Fix ref.null semantics

[ShinWonho]

Problem

This is the semantics of ref.null ht in the current specification. But I think simply pushing ref.null ht is problematic.

Example

Consider the following example, which is simplified version of "test-sub" in ref_test.wast.

(module
  (type $t0 (sub (struct)))

  (func (export "test-sub")
    ;; must hold
    (ref.test (ref null $t0) (ref.null $t0))
    (drop)))

(assert_return (invoke "test-sub"))

According to the semantics of ref.test, we first need to get the reference type of ref.null $t0.

However, the typeindex $t0 is not ok under empty context.

Suggested change

In the reference interpreter, type index of ref.null $t0 is substituted before pushed.

let rec step (c : config) : config =

      ....

      | RefNull t, vs' ->
        Ref (NullRef (subst_heap_type (subst_of c.frame.inst) t)) :: vs', []

Therefore, I fixed the semantics according to the reference interpreter.

[zapashcanon]

Because (ref.null ht) is defined to be a value, and values must never reduce, otherwise the Progress statement is compromised.

Wouldn't having null.new $t to be an instruction and ref.null $t a value fix the issue ?

[rossberg]

See my reply on the other issue. Also, ref.null is already standardised as part of Wasm 2.0 (as is ref.func, btw), so we cannot change it anymore.

[ShinWonho]

I changed the syntax of ref.null value so that ref.null with type index cannot be a value. Is this right fix?