1BitWidth = (BitSize <= 128) ? 7 : 32;
   }
 
   if (TIL.TheKind == TypeTestResolution::ByteArray) {
-    ExportGlobal("byte_array", TIL.TheByteArray);
+    ExportGlobal("byte_array", TIL.TheByteArray, true);
     if (shouldExportConstantsAsAbsoluteSymbols())
-      ExportGlobal("bit_mask", TIL.BitMask);
+      ExportGlobal("bit_mask", TIL.BitMask, true);
     else
       return &TTRes.BitMask;
   }
 
   if (TIL.TheKind == TypeTestResolution::Inline)
     ExportConstant("inline_bits", TTRes.InlineBits, TIL.InlineBits);
 
   return nullptr;
void LowerTypeTestsModule::importFunction(
   // Set visibility late because it's used in replaceCfiUses() to determine
   // whether uses need to to be replaced.
   F->setVisibility(Visibility);
 }
 
 void LowerTypeTestsModule::lowerTypeTestCalls(
     ArrayRef<Metadata *> TypeIds, Constant *CombinedGlobalAddr,
     const DenseMap<GlobalTypeMember *, uint64_t> &GlobalLayout) {
-  CombinedGlobalAddr = ConstantExpr::getBitCast(CombinedGlobalAddr, Int8PtrTy);
+  if (CombinedGlobalAddr)
+    CombinedGlobalAddr =
+        ConstantExpr::getBitCast(CombinedGlobalAddr, Int8PtrTy);
 
   // For each type identifier in this disjoint set...
   for (Metadata *TypeId : TypeIds) {
     // Build the bitset.
     BitSetInfo BSI = buildBitSet(TypeId, GlobalLayout);
     LLVM_DEBUG({
       if (auto MDS = dyn_cast<MDString>(TypeId))
         dbgs() << MDS->getString() << ": ";
       else
         dbgs() << "<unnamed>: ";
       BSI.print(dbgs());
     });
 
     ByteArrayInfo *BAI = nullptr;
     TypeIdLowering TIL;
-    TIL.OffsetedGlobal = ConstantExpr::getGetElementPtr(
-        Int8Ty, CombinedGlobalAddr, ConstantInt::get(IntPtrTy, BSI.ByteOffset)),
+    TIL.OffsetedGlobal =
+        CombinedGlobalAddr
+            ? ConstantExpr::getGetElementPtr(
+                  Int8Ty, CombinedGlobalAddr,
+                  ConstantInt::get(IntPtrTy, BSI.ByteOffset))
+            : ConstantExpr::getIntToPtr(
+                  ConstantInt::get(IntPtrTy, BSI.ByteOffset), Int8PtrTy);
     TIL.AlignLog2 = ConstantInt::get(Int8Ty, BSI.AlignLog2);
     TIL.SizeM1 = ConstantInt::get(IntPtrTy, BSI.BitSize - 1);
     if (BSI.isAllOnes()) {
       TIL.TheKind = (BSI.BitSize == 1) ? TypeTestResolution::Single
                                        : TypeTestResolution::AllOnes;
     } else if (BSI.BitSize <= 64) {
       TIL.TheKind = TypeTestResolution::Inline;
       uint64_t InlineBits = 0;

 /// been finalized.
 void LowerTypeTestsModule::buildBitSetsFromFunctionsWASM(
     ArrayRef<Metadata *> TypeIds, ArrayRef<GlobalTypeMember *> Functions) {
   assert(!Functions.empty());
 
   // Build consecutive monotonic integer ranges for each call target set
   DenseMap<GlobalTypeMember *, uint64_t> GlobalLayout;
 
+  // Use absolute_symbol metadata to store the assigned table index since it
+  // cannot be dropped, unlike normal metadata
+  auto SetAbsValue = [&](Function *F, uint64_t V) {
+    auto *MinC = ConstantAsMetadata::get(ConstantInt::get(IntPtrTy, V));
+    auto *MaxC = ConstantAsMetadata::get(ConstantInt::get(IntPtrTy, V + 1));
+    F->setMetadata(LLVMContext::MD_absolute_symbol,
+                   MDNode::get(M.getContext(), {MinC, MaxC}));
+  };
+
+  // Perform two passes; first one for imports only
+  for (GlobalTypeMember *GTM : Functions) {
+    Function *F = cast<Function>(GTM->getGlobal());
+
+    // Skip non-address-taken functions, or functions that are not imports
+    if (!F->hasAddressTaken() || !F->isDeclaration())
+      continue;
+
+    // Store metadata with the index for each function
+    SetAbsValue(F, IndirectIndex);
+
+    // Assign the counter value
+    GlobalLayout[GTM] = IndirectIndex++;
+  }
+
+  // Perform two passes; second one for definitions only
   for (GlobalTypeMember *GTM : Functions) {
     Function *F = cast<Function>(GTM->getGlobal());
 
-    // Skip functions that are not address taken, to avoid bloating the table
-    if (!F->hasAddressTaken())
+    // Skip non-address-taken functions, or functions that are imports
+    if (!F->hasAddressTaken() || F->isDeclaration())
       continue;
 
     // Store metadata with the index for each function
-    MDNode *MD = MDNode::get(F->getContext(),
-                             ArrayRef<Metadata *>(ConstantAsMetadata::get(
-                                 ConstantInt::get(Int64Ty, IndirectIndex))));
-    F->setMetadata("wasm.index", MD);
+    SetAbsValue(F, IndirectIndex);
 
     // Assign the counter value
     GlobalLayout[GTM] = IndirectIndex++;
   }
 
-  // The indirect function table index space starts at zero, so pass a NULL
-  // pointer as the subtracted "jump table" offset.
-  lowerTypeTestCalls(TypeIds, ConstantPointerNull::get(Int32PtrTy),
-                     GlobalLayout);
+  // Don't pass CombinedGlobal because no jump table is used and absolute
+  // symbols are not supported
+  lowerTypeTestCalls(TypeIds, nullptr, GlobalLayout);
 }
 
 void LowerTypeTestsModule::buildBitSetsFromDisjointSet(
     ArrayRef<Metadata *> TypeIds, ArrayRef<GlobalTypeMember *> Globals,
     ArrayRef<ICallBranchFunnel *> ICallBranchFunnels) {
   DenseMap<Metadata *, uint64_t> TypeIdIndices;
   for (unsigned I = 0; I != TypeIds.size(); ++I)
     TypeIdIndices[TypeIds[I]] = I;

llvm/test/CodeGen/WebAssembly/cfi-obj.ll

+; RUN: opt -S -lowertypetests < %s | llc -filetype=obj | obj2yaml | FileCheck %s
+
+; Tests that we correctly assign indexes for control flow integrity.
+
+target datalayout = "e-m:e-p:32:32-i64:64-n32:64-S128"
+target triple = "wasm32-unknown-unknown"
+
+@0 = private unnamed_addr constant [2 x void (...)*] [void (...)* bitcast (void ()* @f to void (...)*), void (...)* bitcast (void ()* @g to void (...)*)], align 16
+
+define void @h() !type !0 {
+  ret void
+}
+
+define void @f() !type !0 {
+  ret void
+}
+
+define void @g() !type !1 {
+  ret void
+}
+
+!0 = !{i32 0, !"typeid1"}
+!1 = !{i32 0, !"typeid2"}
+
+declare i1 @llvm.type.test(i8* %ptr, metadata %bitset) nounwind readnone
+declare void @llvm.trap() nounwind noreturn
+
+define i1 @foo(i8* %p) {
+  %x = call i1 @llvm.type.test(i8* %p, metadata !"typeid1")
+  br i1 %x, label %contx, label %trap
+
+trap:
+  tail call void @llvm.trap() #1
+  unreachable
+
+contx:
+  %y = call i1 @llvm.type.test(i8* %p, metadata !"typeid2")
+  br i1 %y, label %conty, label %trap
+
+conty:
+  %z = add i1 %x, %y
+  ret i1 %z
+}
+
+; CHECK:  - Type:            ELEM
+; CHECK-NEXT:  Segments:
+; CHECK-NEXT:    - Offset:
+; CHECK-NEXT:        Opcode:          I32_CONST
+; CHECK-NEXT:        Value:           1
+; CHECK-NEXT:      Functions:       [ 1, 2 ]
+
+; CHECK:  - Type:            CUSTOM
+; CHECK-NEXT:    Name:            linking
+; CHECK-NEXT:    Version:         2
+; CHECK-NEXT:    SymbolTable:
+; CHECK:      - Index:           1
+; CHECK-NEXT:        Kind:            FUNCTION
+; CHECK-NEXT:        Name:            f
+; CHECK-NEXT:        Flags:           [  ]
+; CHECK-NEXT:        Function:        1
+; CHECK-NEXT:          - Index:           2
+; CHECK-NEXT:        Kind:            FUNCTION
+; CHECK-NEXT:        Name:            g
+; CHECK-NEXT:        Flags:           [  ]
+; CHECK-NEXT:        Function:        2

llvm/test/MC/WebAssembly/cfi.ll

+; RUN: llc -O2 -filetype=obj %s -o - | obj2yaml | FileCheck %s
+
+target triple = "wasm32-unknown-unknown"
+
+declare i32 @import1()
+declare !absolute_symbol !0 i32 @import2()
+declare i32 @import3()
+
+; call the imports to make sure they are included in the imports section
+define hidden void @call_imports() {
+entry:
+  %call1 = call i32 @import1()
+  %call3 = call i32 @import3()
+  ret void
+}
+
+define i32 @define1() !absolute_symbol !1 {
+    ret i32 0
+}
+
+; take the address of the second import and the first definition. they should be
+; placed at indices 1 and 2 in the table.
+define hidden void @call_indirect() {
+entry:
+  %addr_i2 = alloca i32 ()*, align 4
+  %addr_d1 = alloca i32 ()*, align 4
+  store i32 ()* @import2, i32 ()** %addr_i2, align 4
+  store i32 ()* @define1, i32 ()** %addr_d1, align 4
+  ret void
+}
+
+!0 = !{i64 1, i64 2}
+!1 = !{i64 2, i64 3}
+
+; CHECK:  - Type:            ELEM
+; CHECK-NEXT:  Segments:
+; CHECK-NEXT:    - Offset:
+; CHECK-NEXT:        Opcode:          I32_CONST
+; CHECK-NEXT:        Value:           1
+; CHECK-NEXT:      Functions:       [ 2, 4 ]
+
+; CHECK:  - Type:            CUSTOM
+; CHECK-NEXT:    Name:            linking
+; CHECK-NEXT:    Version:         2
+; CHECK-NEXT:    SymbolTable:
+; CHECK:      - Index:           3
+; CHECK-NEXT:        Kind:            FUNCTION
+; CHECK-NEXT:        Name:            define1
+; CHECK-NEXT:        Flags:           [  ]
+; CHECK-NEXT:        Function:        4
+; CHECK:          - Index:           6
+; CHECK-NEXT:        Kind:            FUNCTION
+; CHECK-NEXT:        Name:            import2
+; CHECK-NEXT:        Flags:           [ UNDEFINED ]
+; CHECK-NEXT:        Function:        2

llvm/test/Transforms/LowerTypeTests/function-disjoint.ll

 ; RUN: opt -S -lowertypetests -mtriple=x86_64-unknown-linux-gnu < %s | FileCheck --check-prefix=X64 %s
 ; RUN: opt -S -lowertypetests -mtriple=wasm32-unknown-unknown < %s | FileCheck --check-prefix=WASM32 %s
 
 ; Tests that we correctly handle bitsets with disjoint call target sets.
 
 target datalayout = "e-p:64:64"
 
 ; X64: @f = alias void (), void ()* @[[JT0:.*]]
 ; X64: @g = alias void (), void ()* @[[JT1:.*]]
 
 ; WASM32: private constant [0 x i8] zeroinitializer
 @0 = private unnamed_addr constant [2 x void ()*] [void ()* @f, void ()* @g], align 16
 
 ; X64: define hidden void @f.cfi()
-; WASM32: define void @f() !type !{{[0-9]+}} !wasm.index ![[I0:[0-9]+]]
+; WASM32: define void @f() !type !{{[0-9]+}} !absolute_symbol ![[I0:[0-9]+]]
 define void @f() !type !0 {
   ret void
 }
 
 ; X64: define hidden void @g.cfi()
-; WASM32: define void @g() !type !{{[0-9]+}} !wasm.index ![[I1:[0-9]+]]
+; WASM32: define void @g() !type !{{[0-9]+}} !absolute_symbol ![[I1:[0-9]+]]
 define void @g() !type !1 {
   ret void
 }
 
 !0 = !{i32 0, !"typeid1"}
 !1 = !{i32 0, !"typeid2"}
 
 declare i1 @llvm.type.test(i8* %ptr, metadata %bitset) nounwind readnone
 
 define i1 @foo(i8* %p) {
   ; X64: icmp eq i64 {{.*}}, ptrtoint (void ()* @[[JT0]] to i64)
-  ; WASM32: icmp eq i64 {{.*}}, ptrtoint (i8* getelementptr (i8, i8* null, i64 1) to i64)
+  ; WASM32: icmp eq i64 {{.*}}, 1
   %x = call i1 @llvm.type.test(i8* %p, metadata !"typeid1")
   ; X64: icmp eq i64 {{.*}}, ptrtoint (void ()* @[[JT1]] to i64)
-  ; WASM32: icmp eq i64 {{.*}}, mul (i64 ptrtoint (i8* getelementptr (i8, i8* null, i32 1) to i64), i64 2)
+  ; WASM32: icmp eq i64 {{.*}}, 2
   %y = call i1 @llvm.type.test(i8* %p, metadata !"typeid2")
   %z = add i1 %x, %y
   ret i1 %z
 }
 
 ; X64: define private void @[[JT0]]() #{{.*}} align 8 {
 ; X64:   call void asm sideeffect "jmp ${0:c}@plt\0Aint3\0Aint3\0Aint3\0A", "s"(void ()* @f.cfi)
 
 ; X64: define private void @[[JT1]]() #{{.*}} align 8 {
 ; X64:   call void asm sideeffect "jmp ${0:c}@plt\0Aint3\0Aint3\0Aint3\0A", "s"(void ()* @g.cfi)
 
-; WASM32: ![[I0]] = !{i64 1}
-; WASM32: ![[I1]] = !{i64 2}
+; WASM32: ![[I0]] = !{i64 1, i64 2}
+; WASM32: ![[I1]] = !{i64 2, i64 3}

llvm/test/Transforms/LowerTypeTests/function-ext.ll

 ; RUN: opt -S -lowertypetests -mtriple=x86_64-unknown-linux-gnu < %s | FileCheck --check-prefixes=CHECK,X64 %s
 ; RUN: opt -S -lowertypetests -mtriple=wasm32-unknown-unknown < %s | FileCheck --check-prefixes=CHECK,WASM32 %s
 
 ; Tests that we correctly handle external references, including the case where
 ; all functions in a bitset are external references.
 
 ; WASM32: private constant [0 x i8] zeroinitializer
 
-; WASM32: declare !type !{{[0-9]+}} !wasm.index !{{[0-9]+}} void @foo1()
+; WASM32: declare !type !{{[0-9]+}} !absolute_symbol !{{[0-9]+}} void @foo1()
 declare !type !0 void @foo1()
 ; WASM32: declare !type !{{[0-9]+}} void @foo2()
 declare !type !1 void @foo2()
 
 ; CHECK-LABEL: @bar
 define i1 @bar(i8* %ptr) {
   ; CHECK: %[[ICMP:[0-9]+]] = icmp eq
   ; CHECK: ret i1 %[[ICMP]]
   %p = call i1 @llvm.type.test(i8* %ptr, metadata !"type1")
   ret i1 %p
 }
 
 ; CHECK-LABEL: @baz
 define i1 @baz(i8* %ptr) {
   ; CHECK: ret i1 false
   %p = call i1 @llvm.type.test(i8* %ptr, metadata !"type2")
   ret i1 %p
 }
 
 ; CHECK-LABEL: @addrtaken
 define void()* @addrtaken() {
   ; X64: ret void ()* @[[JT:.*]]
+  ; WASM32: ret void ()* @foo1
   ret void()* @foo1
 }
 
 declare i1 @llvm.type.test(i8* %ptr, metadata %bitset) nounwind readnone
 
 !0 = !{i64 0, !"type1"}
 !1 = !{i64 0, !"type2"}
 
 ; X64: define private void @[[JT]]() #{{.*}} align {{.*}} {
 ; X64:   call void asm sideeffect "jmp ${0:c}@plt\0Aint3\0Aint3\0Aint3\0A", "s"(void ()* @foo1)

llvm/test/Transforms/LowerTypeTests/function.ll

 
 ; NATIVE: @f = alias void (), void ()* @[[JT:.*]]
 
 ; X86: @g = internal alias void (), bitcast ([8 x i8]* getelementptr inbounds ([2 x [8 x i8]], [2 x [8 x i8]]* bitcast (void ()* @[[JT]] to [2 x [8 x i8]]*), i64 0, i64 1) to void ()*)
 ; ARM: @g = internal alias void (), bitcast ([4 x i8]* getelementptr inbounds ([2 x [4 x i8]], [2 x [4 x i8]]* bitcast (void ()* @[[JT]] to [2 x [4 x i8]]*), i64 0, i64 1) to void ()*)
 ; THUMB: @g = internal alias void (), bitcast ([4 x i8]* getelementptr inbounds ([2 x [4 x i8]], [2 x [4 x i8]]* bitcast (void ()* @[[JT]] to [2 x [4 x i8]]*), i64 0, i64 1) to void ()*)
 
 ; NATIVE: define hidden void @f.cfi()
-; WASM32: define void @f() !type !{{[0-9]+}} !wasm.index ![[I0:[0-9]+]]
+; WASM32: define void @f() !type !{{[0-9]+}} !absolute_symbol ![[I0:[0-9]+]]
 define void @f() !type !0 {
   ret void
 }
 
 ; NATIVE: define internal void @g.cfi()
-; WASM32: define internal void @g() !type !{{[0-9]+}} !wasm.index ![[I1:[0-9]+]]
+; WASM32: define internal void @g() !type !{{[0-9]+}} !absolute_symbol ![[I1:[0-9]+]]
 define internal void @g() !type !0 {
   ret void
 }
 
 !0 = !{i32 0, !"typeid1"}
 
 declare i1 @llvm.type.test(i8* %ptr, metadata %bitset) nounwind readnone
 
 define i1 @foo(i8* %p) {
   ; NATIVE: sub i64 {{.*}}, ptrtoint (void ()* @[[JT]] to i64)
-  ; WASM32: sub i64 {{.*}}, ptrtoint (i8* getelementptr (i8, i8* null, i64 1) to i64)
+  ; WASM32: sub i64 {{.*}}, 1
   ; WASM32: icmp ule i64 {{.*}}, 1
   %x = call i1 @llvm.type.test(i8* %p, metadata !"typeid1")
   ret i1 %x
 }
 
 ; X86-LINUX:   define private void @[[JT]]() #[[ATTR:.*]] align 8 {
 ; X86-WIN32:   define private void @[[JT]]() #[[ATTR:.*]] align 8 {
 ; ARM:   define private void @[[JT]]() #[[ATTR:.*]] align 4 {

 
 ; NATIVE-SAME: "s,s"(void ()* @f.cfi, void ()* @g.cfi)
 
 ; X86-LINUX: attributes #[[ATTR]] = { naked nounwind }
 ; X86-WIN32: attributes #[[ATTR]] = { nounwind }
 ; ARM: attributes #[[ATTR]] = { naked nounwind
 ; THUMB: attributes #[[ATTR]] = { naked nounwind "target-cpu"="cortex-a8" "target-features"="+thumb-mode" }
 
-; WASM32: ![[I0]] = !{i64 1}
-; WASM32: ![[I1]] = !{i64 2}
+; WASM32: ![[I0]] = !{i64 1, i64 2}
+; WASM32: ![[I1]] = !{i64 2, i64 3}