loader: fix block/loop ref params type checking

Author: XeniaLu

core/iwasm/interpreter/wasm_loader.c

@@ -12050,9 +12050,25 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
                     WASMFuncType *wasm_type = block_type.u.type;
 
                     BranchBlock *cur_block = loader_ctx->frame_csp - 1;
+#if WASM_ENABLE_GC != 0
+                    WASMRefType *ref_type;
+                    uint32 j = 0;
+#endif
 #if WASM_ENABLE_FAST_INTERP != 0
                     uint32 cell_num;
                     available_params = block_type.u.type->param_count;
+#endif
+#if WASM_ENABLE_GC != 0
+                    /* find the index of the last param
+                     * in wasm_type->ref_type_maps as j */
+                    for (i = 0; i < block_type.u.type->param_count; i++) {
+                        if (wasm_is_type_multi_byte_type(wasm_type->types[i])) {
+                            j += 1;
+                        }
+                    }
+                    if (j > 0) {
+                        j -= 1;
+                    }
 #endif
                     for (i = 0; i < block_type.u.type->param_count; i++) {
 
@@ -12066,6 +12082,16 @@ wasm_loader_prepare_bytecode(WASMModule *module, WASMFunction *func,
 #endif
                             break;
                         }
+#if WASM_ENABLE_GC != 0
+                        if (wasm_is_type_multi_byte_type(wasm_type->types[wasm_type->param_count - i - 1])) {
+                            bh_assert(wasm_type->ref_type_maps[j].index == wasm_type->param_count - i - 1);
+                            ref_type = wasm_type->ref_type_maps[j].ref_type;
+                            bh_memcpy_s(&wasm_ref_type, sizeof(WASMRefType),
+                                        ref_type,
+                                        wasm_reftype_struct_size(ref_type));
+                            j--;
+                        }
+#endif
 
                         POP_TYPE(
                             wasm_type->types[wasm_type->param_count - i - 1]);

tests/regression/ba-issues/issues/issue-4646/test.wasm

@@ -0,0 +1,31 @@
+;; 定义不同的引用类型
+(type $struct_a (struct (field (mut i32))))
+(type $struct_b (struct (field (mut i64))))
+(type $struct_c (struct (field (mut i32)) (field (mut i32))))
+
+(func $main
+  ;; 准备参数：i32, ref_a, i32, ref_b
+  (i32.const 10)
+  (struct.new $struct_a (i32.const 100))
+  (i32.const 20)
+  (struct.new $struct_b (i64.const 200))
+
+  ;; 带交错参数的block：i32, ref_a, i32, ref_b -> ref_c
+  (block (param i32 (ref $struct_a) i32 (ref $struct_b)) (result (ref $struct_c))
+    ;; 清理栈中的参数
+    drop  ;; 丢弃 ref_b
+    drop  ;; 丢弃 i32
+    drop  ;; 丢弃 ref_a
+    drop  ;; 丢弃 i32
+    ;; 返回新的第三种类型引用
+
+    (struct.new $struct_c (i32.const 300) (i32.const 400))
+  )
+
+  ;; 丢弃返回值
+  drop
+)
+
+(memory 1)
+(export "memory" (memory 0))
+(export "_start" (func $main))

tests/regression/ba-issues/issues/issue-4646/test.wat

@@ -1754,6 +1754,22 @@
                 "stdout content": "",
                 "description": "no sanitizer 'heap-buffer-overflow'"
             }
+        },
+        {
+            "deprecated": false,
+            "ids": [
+                4646
+            ],
+            "runtime": "iwasm-default-gc-enabled",
+            "file": "test.wasm",
+            "mode": "classic-interp",
+            "options": "-f _start",
+            "argument": "",
+            "expected return": {
+                "ret code": 0,
+                "stdout content": "",
+                "description": "load successfully"
+            }
         }
     ]
 }