Attachment 372095 Details for Bug 198157 – Patch

[patch] Patch

bug-198157-20190613190231.patch (text/plain), 84.17 KB, created by Justin Michaud on 2019-06-13 19:02:31 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Justin Michaud

Created: 2019-06-13 19:02:31 PDT

Size: 84.17 KB

patch

obsolete

>Subversion Revision: 246417
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 65ee267357143c50676cb7e14a2d9ac568a2d18b..fb1be7443480e30597620c74ffe106f3708a8290 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,84 @@
>+2019-06-10  Justin Michaud  <justin_michaud@apple.com>
>+
>+        [WASM-References] Add support for Funcref in parameters and return types
>+        https://bugs.webkit.org/show_bug.cgi?id=198157
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Add support for funcref in parameters, globals, and in table.get/set. When converting a JSValue to 
>+        a funcref (nÃ©e anyfunc), we first make sure it is an exported wasm function or null. 
>+
>+        We also add support for Ref.func. Anywhere a Ref.func is used, (statically) we construct a JS wrapper
>+        for it so that we never need to construct JSValues when handling references. This should make threads
>+        easier to implement.
>+
>+        * wasm/WasmAirIRGenerator.cpp:
>+        (JSC::Wasm::AirIRGenerator::tmpForType):
>+        (JSC::Wasm::AirIRGenerator::moveOpForValueType):
>+        (JSC::Wasm::AirIRGenerator::AirIRGenerator):
>+        (JSC::Wasm::AirIRGenerator::addLocal):
>+        (JSC::Wasm::AirIRGenerator::addConstant):
>+        (JSC::Wasm::AirIRGenerator::addRefFunc):
>+        (JSC::Wasm::AirIRGenerator::addTableSet):
>+        (JSC::Wasm::AirIRGenerator::setGlobal):
>+        (JSC::Wasm::AirIRGenerator::addReturn):
>+        * wasm/WasmB3IRGenerator.cpp:
>+        (JSC::Wasm::B3IRGenerator::addLocal):
>+        (JSC::Wasm::B3IRGenerator::addTableSet):
>+        (JSC::Wasm::B3IRGenerator::addRefFunc):
>+        (JSC::Wasm::B3IRGenerator::setGlobal):
>+        * wasm/WasmBBQPlan.cpp:
>+        (JSC::Wasm::BBQPlan::compileFunctions):
>+        * wasm/WasmCallingConvention.h:
>+        (JSC::Wasm::CallingConventionAir::marshallArgument const):
>+        (JSC::Wasm::CallingConventionAir::setupCall const):
>+        * wasm/WasmExceptionType.h:
>+        * wasm/WasmFormat.h:
>+        (JSC::Wasm::isValueType):
>+        (JSC::Wasm::isSubtype):
>+        * wasm/WasmFunctionParser.h:
>+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
>+        (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
>+        * wasm/WasmInstance.cpp:
>+        (JSC::Wasm::Instance::Instance):
>+        (JSC::Wasm::Instance::getFunctionWrapper const):
>+        (JSC::Wasm::Instance::setFunctionWrapper):
>+        * wasm/WasmInstance.h:
>+        * wasm/WasmModuleInformation.h:
>+        (JSC::Wasm::ModuleInformation::referencedFunctions const):
>+        (JSC::Wasm::ModuleInformation::addReferencedFunction const):
>+        * wasm/WasmSectionParser.cpp:
>+        (JSC::Wasm::SectionParser::parseGlobal):
>+        (JSC::Wasm::SectionParser::parseInitExpr):
>+        * wasm/WasmValidate.cpp:
>+        (JSC::Wasm::Validate::addTableGet):
>+        (JSC::Wasm::Validate::addTableSet):
>+        (JSC::Wasm::Validate::addRefIsNull):
>+        (JSC::Wasm::Validate::addRefFunc):
>+        (JSC::Wasm::Validate::setLocal):
>+        (JSC::Wasm::Validate::addCall):
>+        (JSC::Wasm::Validate::addCallIndirect):
>+        * wasm/js/JSToWasm.cpp:
>+        (JSC::Wasm::createJSToWasmWrapper):
>+        * wasm/js/JSWebAssemblyHelpers.h:
>+        (JSC::isWebAssemblyHostFunction):
>+        * wasm/js/JSWebAssemblyInstance.cpp:
>+        (JSC::JSWebAssemblyInstance::visitChildren):
>+        * wasm/js/JSWebAssemblyRuntimeError.cpp:
>+        (JSC::createJSWebAssemblyRuntimeError):
>+        * wasm/js/JSWebAssemblyRuntimeError.h:
>+        * wasm/js/WasmToJS.cpp:
>+        (JSC::Wasm::handleBadI64Use):
>+        (JSC::Wasm::wasmToJS):
>+        (JSC::Wasm::emitWasmToJSException):
>+        * wasm/js/WasmToJS.h:
>+        * wasm/js/WebAssemblyFunction.cpp:
>+        (JSC::callWebAssemblyFunction):
>+        (JSC::WebAssemblyFunction::jsCallEntrypointSlow):
>+        * wasm/js/WebAssemblyModuleRecord.cpp:
>+        (JSC::WebAssemblyModuleRecord::link):
>+        * wasm/wasm.json:
>+
> 2019-06-13  Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         Yarr bytecode compilation failure should be gracefully handled
>diff --git a/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp b/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp
>index 57b3df810e4b12f9e73ac4b14780b1649d873cb2..41efd6202a57db462cbf548bd1f7a2a0af6abd05 100644
>--- a/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp
>@@ -234,6 +234,7 @@ public:
> 
>     // References
>     PartialResult WARN_UNUSED_RETURN addRefIsNull(ExpressionType& value, ExpressionType& result);
>+    PartialResult WARN_UNUSED_RETURN addRefFunc(uint32_t index, ExpressionType& result);
> 
>     // Tables
>     PartialResult WARN_UNUSED_RETURN addTableGet(ExpressionType& idx, ExpressionType& result);
>@@ -370,6 +371,7 @@ private:
>             return g32();
>         case Type::I64:
>         case Type::Anyref:
>+        case Type::Anyfunc:
>             return g64();
>         case Type::F32:
>             return f32();
>@@ -554,6 +556,7 @@ private:
>             return Move32;
>         case Type::I64:
>         case Type::Anyref:
>+        case Type::Anyfunc:
>             return Move;
>         case Type::F32:
>             return MoveFloat;
>@@ -799,6 +802,7 @@ AirIRGenerator::AirIRGenerator(const ModuleInformation& info, B3::Procedure& pro
>             break;
>         case Type::I64:
>         case Type::Anyref:
>+        case Type::Anyfunc:
>             append(Move, arg, m_locals[i]);
>             break;
>         case Type::F32:
>@@ -885,6 +889,7 @@ auto AirIRGenerator::addLocal(Type type, uint32_t count) -> PartialResult
>         m_locals.uncheckedAppend(local);
>         switch (type) {
>         case Type::Anyref:
>+        case Type::Anyfunc:
>             append(Move, Arg::imm(JSValue::encode(jsNull())), local);
>             break;
>         case Type::I32:
>@@ -919,6 +924,7 @@ auto AirIRGenerator::addConstant(BasicBlock* block, Type type, uint64_t value) -
>     case Type::I32:
>     case Type::I64:
>     case Type::Anyref:
>+    case Type::Anyfunc:
>         append(block, Move, Arg::bigImm(value), result);
>         break;
>     case Type::F32:
>@@ -954,6 +960,15 @@ auto AirIRGenerator::addRefIsNull(ExpressionType& value, ExpressionType& result)
>     return { };
> }
> 
>+auto AirIRGenerator::addRefFunc(uint32_t index, ExpressionType& result) -> PartialResult
>+{
>+    // FIXME: Emit this inline <https://bugs.webkit.org/show_bug.cgi?id=198506>.
>+    result = tmpForType(Type::Anyfunc);
>+    emitCCall(&doWasmRefFunc, result, instanceValue(), addConstant(Type::I32, index));
>+
>+    return { };
>+}
>+
> auto AirIRGenerator::addTableGet(ExpressionType& idx, ExpressionType& result) -> PartialResult
> {
>     // FIXME: Emit this inline <https://bugs.webkit.org/show_bug.cgi?id=198506>.
>@@ -977,13 +992,7 @@ auto AirIRGenerator::addTableSet(ExpressionType& idx, ExpressionType& value) ->
>     ASSERT(idx.type() == Type::I32);
>     ASSERT(value.tmp());
> 
>-    void (*doSet)(Instance*, int32_t, uint64_t value) = [] (Instance* instance, int32_t idx, uint64_t value) -> void {
>-        // FIXME: We need to box wasm Funcrefs once they are supported here.
>-        // <https://bugs.webkit.org/show_bug.cgi?id=198157>
>-        instance->table()->set(idx, JSValue::decode(value));
>-    };
>-
>-    emitCCall(doSet, TypedTmp(), instanceValue(), idx, value);
>+    emitCCall(&setWasmTableElement, TypedTmp(), instanceValue(), idx, value);
> 
>     return { };
> }
>@@ -1104,7 +1113,7 @@ auto AirIRGenerator::setGlobal(uint32_t index, ExpressionType value) -> PartialR
>         append(moveOpForValueType(type), value, Arg::addr(temp));
>     }
> 
>-    if (type == Anyref)
>+    if (isSubtype(type, Anyref))
>         emitWriteBarrierForJSWrapper();
> 
>     return { };
>@@ -1624,6 +1633,7 @@ auto AirIRGenerator::addReturn(const ControlData& data, const ExpressionList& re
>             break;
>         case Type::I64:
>         case Type::Anyref:
>+        case Type::Anyfunc:
>             append(Move, returnValues[0], returnValueGPR);
>             append(Ret64, returnValueGPR);
>             break;
>diff --git a/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp b/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
>index 2226ffc72c9382cc26fb3ebbe09429760ef44ab7..5e6a57eb18ff5f65cbd8a20ceb3326b541aa8fc3 100644
>--- a/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
>@@ -187,6 +187,7 @@ public:
> 
>     // References
>     PartialResult WARN_UNUSED_RETURN addRefIsNull(ExpressionType& value, ExpressionType& result);
>+    PartialResult WARN_UNUSED_RETURN addRefFunc(uint32_t index, ExpressionType& result);
> 
>     // Tables
>     PartialResult WARN_UNUSED_RETURN addTableGet(ExpressionType& idx, ExpressionType& result);
>@@ -539,7 +540,7 @@ auto B3IRGenerator::addLocal(Type type, uint32_t count) -> PartialResult
>     for (uint32_t i = 0; i < count; ++i) {
>         Variable* local = m_proc.addVariable(toB3Type(type));
>         m_locals.uncheckedAppend(local);
>-        auto val = type == Anyref ? JSValue::encode(jsNull()) : 0;
>+        auto val = isSubtype(type, Anyref) ? JSValue::encode(jsNull()) : 0;
>         m_currentBlock->appendNew<VariableValue>(m_proc, Set, Origin(), local, constant(toB3Type(type), val, Origin()));
>     }
>     return { };
>@@ -583,19 +584,25 @@ auto B3IRGenerator::addTableGet(ExpressionType& idx, ExpressionType& result) ->
> auto B3IRGenerator::addTableSet(ExpressionType& idx, ExpressionType& value) -> PartialResult
> {
>     // FIXME: Emit this inline <https://bugs.webkit.org/show_bug.cgi?id=198506>.
>-    void (*doSet)(Instance*, int32_t, uint64_t value) = [] (Instance* instance, int32_t idx, uint64_t value) -> void {
>-        // FIXME: We need to box wasm Funcrefs once they are supported here.
>-        // <https://bugs.webkit.org/show_bug.cgi?id=198157>
>-        instance->table()->set(idx, JSValue::decode(value));
>-    };
> 
>     m_currentBlock->appendNew<CCallValue>(m_proc, B3::Void, origin(),
>-        m_currentBlock->appendNew<ConstPtrValue>(m_proc, origin(), tagCFunctionPtr<void*>(doSet, B3CCallPtrTag)),
>+        m_currentBlock->appendNew<ConstPtrValue>(m_proc, origin(), tagCFunctionPtr<void*>(&setWasmTableElement, B3CCallPtrTag)),
>         instanceValue(), idx, value);
> 
>     return { };
> }
> 
>+auto B3IRGenerator::addRefFunc(uint32_t index, ExpressionType& result) -> PartialResult
>+{
>+    // FIXME: Emit this inline <https://bugs.webkit.org/show_bug.cgi?id=198506>.
>+
>+    result = m_currentBlock->appendNew<CCallValue>(m_proc, B3::Int64, origin(),
>+        m_currentBlock->appendNew<ConstPtrValue>(m_proc, origin(), tagCFunctionPtr<void*>(&doWasmRefFunc, B3CCallPtrTag)),
>+        instanceValue(), addConstant(Type::I32, index));
>+
>+    return { };
>+}
>+
> auto B3IRGenerator::getLocal(uint32_t index, ExpressionType& result) -> PartialResult
> {
>     ASSERT(m_locals[index]);
>@@ -680,7 +687,7 @@ auto B3IRGenerator::setGlobal(uint32_t index, ExpressionType value) -> PartialRe
>     Value* globalsArray = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), origin(), instanceValue(), safeCast<int32_t>(Instance::offsetOfGlobals()));
>     m_currentBlock->appendNew<MemoryValue>(m_proc, Store, origin(), value, globalsArray, safeCast<int32_t>(index * sizeof(Register)));
> 
>-    if (m_info.globals[index].type == Anyref)
>+    if (isSubtype(m_info.globals[index].type, Anyref))
>         emitWriteBarrierForJSWrapper();
> 
>     return { };
>diff --git a/Source/JavaScriptCore/wasm/WasmBBQPlan.cpp b/Source/JavaScriptCore/wasm/WasmBBQPlan.cpp
>index 0b38f9d596bfc07bcb672bc2a17b71aadc1c49aa..65cde662ceae1c52ae7639878165460beceee1b9 100644
>--- a/Source/JavaScriptCore/wasm/WasmBBQPlan.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmBBQPlan.cpp
>@@ -286,7 +286,7 @@ void BBQPlan::compileFunctions(CompilationEffort effort)
> 
>         m_wasmInternalFunctions[functionIndex] = WTFMove(*parseAndCompileResult);
> 
>-        if (m_exportedFunctionIndices.contains(functionIndex)) {
>+        if (m_exportedFunctionIndices.contains(functionIndex) || m_moduleInformation->referencedFunctions().contains(functionIndex)) {
>             auto locker = holdLock(m_lock);
>             auto result = m_embedderToWasmInternalFunctions.add(functionIndex, m_createEmbedderWrapper(m_compilationContexts[functionIndex], signature, &m_unlinkedWasmToWasmCalls[functionIndex], m_moduleInformation.get(), m_mode, functionIndex));
>             ASSERT_UNUSED(result, result.isNewEntry);
>diff --git a/Source/JavaScriptCore/wasm/WasmCallingConvention.h b/Source/JavaScriptCore/wasm/WasmCallingConvention.h
>index 10eb8cd4e7336e0ef24dc9be504b7507ce83c752..f7be38c67bee9eb35332113b23e6b243de94cdce 100644
>--- a/Source/JavaScriptCore/wasm/WasmCallingConvention.h
>+++ b/Source/JavaScriptCore/wasm/WasmCallingConvention.h
>@@ -236,6 +236,7 @@ private:
>         case Type::I32:
>         case Type::I64:
>         case Type::Anyref:
>+        case Wasm::Anyfunc:
>             marshallArgumentImpl(m_gprArgs, gpArgumentCount, stackOffset, regFunc, stackFunc);
>             break;
>         case Type::F32:
>@@ -301,6 +302,7 @@ public:
>         case Type::I32:
>         case Type::I64:
>         case Type::Anyref:
>+        case Wasm::Anyfunc:
>             patchpoint->resultConstraint = B3::ValueRep::reg(GPRInfo::returnValueGPR);
>             break;
>         default:
>diff --git a/Source/JavaScriptCore/wasm/WasmExceptionType.h b/Source/JavaScriptCore/wasm/WasmExceptionType.h
>index d446c0ed1b4dd9f66ff5938265a066e0dc92d611..f00f8f181e640d8e83f86b2d9dc1c6c3258d2ce7 100644
>--- a/Source/JavaScriptCore/wasm/WasmExceptionType.h
>+++ b/Source/JavaScriptCore/wasm/WasmExceptionType.h
>@@ -42,7 +42,8 @@ namespace Wasm {
>     macro(IntegerOverflow, "Integer overflow") \
>     macro(StackOverflow, "Stack overflow") \
>     macro(I64ArgumentType, "WebAssembly function with an i64 argument can't be called from JavaScript") \
>-    macro(I64ReturnType, "WebAssembly function that returns i64 can't be called from JavaScript")
>+    macro(I64ReturnType, "WebAssembly function that returns i64 can't be called from JavaScript") \
>+    macro(FuncrefNotWasm, "Anyfunc must be an exported wasm function")
> 
> enum class ExceptionType : uint32_t {
> #define MAKE_ENUM(enumName, error) enumName,
>diff --git a/Source/JavaScriptCore/wasm/WasmFormat.h b/Source/JavaScriptCore/wasm/WasmFormat.h
>index 6292250f25eea9490c43a4ebd46d2e25e0c36c95..7c034417a13f261b8475c8edc4274fa80518b9eb 100644
>--- a/Source/JavaScriptCore/wasm/WasmFormat.h
>+++ b/Source/JavaScriptCore/wasm/WasmFormat.h
>@@ -68,12 +68,20 @@ inline bool isValueType(Type type)
>     case F64:
>         return true;
>     case Anyref:
>+    case Anyfunc:
>         return Options::useWebAssemblyReferences();
>     default:
>         break;
>     }
>     return false;
> }
>+
>+inline bool isSubtype(Type sub, Type parent)
>+{
>+    if (sub == parent)
>+        return true;
>+    return sub == Anyfunc && parent == Anyref;
>+}
>     
> enum class ExternalKind : uint8_t {
>     // FIXME auto-generate this. https://bugs.webkit.org/show_bug.cgi?id=165231
>@@ -138,6 +146,7 @@ struct Global {
>     enum InitializationType {
>         IsImport,
>         FromGlobalImport,
>+        FromRefFunc,
>         FromExpression
>     };
> 
>@@ -234,6 +243,7 @@ public:
>     uint32_t initial() const { return m_initial; }
>     Optional<uint32_t> maximum() const { return m_maximum; }
>     TableElementType type() const { return m_type; }
>+    Wasm::Type wasmType() const { return m_type == TableElementType::Funcref ? Type::Anyfunc : Type::Anyref; }
> 
> private:
>     uint32_t m_initial;
>diff --git a/Source/JavaScriptCore/wasm/WasmFunctionParser.h b/Source/JavaScriptCore/wasm/WasmFunctionParser.h
>index dfae8f2cf3ad2da18aa88bb26bd558cc7d8476de..260be6d5c9dbab9f9f9ce67e70f27b98a6a607db 100644
>--- a/Source/JavaScriptCore/wasm/WasmFunctionParser.h
>+++ b/Source/JavaScriptCore/wasm/WasmFunctionParser.h
>@@ -301,7 +301,7 @@ auto FunctionParser<Context>::parseExpression() -> PartialResult
> 
>     case RefNull: {
>         WASM_PARSER_FAIL_IF(!Options::useWebAssemblyReferences(), "references are not enabled");
>-        m_expressionStack.append(m_context.addConstant(Anyref, JSValue::encode(jsNull())));
>+        m_expressionStack.append(m_context.addConstant(Anyfunc, JSValue::encode(jsNull())));
>         return { };
>     }
> 
>@@ -314,6 +314,17 @@ auto FunctionParser<Context>::parseExpression() -> PartialResult
>         return { };
>     }
> 
>+    case RefFunc: {
>+        uint32_t index;
>+        ExpressionType result;
>+        WASM_PARSER_FAIL_IF(!Options::useWebAssemblyReferences(), "references are not enabled");
>+        WASM_PARSER_FAIL_IF(!parseVarUInt32(index), "can't get index for ref.func");
>+
>+        WASM_TRY_ADD_TO_CONTEXT(addRefFunc(index, result));
>+        m_expressionStack.append(result);
>+        return { };
>+    }
>+
>     case GetLocal: {
>         uint32_t index;
>         ExpressionType result;
>@@ -681,6 +692,13 @@ auto FunctionParser<Context>::parseUnreachableExpression() -> PartialResult
>         return { };
>     }
> 
>+    case RefFunc: {
>+        uint32_t unused;
>+        WASM_PARSER_FAIL_IF(!parseVarUInt32(unused), "can't get immediate for ", m_currentOpcode, " in unreachable context");
>+        WASM_PARSER_FAIL_IF(!Options::useWebAssemblyReferences(), "references are not enabled");
>+        return { };
>+    }
>+
>     case GrowMemory:
>     case CurrentMemory: {
>         uint8_t reserved;
>diff --git a/Source/JavaScriptCore/wasm/WasmInstance.cpp b/Source/JavaScriptCore/wasm/WasmInstance.cpp
>index 37059968e0b7854d27336f1937ec258a370b4966..95f3a86f79a3603f16f787b7278ecf71c386db07 100644
>--- a/Source/JavaScriptCore/wasm/WasmInstance.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmInstance.cpp
>@@ -29,6 +29,7 @@
> #if ENABLE(WEBASSEMBLY)
> 
> #include "JSCInlines.h"
>+#include "JSWebAssemblyHelpers.h"
> #include "JSWebAssemblyInstance.h"
> #include "Register.h"
> #include "WasmModuleInformation.h"
>@@ -57,7 +58,7 @@ Instance::Instance(Context* context, Ref<Module>&& module, EntryFrame** pointerT
>         new (importFunctionInfo(i)) ImportFunctionInfo();
>     memset(static_cast<void*>(m_globals.get()), 0, globalMemoryByteSize(m_module.get()));
>     for (unsigned i = 0; i < m_module->moduleInformation().globals.size(); ++i) {
>-        if (m_module.get().moduleInformation().globals[i].type == Anyref)
>+        if (isSubtype(m_module.get().moduleInformation().globals[i].type, Anyref))
>             m_globalsToMark.set(i);
>     }
> }
>@@ -80,6 +81,50 @@ void Instance::setGlobal(unsigned i, JSValue value)
>     m_globals.get()[i].anyref.set(*owner<JSWebAssemblyInstance>()->vm(), owner<JSWebAssemblyInstance>(), value);
> }
> 
>+JSValue Instance::getFunctionWrapper(unsigned i) const
>+{
>+    return m_functionWrappers.contains(i) ? m_functionWrappers.get(i).get() : jsNull();
>+}
>+
>+void Instance::setFunctionWrapper(unsigned i, JSValue value)
>+{
>+    ASSERT(m_owner);
>+    ASSERT(value.isFunction(*owner<JSWebAssemblyInstance>()->vm()));
>+    ASSERT(!m_functionWrappers.contains(i));
>+    m_functionWrappers.set(i, WriteBarrier<Unknown>(*owner<JSWebAssemblyInstance>()->vm(), owner<JSWebAssemblyInstance>(), value));
>+    ASSERT(getFunctionWrapper(i) == value);
>+}
>+
>+void setWasmTableElement(Wasm::Instance* instance, uint32_t idx, uint64_t encValue)
>+{
>+    JSValue value = JSValue::decode(encValue);
>+    if (instance->table()->type() == Wasm::TableElementType::Anyref)
>+        instance->table()->set(idx, value);
>+    else if (instance->table()->type() == Wasm::TableElementType::Funcref) {
>+        WebAssemblyFunction* wasmFunction;
>+        WebAssemblyWrapperFunction* wasmWrapperFunction;
>+
>+        if (isWebAssemblyHostFunction(*instance->owner<JSObject>()->vm(), value, wasmFunction, wasmWrapperFunction)) {
>+            ASSERT(!!wasmFunction || !!wasmWrapperFunction);
>+            if (wasmFunction)
>+                instance->table()->asFuncrefTable()->setFunction(idx, jsCast<JSObject*>(value), wasmFunction->importableFunction(), &wasmFunction->instance()->instance());
>+            else
>+                instance->table()->asFuncrefTable()->setFunction(idx, jsCast<JSObject*>(value), wasmWrapperFunction->importableFunction(), &wasmWrapperFunction->instance()->instance());
>+        } else if (value.isNull())
>+            instance->table()->clear(idx);
>+        else
>+            ASSERT_NOT_REACHED();
>+    } else
>+        ASSERT_NOT_REACHED();
>+}
>+
>+uint64_t doWasmRefFunc(Wasm::Instance* instance, uint32_t index)
>+{
>+    JSValue val = instance->getFunctionWrapper(index);
>+    ASSERT(val.isFunction(*instance->owner<JSObject>()->vm()));
>+    return JSValue::encode(val);
>+}
>+
> } } // namespace JSC::Wasm
> 
> #endif // ENABLE(WEBASSEMBLY)
>diff --git a/Source/JavaScriptCore/wasm/WasmInstance.h b/Source/JavaScriptCore/wasm/WasmInstance.h
>index 5d1fcf3f9d3b82bd0981a20cccd544e7807ce4d7..0bb4bc9b4b60e73d8bb7096b2f326cf57c1f665c 100644
>--- a/Source/JavaScriptCore/wasm/WasmInstance.h
>+++ b/Source/JavaScriptCore/wasm/WasmInstance.h
>@@ -40,6 +40,9 @@ namespace JSC { namespace Wasm {
> 
> struct Context;
> 
>+void setWasmTableElement(Wasm::Instance*, uint32_t, uint64_t encValue);
>+uint64_t doWasmRefFunc(Wasm::Instance*, uint32_t);
>+
> class Instance : public ThreadSafeRefCounted<Instance>, public CanMakeWeakPtr<Instance> {
> public:
>     using StoreTopCallFrameCallback = WTF::Function<void(void*)>;
>@@ -91,6 +94,8 @@ public:
>     void setGlobal(unsigned i, int64_t bits) { m_globals.get()[i].primitive = bits; }
>     void setGlobal(unsigned, JSValue);
>     const BitVector& globalsToMark() { return m_globalsToMark; }
>+    JSValue getFunctionWrapper(unsigned) const;
>+    void setFunctionWrapper(unsigned, JSValue);
> 
>     static ptrdiff_t offsetOfMemory() { return OBJECT_OFFSETOF(Instance, m_memory); }
>     static ptrdiff_t offsetOfGlobals() { return OBJECT_OFFSETOF(Instance, m_globals); }
>@@ -159,6 +164,7 @@ private:
>         uint64_t primitive;
>     };
>     MallocPtr<GlobalValue> m_globals;
>+    HashMap<uint32_t, WriteBarrier<Unknown>, IntHash<uint32_t>, WTF::UnsignedWithZeroKeyHashTraits<uint32_t>> m_functionWrappers;
>     BitVector m_globalsToMark;
>     EntryFrame** m_pointerToTopEntryFrame { nullptr };
>     void** m_pointerToActualStackLimit { nullptr };
>diff --git a/Source/JavaScriptCore/wasm/WasmModuleInformation.h b/Source/JavaScriptCore/wasm/WasmModuleInformation.h
>index ad5eb9526ac7ac3be437fc623df0bd7dc20807d2..88f66cb639159c369d9dde60a1fce6da5d171289 100644
>--- a/Source/JavaScriptCore/wasm/WasmModuleInformation.h
>+++ b/Source/JavaScriptCore/wasm/WasmModuleInformation.h
>@@ -29,6 +29,7 @@
> 
> #include "WasmFormat.h"
> 
>+#include <wtf/BitVector.h>
> #include <wtf/Optional.h>
> 
> namespace JSC { namespace Wasm {
>@@ -66,6 +67,9 @@ struct ModuleInformation : public ThreadSafeRefCounted<ModuleInformation> {
>     uint32_t memoryCount() const { return memory ? 1 : 0; }
>     uint32_t tableCount() const { return tableInformation ? 1 : 0; }
> 
>+    const BitVector& referencedFunctions() const { return m_referencedFunctions; }
>+    void addReferencedFunction(unsigned index) const { m_referencedFunctions.set(index); }
>+
>     Vector<Import> imports;
>     Vector<SignatureIndex> importFunctionSignatureIndices;
>     Vector<SignatureIndex> internalFunctionSignatureIndices;
>@@ -84,6 +88,8 @@ struct ModuleInformation : public ThreadSafeRefCounted<ModuleInformation> {
>     unsigned firstInternalGlobal { 0 };
>     Vector<CustomSection> customSections;
>     Ref<NameSection> nameSection;
>+    
>+    mutable BitVector m_referencedFunctions;
> };
> 
>     
>diff --git a/Source/JavaScriptCore/wasm/WasmSectionParser.cpp b/Source/JavaScriptCore/wasm/WasmSectionParser.cpp
>index 30b6f3ced9df5626222627253c24684a3c8b4943..254e826a80309440cd257f3d746b70219cd43436 100644
>--- a/Source/JavaScriptCore/wasm/WasmSectionParser.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmSectionParser.cpp
>@@ -291,9 +291,11 @@ auto SectionParser::parseGlobal() -> PartialResult
>         WASM_FAIL_IF_HELPER_FAILS(parseInitExpr(initOpcode, global.initialBitsOrImportNumber, typeForInitOpcode));
>         if (initOpcode == GetGlobal)
>             global.initializationType = Global::FromGlobalImport;
>+        else if (initOpcode == RefFunc)
>+            global.initializationType = Global::FromRefFunc;
>         else
>             global.initializationType = Global::FromExpression;
>-        WASM_PARSER_FAIL_IF(typeForInitOpcode != global.type, "Global init_expr opcode of type ", typeForInitOpcode, " doesn't match global's type ", global.type);
>+        WASM_PARSER_FAIL_IF(!isSubtype(typeForInitOpcode, global.type), "Global init_expr opcode of type ", typeForInitOpcode, " doesn't match global's type ", global.type);
> 
>         m_info->globals.uncheckedAppend(WTFMove(global));
>     }
>@@ -479,11 +481,21 @@ auto SectionParser::parseInitExpr(uint8_t& opcode, uint64_t& bitsOrImportNumber,
>     }
> 
>     case RefNull: {
>-        resultType = Anyref;
>+        resultType = Anyfunc;
>         bitsOrImportNumber = JSValue::encode(jsNull());
>         break;
>     }
> 
>+    case RefFunc: {
>+        uint32_t index;
>+        WASM_PARSER_FAIL_IF(!parseVarUInt32(index), "can't get ref.func index");
>+        WASM_PARSER_FAIL_IF(index >= m_info->functions.size(), "ref.func index", index, " exceeds the number of functions ", m_info->functions.size());
>+
>+        resultType = Anyfunc;
>+        bitsOrImportNumber = index;
>+        break;
>+    }
>+
>     default:
>         WASM_PARSER_FAIL_IF(true, "unknown init_expr opcode ", opcode);
>     }
>diff --git a/Source/JavaScriptCore/wasm/WasmValidate.cpp b/Source/JavaScriptCore/wasm/WasmValidate.cpp
>index a4b78e458df4598e0ccda61fa94ec919a29afcf4..f594aee7262d320eebcf58e8629b1bb27971960a 100644
>--- a/Source/JavaScriptCore/wasm/WasmValidate.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmValidate.cpp
>@@ -103,6 +103,7 @@ public:
> 
>     // References
>     Result WARN_UNUSED_RETURN addRefIsNull(ExpressionType& value, ExpressionType& result);
>+    Result WARN_UNUSED_RETURN addRefFunc(uint32_t index, ExpressionType& result);
> 
>     // Tables
>     Result WARN_UNUSED_RETURN addTableGet(ExpressionType& idx, ExpressionType& result);
>@@ -179,18 +180,19 @@ auto Validate::addArguments(const Signature& signature) -> Result
> 
> auto Validate::addTableGet(ExpressionType& idx, ExpressionType& result) -> Result
> {
>-    result = Type::Anyref;
>+    result = m_module.tableInformation.wasmType();
>     WASM_VALIDATOR_FAIL_IF(Type::I32 != idx, "table.get index to type ", idx, " expected ", Type::I32);
>-    WASM_VALIDATOR_FAIL_IF(TableElementType::Anyref != m_module.tableInformation.type(), "table.get expects the table to have type ", Type::Anyref);
> 
>     return { };
> }
> 
> auto Validate::addTableSet(ExpressionType& idx, ExpressionType& value) -> Result
> {
>+    auto type = m_module.tableInformation.wasmType();
>     WASM_VALIDATOR_FAIL_IF(Type::I32 != idx, "table.set index to type ", idx, " expected ", Type::I32);
>-    WASM_VALIDATOR_FAIL_IF(Type::Anyref != value, "table.set value to type ", value, " expected ", Type::Anyref);
>-    WASM_VALIDATOR_FAIL_IF(TableElementType::Anyref != m_module.tableInformation.type(), "table.set expects the table to have type ", Type::Anyref);
>+    WASM_VALIDATOR_FAIL_IF(!isSubtype(value, type), "table.set value to type ", value, " expected ", type);
>+    WASM_VALIDATOR_FAIL_IF(m_module.tableInformation.type() != TableElementType::Anyref
>+        && m_module.tableInformation.type() != TableElementType::Funcref, "table.set expects the table to have type anyref or anyfunc");
> 
>     return { };
> }
>@@ -198,7 +200,16 @@ auto Validate::addTableSet(ExpressionType& idx, ExpressionType& value) -> Result
> auto Validate::addRefIsNull(ExpressionType& value, ExpressionType& result) -> Result
> {
>     result = Type::I32;
>-    WASM_VALIDATOR_FAIL_IF(Type::Anyref != value, "ref.is_null to type ", value, " expected ", Type::Anyref);
>+    WASM_VALIDATOR_FAIL_IF(!isSubtype(value, Type::Anyref), "ref.is_null to type ", value, " expected ", Type::Anyref);
>+
>+    return { };
>+}
>+
>+auto Validate::addRefFunc(uint32_t index, ExpressionType& result) -> Result
>+{
>+    result = Type::Anyfunc;
>+    WASM_VALIDATOR_FAIL_IF(index >= m_module.functionIndexSpaceSize(), "ref.func index ", index, " is too large, max is ", m_module.functionIndexSpaceSize());
>+    m_module.addReferencedFunction(index);
> 
>     return { };
> }
>@@ -224,7 +235,7 @@ auto Validate::setLocal(uint32_t index, ExpressionType value) -> Result
> {
>     ExpressionType localType;
>     WASM_FAIL_IF_HELPER_FAILS(getLocal(index, localType));
>-    WASM_VALIDATOR_FAIL_IF(localType != value, "set_local to type ", value, " expected ", localType);
>+    WASM_VALIDATOR_FAIL_IF(!isSubtype(value, localType), "set_local to type ", value, " expected ", localType);
>     return { };
> }
> 
>@@ -362,7 +373,7 @@ auto Validate::addCall(unsigned, const Signature& signature, const Vector<Expres
>     WASM_VALIDATOR_FAIL_IF(signature.argumentCount() != args.size(), "arity mismatch in call, got ", args.size(), " arguments, expected ", signature.argumentCount());
> 
>     for (unsigned i = 0; i < args.size(); ++i)
>-        WASM_VALIDATOR_FAIL_IF(args[i] != signature.argument(i), "argument type mismatch in call, got ", args[i], ", expected ", signature.argument(i));
>+        WASM_VALIDATOR_FAIL_IF(!isSubtype(args[i], signature.argument(i)), "argument type mismatch in call, got ", args[i], ", expected ", signature.argument(i));
> 
>     result = signature.returnType();
>     return { };
>@@ -375,7 +386,7 @@ auto Validate::addCallIndirect(const Signature& signature, const Vector<Expressi
>     WASM_VALIDATOR_FAIL_IF(argumentCount != args.size() - 1, "arity mismatch in call_indirect, got ", args.size() - 1, " arguments, expected ", argumentCount);
> 
>     for (unsigned i = 0; i < argumentCount; ++i)
>-        WASM_VALIDATOR_FAIL_IF(args[i] != signature.argument(i), "argument type mismatch in call_indirect, got ", args[i], ", expected ", signature.argument(i));
>+        WASM_VALIDATOR_FAIL_IF(!isSubtype(args[i], signature.argument(i)), "argument type mismatch in call_indirect, got ", args[i], ", expected ", signature.argument(i));
> 
>     WASM_VALIDATOR_FAIL_IF(args.last() != I32, "non-i32 call_indirect index ", args.last());
> 
>diff --git a/Source/JavaScriptCore/wasm/js/JSToWasm.cpp b/Source/JavaScriptCore/wasm/js/JSToWasm.cpp
>index 657da57aeb7ce3daeaf3c25747818b620dce1492..1c2f5fb58b6c9996106415101ab54254187db72c 100644
>--- a/Source/JavaScriptCore/wasm/js/JSToWasm.cpp
>+++ b/Source/JavaScriptCore/wasm/js/JSToWasm.cpp
>@@ -31,6 +31,7 @@
> #include "CCallHelpers.h"
> #include "DisallowMacroScratchRegisterUsage.h"
> #include "JSCInlines.h"
>+#include "JSWebAssemblyHelpers.h"
> #include "JSWebAssemblyInstance.h"
> #include "JSWebAssemblyRuntimeError.h"
> #include "MaxFrameExtentForSlowPathCall.h"
>@@ -83,6 +84,7 @@ std::unique_ptr<InternalFunction> createJSToWasmWrapper(CompilationContext& comp
>             FALLTHROUGH;
>         case Wasm::I32:
>         case Wasm::Anyref:
>+        case Wasm::Anyfunc:
>             if (numGPRs >= wasmCallingConvention().m_gprArgs.size())
>                 totalFrameSize += sizeof(void*);
>             ++numGPRs;
>@@ -122,20 +124,7 @@ std::unique_ptr<InternalFunction> createJSToWasmWrapper(CompilationContext& comp
>             jit.loadPtr(CCallHelpers::Address(GPRInfo::argumentGPR2, JSWebAssemblyInstance::offsetOfInstance()), GPRInfo::argumentGPR2);
>         }
> 
>-        jit.loadPtr(CCallHelpers::Address(GPRInfo::argumentGPR2, Instance::offsetOfPointerToTopEntryFrame()), GPRInfo::argumentGPR0);
>-        jit.loadPtr(CCallHelpers::Address(GPRInfo::argumentGPR0), GPRInfo::argumentGPR0);
>-        jit.copyCalleeSavesToEntryFrameCalleeSavesBuffer(GPRInfo::argumentGPR0);
>-        jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
>-        jit.move(CCallHelpers::TrustedImm32(static_cast<int32_t>(argumentsIncludeI64 ? ExceptionType::I64ArgumentType : ExceptionType::I64ReturnType)), GPRInfo::argumentGPR1);
>-
>-        CCallHelpers::Call call = jit.call(OperationPtrTag);
>-
>-        jit.jump(GPRInfo::returnValueGPR, ExceptionHandlerPtrTag);
>-        jit.breakpoint(); // We should not reach this.
>-
>-        jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
>-            linkBuffer.link(call, FunctionPtr<OperationPtrTag>(wasmToJSException));
>-        });
>+        emitWasmToJSException(jit, GPRInfo::argumentGPR2, argumentsIncludeI64 ? ExceptionType::I64ArgumentType : ExceptionType::I64ReturnType);
>         return result;
>     }
> 
>@@ -165,6 +154,7 @@ std::unique_ptr<InternalFunction> createJSToWasmWrapper(CompilationContext& comp
>             switch (signature.argument(i)) {
>             case Wasm::I32:
>             case Wasm::I64:
>+            case Wasm::Anyfunc:
>             case Wasm::Anyref:
>                 if (numGPRs >= wasmCallingConvention().m_gprArgs.size()) {
>                     if (signature.argument(i) == Wasm::I32) {
>@@ -250,7 +240,7 @@ std::unique_ptr<InternalFunction> createJSToWasmWrapper(CompilationContext& comp
>         jit.moveTrustedValue(jsUndefined(), JSValueRegs { GPRInfo::returnValueGPR });
>         break;
>     case Wasm::Anyref:
>-        // FIXME: We need to box wasm Funcrefs once they are supported here.
>+    case Wasm::Anyfunc:
>         break;
>     case Wasm::I32:
>         jit.zeroExtend32ToPtr(GPRInfo::returnValueGPR, GPRInfo::returnValueGPR);
>@@ -268,7 +258,6 @@ std::unique_ptr<InternalFunction> createJSToWasmWrapper(CompilationContext& comp
>     }
>     case Wasm::I64:
>     case Wasm::Func:
>-    case Wasm::Anyfunc:
>         jit.breakpoint();
>         break;
>     default:
>diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyHelpers.h b/Source/JavaScriptCore/wasm/js/JSWebAssemblyHelpers.h
>index ea292a22f64e385ced233b8f4cbac5c8c08c6e1f..13d0a0947ee1df0eea1360f460d2bd4c655470ef 100644
>--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyHelpers.h
>+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyHelpers.h
>@@ -122,7 +122,7 @@ ALWAYS_INLINE bool isWebAssemblyHostFunction(VM& vm, JSValue value, WebAssemblyF
> }
> 
> 
>-ALWAYS_INLINE bool isWebAssemblyHostFunction(VM& vm, JSObject* object)
>+ALWAYS_INLINE bool isWebAssemblyHostFunction(VM& vm, JSValue object)
> {
>     WebAssemblyFunction* unused;
>     WebAssemblyWrapperFunction* unused2;
>diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp b/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp
>index 666bf47f1fe23302fc30fd4e1dc73945ea4b3d3f..20b60fc7115abd2a7626747dee5c1a9749067035 100644
>--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp
>+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp
>@@ -91,11 +91,11 @@ void JSWebAssemblyInstance::visitChildren(JSCell* cell, SlotVisitor& visitor)
>     for (unsigned i = 0; i < thisObject->instance().numImportFunctions(); ++i)
>         visitor.append(*thisObject->instance().importFunction<WriteBarrier<JSObject>>(i)); // This also keeps the functions' JSWebAssemblyInstance alive.
> 
>-    for (size_t i : thisObject->instance().globalsToMark()) {
>-        // FIXME: We need to box wasm Funcrefs once they are supported here.
>-        // <https://bugs.webkit.org/show_bug.cgi?id=198157>
>+    for (size_t i : thisObject->instance().globalsToMark())
>         visitor.appendUnbarriered(JSValue::decode(thisObject->instance().loadI64Global(i)));
>-    }
>+
>+    for (unsigned i = 0; i < thisObject->instance().module().moduleInformation().functionIndexSpaceSize(); ++i)
>+        visitor.appendUnbarriered(thisObject->instance().getFunctionWrapper(i));
> }
> 
> void JSWebAssemblyInstance::finalizeCreation(VM& vm, ExecState* exec, Ref<Wasm::CodeBlock>&& wasmCodeBlock, JSObject* importObject, Wasm::CreationMode creationMode)
>diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.cpp b/Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.cpp
>index 963c282e8b88df23ba3997b1d7d1508cd2cf88c1..8ab2f903acac15b13a1de39247c055052edcf379 100644
>--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.cpp
>+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.cpp
>@@ -48,6 +48,12 @@ JSWebAssemblyRuntimeError::JSWebAssemblyRuntimeError(VM& vm, Structure* structur
> 
> const ClassInfo JSWebAssemblyRuntimeError::s_info = { "WebAssembly.RuntimeError", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSWebAssemblyRuntimeError) };
> 
>+JSObject* createJSWebAssemblyRuntimeError(ExecState* exec, VM& vm, const String& message)
>+{
>+    ASSERT(!message.isEmpty());
>+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
>+    return JSWebAssemblyRuntimeError::create(exec, vm, globalObject->webAssemblyRuntimeErrorStructure(), message);
>+}
>     
> } // namespace JSC
> 
>diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h b/Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h
>index 68d3ad1465b1af8e6e116936fa1bc92f6ea651d5..861f472f3db77097ea3bcc24c92463a9c11b8e2f 100644
>--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h
>+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h
>@@ -43,6 +43,8 @@ protected:
>     JSWebAssemblyRuntimeError(VM&, Structure*);
> };
> 
>+JSObject* createJSWebAssemblyRuntimeError(ExecState*, VM&, const String&);
>+
> } // namespace JSC
> 
> #endif // ENABLE(WEBASSEMBLY)
>diff --git a/Source/JavaScriptCore/wasm/js/WasmToJS.cpp b/Source/JavaScriptCore/wasm/js/WasmToJS.cpp
>index 5bff9cc6d0441f0efcf21b9dcf988107fb5688bb..5c7b006516f62e1498297ac942432f4b092185da 100644
>--- a/Source/JavaScriptCore/wasm/js/WasmToJS.cpp
>+++ b/Source/JavaScriptCore/wasm/js/WasmToJS.cpp
>@@ -32,6 +32,7 @@
> #include "FrameTracers.h"
> #include "JITExceptions.h"
> #include "JSCInlines.h"
>+#include "JSWebAssemblyHelpers.h"
> #include "JSWebAssemblyInstance.h"
> #include "JSWebAssemblyRuntimeError.h"
> #include "LinkBuffer.h"
>@@ -65,7 +66,6 @@ static Expected<MacroAssemblerCodeRef<WasmEntryPtrTag>, BindingFailure> handleBa
>         switch (argType) {
>         case Void:
>         case Func:
>-        case Anyfunc:
>             RELEASE_ASSERT_NOT_REACHED();
> 
>         case I64: {
>@@ -162,10 +162,10 @@ Expected<MacroAssemblerCodeRef<WasmEntryPtrTag>, BindingFailure> wasmToJS(VM* vm
>             switch (argType) {
>             case Void:
>             case Func:
>-            case Anyfunc:
>             case I64:
>                 RELEASE_ASSERT_NOT_REACHED();
>             case Anyref:
>+            case Anyfunc:
>             case I32: {
>                 GPRReg gprReg;
>                 if (marshalledGPRs < wasmCC.m_gprArgs.size())
>@@ -237,14 +237,17 @@ Expected<MacroAssemblerCodeRef<WasmEntryPtrTag>, BindingFailure> wasmToJS(VM* vm
>                     switch (argType) {
>                     case Void:
>                     case Func:
>-                    case Anyfunc:
>                     case I64:
>                         RELEASE_ASSERT_NOT_REACHED();
>                     case I32:
>                         arg = jsNumber(static_cast<int32_t>(buffer[argNum]));
>                         break;
>+                    case Anyfunc: {
>+                        arg = JSValue::decode(buffer[argNum]);
>+                        ASSERT(isWebAssemblyHostFunction(*vm, arg) || arg.isNull());
>+                        break;
>+                    }
>                     case Anyref:
>-                        // FIXME: We need to box wasm Funcrefs once they are supported here.
>                         arg = JSValue::decode(buffer[argNum]);
>                         break;
>                     case F32:
>@@ -268,7 +271,6 @@ Expected<MacroAssemblerCodeRef<WasmEntryPtrTag>, BindingFailure> wasmToJS(VM* vm
>                 uint64_t realResult;
>                 switch (signature.returnType()) {
>                 case Func:
>-                case Anyfunc:
>                 case I64:
>                     RELEASE_ASSERT_NOT_REACHED();
>                     break;
>@@ -278,6 +280,11 @@ Expected<MacroAssemblerCodeRef<WasmEntryPtrTag>, BindingFailure> wasmToJS(VM* vm
>                     realResult = static_cast<uint64_t>(static_cast<uint32_t>(result.toInt32(exec)));
>                     break;
>                 }
>+                case Anyfunc: {
>+                    realResult = JSValue::encode(result);
>+                    ASSERT(result.isFunction(*vm) || result.isNull());
>+                    break;
>+                }
>                 case Anyref: {
>                     realResult = JSValue::encode(result);
>                     break;
>@@ -371,10 +378,10 @@ Expected<MacroAssemblerCodeRef<WasmEntryPtrTag>, BindingFailure> wasmToJS(VM* vm
>             switch (argType) {
>             case Void:
>             case Func:
>-            case Anyfunc:
>             case I64:
>                 RELEASE_ASSERT_NOT_REACHED(); // Handled above.
>             case Anyref:
>+            case Anyfunc:
>             case I32: {
>                 GPRReg gprReg;
>                 if (marshalledGPRs < wasmCC.m_gprArgs.size())
>@@ -390,7 +397,6 @@ Expected<MacroAssemblerCodeRef<WasmEntryPtrTag>, BindingFailure> wasmToJS(VM* vm
>                     jit.zeroExtend32ToPtr(gprReg, gprReg); // Clear non-int32 and non-tag bits.
>                     jit.boxInt32(gprReg, JSValueRegs(gprReg), DoNotHaveTagRegisters);
>                 }
>-                // FIXME: We need to box wasm Funcrefs once they are supported here.
>                 jit.store64(gprReg, calleeFrame.withOffset(calleeFrameOffset));
>                 calleeFrameOffset += sizeof(Register);
>                 break;
>@@ -441,10 +447,10 @@ Expected<MacroAssemblerCodeRef<WasmEntryPtrTag>, BindingFailure> wasmToJS(VM* vm
>             switch (argType) {
>             case Void:
>             case Func:
>-            case Anyfunc:
>             case I64:
>                 RELEASE_ASSERT_NOT_REACHED(); // Handled above.
>             case Anyref:
>+            case Anyfunc:
>             case I32:
>                 // Skipped: handled above.
>                 if (marshalledGPRs >= wasmCC.m_gprArgs.size())
>@@ -519,7 +525,6 @@ Expected<MacroAssemblerCodeRef<WasmEntryPtrTag>, BindingFailure> wasmToJS(VM* vm
>         // Discard.
>         break;
>     case Func:
>-    case Anyfunc:
>         // For the JavaScript embedding, imports with these types in their signature return are a WebAssembly.Module validation error.
>         RELEASE_ASSERT_NOT_REACHED();
>         break;
>@@ -553,6 +558,7 @@ Expected<MacroAssemblerCodeRef<WasmEntryPtrTag>, BindingFailure> wasmToJS(VM* vm
>         done.link(&jit);
>         break;
>     }
>+    case Anyfunc:
>     case Anyref:
>         break;
>     case F32: {
>@@ -695,6 +701,25 @@ void* wasmToJSException(ExecState* exec, Wasm::ExceptionType type, Instance* was
>     return vm.targetMachinePCForThrow;
> }
> 
>+void emitWasmToJSException(CCallHelpers& jit, GPRReg wasmInstance, Wasm::ExceptionType type)
>+{
>+    ASSERT(wasmInstance != GPRInfo::argumentGPR0);
>+    jit.loadPtr(CCallHelpers::Address(wasmInstance, Wasm::Instance::offsetOfPointerToTopEntryFrame()), GPRInfo::argumentGPR0);
>+    jit.loadPtr(CCallHelpers::Address(GPRInfo::argumentGPR0), GPRInfo::argumentGPR0);
>+    jit.copyCalleeSavesToEntryFrameCalleeSavesBuffer(GPRInfo::argumentGPR0);
>+    jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
>+    jit.move(CCallHelpers::TrustedImm32(static_cast<int32_t>(type)), GPRInfo::argumentGPR1);
>+
>+    CCallHelpers::Call call = jit.call(OperationPtrTag);
>+
>+    jit.jump(GPRInfo::returnValueGPR, ExceptionHandlerPtrTag);
>+    jit.breakpoint(); // We should not reach this.
>+
>+    jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
>+        linkBuffer.link(call, FunctionPtr<OperationPtrTag>(Wasm::wasmToJSException));
>+    });
>+}
>+
> } } // namespace JSC::Wasm
> 
> #endif // ENABLE(WEBASSEMBLY)
>diff --git a/Source/JavaScriptCore/wasm/js/WasmToJS.h b/Source/JavaScriptCore/wasm/js/WasmToJS.h
>index e0c74c33836f052f60fe874e93a0c71d683f861e..de3e7cbf4d4186fe0f9d77a3e13785e8cabc5a65 100644
>--- a/Source/JavaScriptCore/wasm/js/WasmToJS.h
>+++ b/Source/JavaScriptCore/wasm/js/WasmToJS.h
>@@ -45,6 +45,7 @@ class Instance;
> Expected<MacroAssemblerCodeRef<WasmEntryPtrTag>, BindingFailure> wasmToJS(VM*, Bag<CallLinkInfo>& callLinkInfos, SignatureIndex, unsigned importIndex);
> 
> void* wasmToJSException(ExecState*, Wasm::ExceptionType, Instance*);
>+void emitWasmToJSException(CCallHelpers&, GPRReg wasmInstance, Wasm::ExceptionType);
> 
> } } // namespace JSC::Wasm
> 
>diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp b/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp
>index 2ff0e78e582f6561a28f3c59537821c03980b890..9e2df6ac222139b379b0ca3ec4ca27c6a903e33e 100644
>--- a/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp
>+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp
>@@ -84,6 +84,11 @@ static EncodedJSValue JSC_HOST_CALL callWebAssemblyFunction(ExecState* exec)
>         case Wasm::I32:
>             arg = JSValue::decode(arg.toInt32(exec));
>             break;
>+        case Wasm::Anyfunc: {
>+            if (!isWebAssemblyHostFunction(vm, arg) && !arg.isNull())
>+                return JSValue::encode(throwException(exec, scope, createJSWebAssemblyRuntimeError(exec, vm, "Anyfunc must be an exported wasm function")));
>+            break;
>+        }
>         case Wasm::Anyref:
>             break;
>         case Wasm::I64:
>@@ -97,7 +102,6 @@ static EncodedJSValue JSC_HOST_CALL callWebAssemblyFunction(ExecState* exec)
>             break;
>         case Wasm::Void:
>         case Wasm::Func:
>-        case Wasm::Anyfunc:
>             RELEASE_ASSERT_NOT_REACHED();
>         }
>         RETURN_IF_EXCEPTION(scope, encodedJSValue());
>@@ -228,6 +232,7 @@ MacroAssemblerCodePtr<JSEntryPtrTag> WebAssemblyFunction::jsCallEntrypointSlow()
>             argumentsIncludeI64 = true;
>             break;
>         case Wasm::Anyref:
>+        case Wasm::Anyfunc:
>         case Wasm::I32:
>             if (numGPRs >= Wasm::wasmCallingConvention().m_gprArgs.size())
>                 totalFrameSize += sizeof(CPURegister);
>@@ -303,6 +308,27 @@ MacroAssemblerCodePtr<JSEntryPtrTag> WebAssemblyFunction::jsCallEntrypointSlow()
>                     ++numGPRs;
>                 }
>                 break;
>+            case Wasm::Anyfunc: {
>+                // FIXME: Emit this inline <https://bugs.webkit.org/show_bug.cgi?id=198506>.
>+                bool (*shouldThrow)(Wasm::Instance*, JSValue) = [] (Wasm::Instance* wasmInstance, JSValue arg) -> bool {
>+                    JSWebAssemblyInstance* instance = wasmInstance->owner<JSWebAssemblyInstance>();
>+                    JSGlobalObject* globalObject = instance->globalObject();
>+                    VM& vm = globalObject->vm();
>+                    return !isWebAssemblyHostFunction(vm, arg) && !arg.isNull();
>+                };
>+                jit.move(CCallHelpers::TrustedImmPtr(&instance()->instance()), GPRInfo::argumentGPR0);
>+                jit.load64(CCallHelpers::Address(GPRInfo::callFrameRegister, jsOffset), GPRInfo::argumentGPR1);
>+                jit.setupArguments<decltype(shouldThrow)>(GPRInfo::argumentGPR0, GPRInfo::argumentGPR1);
>+                auto call = jit.call(OperationPtrTag);
>+
>+                jit.addLinkTask([=] (LinkBuffer& linkBuffer) {
>+                    linkBuffer.link(call, FunctionPtr<OperationPtrTag>(shouldThrow));
>+                });
>+
>+                slowPath.append(jit.branchTest32(CCallHelpers::NonZero, GPRInfo::returnValueGPR));
>+
>+                FALLTHROUGH;
>+            }
>             case Wasm::Anyref: {
>                 jit.load64(CCallHelpers::Address(GPRInfo::callFrameRegister, jsOffset), scratchGPR);
> 
>@@ -466,13 +492,11 @@ MacroAssemblerCodePtr<JSEntryPtrTag> WebAssemblyFunction::jsCallEntrypointSlow()
>         isNaN.link(&jit);
>         break;
>     }
>-    case Wasm::Anyref: {
>-        // FIXME: We need to box wasm Funcrefs once they are supported here.
>+    case Wasm::Anyfunc:
>+    case Wasm::Anyref:
>         break;
>-    }
>     case Wasm::I64:
>     case Wasm::Func:
>-    case Wasm::Anyfunc:
>         return nullptr;
>     default:
>         break;
>diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp b/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp
>index 4f801e576927ff66ee50c650890efe021707b8f2..12b1cef2df46879a2c7f1b371f4c59399bec6613 100644
>--- a/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp
>+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp
>@@ -235,10 +235,15 @@ void WebAssemblyModuleRecord::link(ExecState* exec, JSValue, JSObject* importObj
>             // ii. If the global_type of i is i64 or Type(v) is not Number, throw a WebAssembly.LinkError.
>             if (moduleInformation.globals[import.kindIndex].type == Wasm::I64)
>                 return exception(createJSWebAssemblyLinkError(exec, vm, importFailMessage(import, "imported global", "cannot be an i64")));
>-            if (moduleInformation.globals[import.kindIndex].type != Wasm::Anyref && !value.isNumber())
>+            if (!isSubtype(moduleInformation.globals[import.kindIndex].type, Wasm::Anyref) && !value.isNumber())
>                 return exception(createJSWebAssemblyLinkError(exec, vm, importFailMessage(import, "imported global", "must be a number")));
>             // iii. Append ToWebAssemblyValue(v) to imports.
>             switch (moduleInformation.globals[import.kindIndex].type) {
>+            case Wasm::Anyfunc:
>+                if (!isWebAssemblyHostFunction(vm, value) && !value.isNull())
>+                    return exception(createJSWebAssemblyLinkError(exec, vm, importFailMessage(import, "imported global", "must be a wasm exported function or null")));
>+                m_instance->instance().setGlobal(import.kindIndex, value);
>+                break;
>             case Wasm::Anyref:
>                 m_instance->instance().setGlobal(import.kindIndex, value);
>                 break;
>@@ -319,6 +324,47 @@ void WebAssemblyModuleRecord::link(ExecState* exec, JSValue, JSObject* importObj
>         }
>     }
> 
>+    unsigned functionImportCount = codeBlock->functionImportCount();
>+    auto makeFunctionWrapper = [&] (const String& field, uint32_t index) -> JSValue {
>+        // If we already made a wrapper, do not make a new one.
>+        JSValue wrapper = m_instance->instance().getFunctionWrapper(index);
>+
>+        if (!wrapper.isNull())
>+            return wrapper;
>+
>+        // 1. If e is a closure c:
>+        //   i. If there is an Exported Function Exotic Object func in funcs whose func.[[Closure]] equals c, then return func.
>+        //   ii. (Note: At most one wrapper is created for any closure, so func is unique, even if there are multiple occurrances in the list. Moreover, if the item was an import that is already an Exported Function Exotic Object, then the original function object will be found. For imports that are regular JS functions, a new wrapper will be created.)
>+        if (index < functionImportCount) {
>+            JSObject* functionImport = m_instance->instance().importFunction<WriteBarrier<JSObject>>(index)->get();
>+            if (isWebAssemblyHostFunction(vm, functionImport))
>+                wrapper = functionImport;
>+            else {
>+                Wasm::SignatureIndex signatureIndex = module->signatureIndexFromFunctionIndexSpace(index);
>+                wrapper = WebAssemblyWrapperFunction::create(vm, globalObject, globalObject->webAssemblyWrapperFunctionStructure(), functionImport, index, m_instance.get(), signatureIndex);
>+            }
>+        } else {
>+            //   iii. Otherwise:
>+            //     a. Let func be an Exported Function Exotic Object created from c.
>+            //     b. Append func to funcs.
>+            //     c. Return func.
>+            Wasm::Callee& embedderEntrypointCallee = codeBlock->embedderEntrypointCalleeFromFunctionIndexSpace(index);
>+            Wasm::WasmToWasmImportableFunction::LoadLocation entrypointLoadLocation = codeBlock->entrypointLoadLocationFromFunctionIndexSpace(index);
>+            Wasm::SignatureIndex signatureIndex = module->signatureIndexFromFunctionIndexSpace(index);
>+            const Wasm::Signature& signature = Wasm::SignatureInformation::get(signatureIndex);
>+            WebAssemblyFunction* function = WebAssemblyFunction::create(vm, globalObject, globalObject->webAssemblyFunctionStructure(), signature.argumentCount(), field, m_instance.get(), embedderEntrypointCallee, entrypointLoadLocation, signatureIndex);
>+            wrapper = function;
>+        }
>+
>+        ASSERT(wrapper.isFunction(vm));
>+        m_instance->instance().setFunctionWrapper(index, wrapper);
>+
>+        return wrapper;
>+    };
>+
>+    for (auto index : moduleInformation.referencedFunctions())
>+        makeFunctionWrapper("Referenced function", index);
>+
>     // Globals
>     {
>         for (size_t globalIndex = moduleInformation.firstInternalGlobal; globalIndex < moduleInformation.globals.size(); ++globalIndex) {
>@@ -327,13 +373,16 @@ void WebAssemblyModuleRecord::link(ExecState* exec, JSValue, JSObject* importObj
>             if (global.initializationType == Wasm::Global::FromGlobalImport) {
>                 ASSERT(global.initialBitsOrImportNumber < moduleInformation.firstInternalGlobal);
>                 m_instance->instance().setGlobal(globalIndex, m_instance->instance().loadI64Global(global.initialBitsOrImportNumber));
>+            } else if (global.initializationType == Wasm::Global::FromRefFunc) {
>+                ASSERT(global.initialBitsOrImportNumber < moduleInformation.functionIndexSpaceSize());
>+                ASSERT(makeFunctionWrapper("Global init expr", global.initialBitsOrImportNumber).isFunction(vm));
>+                m_instance->instance().setGlobal(globalIndex, JSValue::encode(makeFunctionWrapper("Global init expr", global.initialBitsOrImportNumber)));
>             } else
>                 m_instance->instance().setGlobal(globalIndex, global.initialBitsOrImportNumber);
>         }
>     }
> 
>     SymbolTable* exportSymbolTable = module->exportSymbolTable();
>-    unsigned functionImportCount = codeBlock->functionImportCount();
> 
>     // Let exports be a list of (string, JS value) pairs that is mapped from each external value e in instance.exports as follows:
>     JSModuleEnvironment* moduleEnvironment = JSModuleEnvironment::create(vm, globalObject, nullptr, exportSymbolTable, JSValue(), this);
>@@ -341,30 +390,9 @@ void WebAssemblyModuleRecord::link(ExecState* exec, JSValue, JSObject* importObj
>         JSValue exportedValue;
>         switch (exp.kind) {
>         case Wasm::ExternalKind::Function: {
>-            // 1. If e is a closure c:
>-            //   i. If there is an Exported Function Exotic Object func in funcs whose func.[[Closure]] equals c, then return func.
>-            //   ii. (Note: At most one wrapper is created for any closure, so func is unique, even if there are multiple occurrances in the list. Moreover, if the item was an import that is already an Exported Function Exotic Object, then the original function object will be found. For imports that are regular JS functions, a new wrapper will be created.)
>-            if (exp.kindIndex < functionImportCount) {
>-                unsigned functionIndex = exp.kindIndex;
>-                JSObject* functionImport = m_instance->instance().importFunction<WriteBarrier<JSObject>>(functionIndex)->get();
>-                if (isWebAssemblyHostFunction(vm, functionImport))
>-                    exportedValue = functionImport;
>-                else {
>-                    Wasm::SignatureIndex signatureIndex = module->signatureIndexFromFunctionIndexSpace(functionIndex);
>-                    exportedValue = WebAssemblyWrapperFunction::create(vm, globalObject, globalObject->webAssemblyWrapperFunctionStructure(), functionImport, functionIndex, m_instance.get(), signatureIndex);
>-                }
>-            } else {
>-                //   iii. Otherwise:
>-                //     a. Let func be an Exported Function Exotic Object created from c.
>-                //     b. Append func to funcs.
>-                //     c. Return func.
>-                Wasm::Callee& embedderEntrypointCallee = codeBlock->embedderEntrypointCalleeFromFunctionIndexSpace(exp.kindIndex);
>-                Wasm::WasmToWasmImportableFunction::LoadLocation entrypointLoadLocation = codeBlock->entrypointLoadLocationFromFunctionIndexSpace(exp.kindIndex);
>-                Wasm::SignatureIndex signatureIndex = module->signatureIndexFromFunctionIndexSpace(exp.kindIndex);
>-                const Wasm::Signature& signature = Wasm::SignatureInformation::get(signatureIndex);
>-                WebAssemblyFunction* function = WebAssemblyFunction::create(vm, globalObject, globalObject->webAssemblyFunctionStructure(), signature.argumentCount(), String::fromUTF8(exp.field), m_instance.get(), embedderEntrypointCallee, entrypointLoadLocation, signatureIndex);
>-                exportedValue = function;
>-            }
>+            exportedValue = makeFunctionWrapper(String::fromUTF8(exp.field), exp.kindIndex);
>+            ASSERT(exportedValue.isFunction(vm));
>+            ASSERT(makeFunctionWrapper(String::fromUTF8(exp.field), exp.kindIndex) == exportedValue);
>             break;
>         }
>         case Wasm::ExternalKind::Table: {
>@@ -388,8 +416,7 @@ void WebAssemblyModuleRecord::link(ExecState* exec, JSValue, JSObject* importObj
>             // Return ToJSValue(v).
>             switch (global.type) {
>             case Wasm::Anyref:
>-                // FIXME: We need to box wasm Funcrefs once they are supported here.
>-                // <https://bugs.webkit.org/show_bug.cgi?id=198157>
>+            case Wasm::Anyfunc:
>                 exportedValue = JSValue::decode(m_instance->instance().loadI64Global(exp.kindIndex));
>                 break;
> 
>diff --git a/Source/JavaScriptCore/wasm/wasm.json b/Source/JavaScriptCore/wasm/wasm.json
>index 30bbc74723783922edbbf634993490f48b7b7e02..75285d6fb700901ca5275ea3fd75bb18d30e413b 100644
>--- a/Source/JavaScriptCore/wasm/wasm.json
>+++ b/Source/JavaScriptCore/wasm/wasm.json
>@@ -11,13 +11,13 @@
>         "i64":     { "type": "varint7", "value":  -2, "b3type": "B3::Int64" },
>         "f32":     { "type": "varint7", "value":  -3, "b3type": "B3::Float" },
>         "f64":     { "type": "varint7", "value":  -4, "b3type": "B3::Double" },
>-        "anyfunc": { "type": "varint7", "value": -16, "b3type": "B3::Void" },
>+        "anyfunc": { "type": "varint7", "value": -16, "b3type": "B3::Int64" },
>         "anyref":  { "type": "varint7", "value": -17, "b3type": "B3::Int64" },
>         "func":    { "type": "varint7", "value": -32, "b3type": "B3::Void" },
>         "void":    { "type": "varint7", "value": -64, "b3type": "B3::Void" }
>     },
>-    "value_type": ["i32", "i64", "f32", "f64", "anyref"],
>-    "block_type": ["i32", "i64", "f32", "f64", "void", "anyref"],
>+    "value_type": ["i32", "i64", "f32", "f64", "anyref", "anyfunc"],
>+    "block_type": ["i32", "i64", "f32", "f64", "void", "anyref", "anyfunc"],
>     "elem_type": ["anyfunc","anyref"],
>     "external_kind": {
>         "Function": { "type": "uint8", "value": 0 },
>@@ -59,8 +59,9 @@
>         "i64.const":           { "category": "special",    "value":  66, "return": ["i64"],      "parameter": [],                       "immediate": [{"name": "value",          "type": "varint64"}],                                             "description": "a constant value interpreted as i64" },
>         "f64.const":           { "category": "special",    "value":  68, "return": ["f64"],      "parameter": [],                       "immediate": [{"name": "value",          "type": "double"}],                                               "description": "a constant value interpreted as f64" },
>         "f32.const":           { "category": "special",    "value":  67, "return": ["f32"],      "parameter": [],                       "immediate": [{"name": "value",          "type": "float"}],                                                "description": "a constant value interpreted as f32" },
>-        "ref.null":            { "category": "special",    "value": 208, "return": ["anyref"],   "parameter": [],                       "immediate": [],                                                                                           "description": "a constant null reference" },
>+        "ref.null":            { "category": "special",    "value": 208, "return": ["anyfunc"],  "parameter": [],                       "immediate": [],                                                                                           "description": "a constant null reference" },
>         "ref.is_null":         { "category": "special",    "value": 209, "return": ["i32"],      "parameter": ["anyref"],               "immediate": [],                                                                                           "description": "determine if a reference is null" },
>+        "ref.func":            { "category": "special",    "value": 210, "return": ["anyfunc"],  "parameter": [],                       "immediate": [{"name": "function_index", "type": "varuint32"}],                                            "description": "return a reference to the function at the given index" },
>         "get_local":           { "category": "special",    "value":  32, "return": ["any"],      "parameter": [],                       "immediate": [{"name": "local_index",    "type": "varuint32"}],                                            "description": "read a local variable or parameter" },
>         "set_local":           { "category": "special",    "value":  33, "return": [],           "parameter": ["any"],                  "immediate": [{"name": "local_index",    "type": "varuint32"}],                                            "description": "write a local variable or parameter" },
>         "tee_local":           { "category": "special",    "value":  34, "return": ["any"],      "parameter": ["any"],                  "immediate": [{"name": "local_index",    "type": "varuint32"}],                                            "description": "write a local variable or parameter and return the same value" },
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index c64efc71170c2abb45edc2b59ac5ac0c4e016ecb..dc35f5544defa91d6ab331b3470a40169302d050 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,33 @@
>+2019-06-10  Justin Michaud  <justin_michaud@apple.com>
>+
>+        [WASM-References] Add support for Funcref in parameters and return types
>+        https://bugs.webkit.org/show_bug.cgi?id=198157
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * wasm/Builder.js:
>+        (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
>+        * wasm/references/anyref_globals.js:
>+        * wasm/references/func_ref.js: Added.
>+        (fullGC.gc.makeExportedFunction):
>+        (makeExportedIdent):
>+        (makeAnyfuncIdent):
>+        (fun):
>+        (assert.eq.instance.exports.fix.fun):
>+        (assert.eq.instance.exports.fix):
>+        (string_appeared_here.End.End.Function.End.Code.End.WebAssembly.imp.ref):
>+        (string_appeared_here.End.End.Function.End.Code.End.WebAssembly):
>+        (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.fun):
>+        (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.assert.throws):
>+        (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly):
>+        (assert.throws):
>+        (assert.throws.doTest):
>+        (let.importedFun.of):
>+        (makeAnyfuncIdent.fun):
>+        * wasm/references/validation.js:
>+        (assert.throws):
>+        * wasm/wasm.json:
>+
> 2019-06-13  Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         Yarr bytecode compilation failure should be gracefully handled
>diff --git a/JSTests/wasm/Builder.js b/JSTests/wasm/Builder.js
>index 7e7c1b7dc223c883e10e6f373bcdd3c6c29d511b..65f1f477a98b8620fccd2aa8f8c1109e0af67866 100644
>--- a/JSTests/wasm/Builder.js
>+++ b/JSTests/wasm/Builder.js
>@@ -536,6 +536,10 @@ export default class Builder {
>                             s.data.push({ type, op: "get_global", mutability: _normalizeMutability(mutability), initValue });
>                             return _errorHandlingProxyFor(globalBuilder);
>                         },
>+                        RefFunc: (type, initValue, mutability) => {
>+                            s.data.push({ type, op: "ref.func", mutability: _normalizeMutability(mutability), initValue });
>+                            return _errorHandlingProxyFor(globalBuilder);
>+                        },
>                         RefNull: (type, mutability) => {
>                             s.data.push({ type, op: "ref.null", mutability: _normalizeMutability(mutability) });
>                             return _errorHandlingProxyFor(globalBuilder);
>diff --git a/JSTests/wasm/references/anyref_globals.js b/JSTests/wasm/references/anyref_globals.js
>index 184457a33fecb0b08ade13decfcf19e7d33089ae..2d3ca7bc605f7974cfef25814e89ae584b053130 100644
>--- a/JSTests/wasm/references/anyref_globals.js
>+++ b/JSTests/wasm/references/anyref_globals.js
>@@ -56,7 +56,9 @@ assert.eq($1.exports.get_glob(), null)
> 
> const obj = { test: "hi" }
> 
>-$1.exports.set_glob(obj); assert.eq($1.exports.get_glob(), obj);
>+assert.throws(() => $1.exports.expglob2 = null, TypeError, "Attempted to assign to readonly property.")
>+
>+$1.exports.set_glob(obj); assert.eq($1.exports.get_glob(), obj); assert.eq($1.exports.expglob2, "hi")
> $1.exports.set_glob(5); assert.eq($1.exports.get_glob(), 5)
> $1.exports.set_glob(null); assert.eq($1.exports.get_glob(), null)
> $1.exports.set_glob("hi"); assert.eq($1.exports.get_glob(), "hi")
>diff --git a/JSTests/wasm/references/func_ref.js b/JSTests/wasm/references/func_ref.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..35e06e4658387283c58335b9b66f77853f9bb102
>--- /dev/null
>+++ b/JSTests/wasm/references/func_ref.js
>@@ -0,0 +1,447 @@
>+import * as assert from '../assert.js';
>+import Builder from '../Builder.js';
>+
>+fullGC()
>+gc()
>+
>+function makeExportedFunction(i) {
>+    const builder = (new Builder())
>+          .Type().End()
>+          .Function().End()
>+          .Export()
>+              .Function("h")
>+          .End()
>+          .Code()
>+            .Function("h", { params: [], ret: "i32" }, [])
>+              .I32Const(i)
>+            .End()
>+          .End();
>+
>+    const bin = builder.WebAssembly().get();
>+    const module = new WebAssembly.Module(bin);
>+    const instance = new WebAssembly.Instance(module);
>+
>+    return instance.exports.h
>+}
>+
>+function makeExportedIdent() {
>+    const builder = (new Builder())
>+          .Type().End()
>+          .Function().End()
>+          .Export()
>+              .Function("h")
>+          .End()
>+          .Code()
>+            .Function("h", { params: ["i32"], ret: "i32" }, [])
>+              .GetLocal(0)
>+            .End()
>+          .End();
>+
>+    const bin = builder.WebAssembly().get();
>+    const module = new WebAssembly.Module(bin);
>+    const instance = new WebAssembly.Instance(module);
>+
>+    return instance.exports.h
>+}
>+
>+function makeAnyfuncIdent() {
>+    const builder = (new Builder())
>+          .Type().End()
>+          .Function().End()
>+          .Export()
>+              .Function("h")
>+          .End()
>+          .Code()
>+            .Function("h", { params: ["anyfunc"], ret: "anyfunc" }, [])
>+              .GetLocal(0)
>+            .End()
>+          .End();
>+
>+    const bin = builder.WebAssembly().get();
>+    const module = new WebAssembly.Module(bin);
>+    const instance = new WebAssembly.Instance(module);
>+
>+    return instance.exports.h
>+}
>+
>+{
>+    const myfun = makeExportedFunction(1337);
>+    function fun() {
>+        return 41;
>+    }
>+
>+    const builder = (new Builder())
>+          .Type().End()
>+          .Function().End()
>+          .Export()
>+              .Function("h")
>+              .Function("i")
>+              .Function("get_h")
>+              .Function("fix")
>+              .Function("get_not_exported")
>+              .Function("local_read")
>+          .End()
>+          .Code()
>+            .Function("h", { params: ["anyfunc"], ret: "anyref" }, ["anyref"])
>+              .GetLocal(0)
>+              .SetLocal(1)
>+              .GetLocal(1)
>+            .End()
>+
>+            .Function("i", { params: ["anyfunc"], ret: "anyfunc" }, ["anyfunc"])
>+              .GetLocal(0)
>+              .SetLocal(1)
>+              .GetLocal(1)
>+            .End()
>+
>+            .Function("get_h", { params: [], ret: "anyfunc" }, ["anyfunc"])
>+              .I32Const(0)
>+              .RefFunc(0)
>+              .SetLocal(0)
>+              .If("anyfunc")
>+              .Block("anyfunc", (b) =>
>+                b.GetLocal(0)
>+              )
>+              .Else()
>+              .Block("anyfunc", (b) =>
>+                b.GetLocal(0)
>+              )
>+              .End()
>+            .End()
>+
>+            .Function("fix", { params: [], ret: "anyfunc" }, [])
>+              .RefFunc(3)
>+            .End()
>+
>+            .Function("get_not_exported", { params: [], ret: "anyfunc" }, [])
>+              .RefFunc(5)
>+            .End()
>+
>+            .Function("ret_42", { params: [], ret: "i32" }, [])
>+              .I32Const(42)
>+            .End()
>+
>+            .Function("local_read", { params: [], ret: "i32" }, ["anyfunc"])
>+              .GetLocal(0)
>+              .RefIsNull()
>+            .End()
>+          .End();
>+
>+    const bin = builder.WebAssembly().get();
>+    const module = new WebAssembly.Module(bin);
>+    const instance = new WebAssembly.Instance(module);
>+    fullGC();
>+
>+    assert.eq(instance.exports.local_read(), 1)
>+    assert.eq(instance.exports.h(null), null)
>+
>+    assert.throws(() => instance.exports.h(fun), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')")
>+    assert.eq(instance.exports.h(myfun), myfun)
>+    assert.throws(() => instance.exports.h(5), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')")
>+    assert.throws(() => instance.exports.h(undefined), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')")
>+
>+    assert.eq(instance.exports.i(null), null)
>+    assert.eq(instance.exports.i(myfun), myfun)
>+    assert.throws(() => instance.exports.i(fun), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')")
>+    assert.throws(() => instance.exports.i(5), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')")
>+
>+    assert.throws(() => instance.exports.get_h()(fun), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')")
>+    assert.eq(instance.exports.get_h()(null), null)
>+    assert.eq(instance.exports.get_h()(myfun), myfun)
>+    assert.throws(() => instance.exports.get_h()(5), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')")
>+
>+    assert.eq(instance.exports.get_not_exported()(), 42)
>+
>+    assert.eq(instance.exports.fix()(), instance.exports.fix());
>+    assert.eq(instance.exports.fix(), instance.exports.fix);
>+}
>+
>+// Globals
>+
>+{
>+    const myfun = makeExportedFunction(42);
>+    function fun() {
>+        return 41;
>+    }
>+
>+    const $1 = (() => new WebAssembly.Instance(new WebAssembly.Module((new Builder())
>+      .Type().End()
>+      .Import()
>+           .Global().Anyfunc("imp", "ref", "immutable").End()
>+      .End()
>+      .Function().End()
>+      .Global()
>+          .RefNull("anyfunc", "mutable")
>+          .RefNull("anyfunc", "immutable")
>+          .GetGlobal("anyfunc", 0, "mutable")
>+          .RefFunc("anyfunc", 2, "immutable")
>+      .End()
>+      .Export()
>+          .Function("set_glob")
>+          .Function("get_glob")
>+          .Function("glob_is_null")
>+          .Function("set_glob_null")
>+          .Function("get_import")
>+          .Global("expglob", 2)
>+          .Global("expglob2", 0)
>+          .Global("exp_glob_is_null", 4)
>+      .End()
>+      .Code()
>+        .Function("set_glob", { params: ["anyfunc"], ret: "void" })
>+          .GetLocal(0)
>+          .SetGlobal(1)
>+        .End()
>+
>+        .Function("get_glob", { params: [], ret: "anyfunc" })
>+            .GetGlobal(1)
>+        .End()
>+
>+        .Function("glob_is_null", { params: [], ret: "i32" })
>+            .Call(1)
>+            .RefIsNull()
>+        .End()
>+
>+        .Function("set_glob_null", { params: [], ret: "void" })
>+            .RefNull()
>+            .Call(0)
>+        .End()
>+
>+        .Function("get_import", { params: [], ret: "anyfunc" })
>+            .GetGlobal(0)
>+        .End()
>+      .End().WebAssembly().get()), { imp: { ref: makeExportedFunction(1337) } }))();
>+
>+    fullGC();
>+
>+    assert.eq($1.exports.get_import()(), 1337)
>+    assert.eq($1.exports.expglob, null)
>+    assert.eq($1.exports.expglob2(), 1337)
>+    assert.eq($1.exports.exp_glob_is_null, $1.exports.glob_is_null);
>+    assert.eq($1.exports.get_glob(), null)
>+
>+    $1.exports.set_glob(myfun); assert.eq($1.exports.get_glob(), myfun); assert.eq($1.exports.get_glob()(), 42); assert.eq($1.exports.expglob2(), 1337)
>+    $1.exports.set_glob(null); assert.eq($1.exports.get_glob(), null)
>+    $1.exports.set_glob(myfun); assert.eq($1.exports.get_glob()(), 42);
>+
>+    assert.throws(() => $1.exports.set_glob(fun), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')")
>+
>+    assert.eq($1.exports.glob_is_null(), 0)
>+    $1.exports.set_glob_null(); assert.eq($1.exports.get_glob(), null)
>+    assert.eq($1.exports.glob_is_null(), 1)
>+}
>+
>+assert.throws(() => new WebAssembly.Instance(new WebAssembly.Module((new Builder())
>+  .Type().End()
>+  .Import()
>+       .Global().Anyfunc("imp", "ref", "immutable").End()
>+  .End()
>+  .Function().End()
>+  .Code().End().WebAssembly().get()), { imp: { ref: function() { return "hi" } } }), Error, "imported global imp:ref must be a wasm exported function or null (evaluating 'new WebAssembly.Instance')");
>+
>+assert.throws(() => new WebAssembly.Module((new Builder())
>+  .Type().End()
>+  .Function().End()
>+  .Code()
>+    .Function("h", { params: ["anyfunc"], ret: "anyref" })
>+      .GetLocal(0)
>+    .End()
>+  .End().WebAssembly().get()), Error, "WebAssembly.Module doesn't validate: control flow returns with unexpected type, in function at index 0 (evaluating 'new WebAssembly.Module')");
>+
>+assert.throws(() => new WebAssembly.Module((new Builder())
>+  .Type().End()
>+  .Function().End()
>+  .Table()
>+    .Table({initial: 1, element: "anyfunc"})
>+  .End()
>+  .Code()
>+    .Function("h", { params: ["i32"], ret: "void" })
>+      .GetLocal(0)
>+      .I32Const(0)
>+      .TableSet()
>+    .End()
>+  .End().WebAssembly().get()), Error, "WebAssembly.Module doesn't validate: table.set value to type I32 expected Anyfunc, in function at index 0 (evaluating 'new WebAssembly.Module')");
>+
>+// Tables
>+{
>+    const $1 = new WebAssembly.Instance(new WebAssembly.Module((new Builder())
>+      .Type().End()
>+      .Function().End()
>+      .Table()
>+            .Table({initial: 1, element: "anyfunc"})
>+      .End()
>+      .Global()
>+          .RefNull("anyfunc", "mutable")
>+      .End()
>+      .Export()
>+          .Function("set_glob")
>+          .Function("get_glob")
>+          .Function("call_glob")
>+          .Function("ret_20")
>+      .End()
>+      .Code()
>+        .Function("set_glob", { params: ["anyfunc"], ret: "void" })
>+          .GetLocal(0)
>+          .SetGlobal(0)
>+        .End()
>+
>+        .Function("get_glob", { params: [], ret: "anyfunc" })
>+            .GetGlobal(0)
>+        .End()
>+
>+        .Function("call_glob", { params: ["i32"], ret: "i32" })
>+            .I32Const(0)
>+            .GetGlobal(0)
>+            .TableSet()
>+
>+            .GetLocal(0)
>+            .I32Const(0)
>+            .CallIndirect(2,0)
>+        .End()
>+
>+        .Function("ret_20", { params: ["i32"], ret: "i32" })
>+            .I32Const(20)
>+        .End()
>+      .End().WebAssembly().get()));
>+
>+    const myfun = makeExportedFunction(1337);
>+    function fun(i) {
>+        return 41;
>+    }
>+    const ident = makeExportedIdent();
>+
>+    $1.exports.set_glob($1.exports.ret_20); assert.eq($1.exports.get_glob(), $1.exports.ret_20); assert.eq($1.exports.call_glob(42), 20)
>+    $1.exports.set_glob(null); assert.eq($1.exports.get_glob(), null); assert.throws(() => $1.exports.call_glob(42), Error, "call_indirect to a null table entry (evaluating 'func(...args)')")
>+    $1.exports.set_glob(ident); assert.eq($1.exports.get_glob(), ident); assert.eq($1.exports.call_glob(42), 42)
>+
>+    assert.throws(() => $1.exports.set_glob(fun), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')")
>+    $1.exports.set_glob(myfun); assert.eq($1.exports.get_glob(), myfun); assert.throws(() => $1.exports.call_glob(42), Error, "call_indirect to a signature that does not match (evaluating 'func(...args)')")
>+
>+    for (let i=0; i<1000; ++i) {
>+        assert.throws(() => $1.exports.set_glob(function() {}), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')");
>+    }
>+}
>+
>+// Table set/get
>+
>+{
>+    const $1 = new WebAssembly.Instance(new WebAssembly.Module((new Builder())
>+      .Type().End()
>+      .Function().End()
>+      .Table()
>+            .Table({initial: 1, element: "anyfunc"})
>+      .End()
>+      .Export()
>+          .Function("set")
>+          .Function("get")
>+      .End()
>+      .Code()
>+        .Function("set", { params: ["anyfunc"], ret: "void" })
>+          .I32Const(0)
>+          .GetLocal(0)
>+          .TableSet()
>+        .End()
>+
>+        .Function("get", { params: [], ret: "anyfunc" })
>+            .I32Const(0)
>+            .TableGet()
>+        .End()
>+      .End().WebAssembly().get()));
>+
>+    function doSet() {
>+        const myfun = makeExportedFunction(444);
>+        for (let i=0; i<1000; ++i) {
>+            $1.exports.set(myfun);
>+        }
>+        $1.exports.set(myfun); assert.eq($1.exports.get(), myfun); assert.eq($1.exports.get()(), 444);
>+    }
>+
>+    function doTest(j,k, l) {
>+        fullGC();
>+        let garbage = { val: "hi", val2: 5, arr: [] }
>+        for (let i=0; i<100; ++i) garbage.arr += ({ field: i + j + k + l })
>+        fullGC();
>+
>+        for (let i=0; i<100; ++i) {
>+            assert.eq($1.exports.get()(), 444);
>+            fullGC();
>+        }
>+    }
>+
>+
>+    doSet()
>+    doTest(0,0,0)
>+}
>+
>+// Wasm->JS Calls
>+
>+for (let importedFun of [function(i) { return i; }, makeAnyfuncIdent()]) {
>+    const $1 = new WebAssembly.Instance(new WebAssembly.Module((new Builder())
>+      .Type().End()
>+      .Import()
>+           .Function("imp", "h", { params: ["anyfunc"], ret: "anyfunc" })
>+      .End()
>+      .Function().End()
>+      .Table()
>+            .Table({initial: 1, element: "anyfunc"})
>+      .End()
>+      .Export()
>+          .Function("test1")
>+          .Function("test2")
>+          .Function("test3")
>+          .Function("test4")
>+      .End()
>+      .Code()
>+        .Function("test1", { params: ["anyfunc"], ret: "anyfunc" })
>+          .GetLocal(0)
>+          .Call(0)
>+        .End()
>+
>+        .Function("test2", { params: [], ret: "anyfunc" })
>+          .RefFunc(1)
>+          .Call(0)
>+        .End()
>+
>+        .Function("test3", { params: ["anyfunc"], ret: "anyfunc" })
>+          .GetLocal(0)
>+          .I32Const(0)
>+          .RefFunc(0)
>+          .TableSet()
>+          .I32Const(0)
>+          .CallIndirect(0, 0)
>+        .End()
>+
>+        .Function("test4", { params: [], ret: "anyfunc" })
>+          .RefFunc(1)
>+          .I32Const(0)
>+          .RefFunc(0)
>+          .TableSet()
>+          .I32Const(0)
>+          .CallIndirect(0, 0)
>+        .End()
>+      .End().WebAssembly().get()), { imp: { h: importedFun } });
>+
>+    const myfun = makeExportedFunction(1337);
>+    function fun(i) {
>+        return 41;
>+    }
>+
>+    for (let test of [$1.exports.test1, $1.exports.test3]) {
>+        assert.eq(test(myfun), myfun)
>+        assert.eq(test(myfun)(), 1337)
>+        assert.throws(() => test(fun), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')")
>+
>+        for (let i=0; i<1000; ++i) {
>+            assert.throws(() => test(fun), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')")
>+        }
>+    }
>+
>+    for (let test of [$1.exports.test2, $1.exports.test4]) {
>+        assert.eq(test(), $1.exports.test1)
>+        assert.eq(test()(myfun), myfun)
>+        assert.throws(() => test()(fun), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')")
>+
>+        for (let i=0; i<1000; ++i) {
>+            assert.throws(() => test()(fun), Error, "Anyfunc must be an exported wasm function (evaluating 'func(...args)')")
>+        }
>+    }
>+}
>diff --git a/JSTests/wasm/references/validation.js b/JSTests/wasm/references/validation.js
>index d38c265bfff610ad494884f9a77a6373c84e52a3..8f816369a74e89e49e6909df445550fd0f66c216 100644
>--- a/JSTests/wasm/references/validation.js
>+++ b/JSTests/wasm/references/validation.js
>@@ -63,7 +63,7 @@ import Builder from '../Builder.js';
>     const bin = builder.WebAssembly();
>     bin.trim();
> 
>-    assert.throws(() => new WebAssembly.Module(bin.get()), WebAssembly.CompileError, "WebAssembly.Module doesn't validate: table.set expects the table to have type Anyref, in function at index 0 (evaluating 'new WebAssembly.Module(bin.get())')");
>+    assert.throws(() => new WebAssembly.Module(bin.get()), WebAssembly.CompileError, "WebAssembly.Module doesn't validate: table.set value to type Anyref expected Anyfunc, in function at index 0 (evaluating 'new WebAssembly.Module(bin.get())')");
> }
> 
> {
>@@ -86,7 +86,7 @@ import Builder from '../Builder.js';
>     const bin = builder.WebAssembly();
>     bin.trim();
> 
>-    assert.throws(() => new WebAssembly.Module(bin.get()), WebAssembly.CompileError, "WebAssembly.Module doesn't validate: table.get expects the table to have type Anyref, in function at index 0 (evaluating 'new WebAssembly.Module(bin.get())')");
>+    assert.throws(() => new WebAssembly.Module(bin.get()), WebAssembly.CompileError, "WebAssembly.Module doesn't validate: control flow returns with unexpected type, in function at index 0 (evaluating 'new WebAssembly.Module(bin.get())')");
> }
> 
> {
>diff --git a/JSTests/wasm/wasm.json b/JSTests/wasm/wasm.json
>index 30bbc74723783922edbbf634993490f48b7b7e02..64ca0b5b208d91b2bf7865575712473d5b7250a3 100644
>--- a/JSTests/wasm/wasm.json
>+++ b/JSTests/wasm/wasm.json
>@@ -11,13 +11,13 @@
>         "i64":     { "type": "varint7", "value":  -2, "b3type": "B3::Int64" },
>         "f32":     { "type": "varint7", "value":  -3, "b3type": "B3::Float" },
>         "f64":     { "type": "varint7", "value":  -4, "b3type": "B3::Double" },
>-        "anyfunc": { "type": "varint7", "value": -16, "b3type": "B3::Void" },
>+        "anyfunc": { "type": "varint7", "value": -16, "b3type": "B3::Int64" },
>         "anyref":  { "type": "varint7", "value": -17, "b3type": "B3::Int64" },
>         "func":    { "type": "varint7", "value": -32, "b3type": "B3::Void" },
>         "void":    { "type": "varint7", "value": -64, "b3type": "B3::Void" }
>     },
>-    "value_type": ["i32", "i64", "f32", "f64", "anyref"],
>-    "block_type": ["i32", "i64", "f32", "f64", "void", "anyref"],
>+    "value_type": ["i32", "i64", "f32", "f64", "anyref", "anyfunc"],
>+    "block_type": ["i32", "i64", "f32", "f64", "void", "anyref", "anyfunc"],
>     "elem_type": ["anyfunc","anyref"],
>     "external_kind": {
>         "Function": { "type": "uint8", "value": 0 },
>@@ -59,8 +59,9 @@
>         "i64.const":           { "category": "special",    "value":  66, "return": ["i64"],      "parameter": [],                       "immediate": [{"name": "value",          "type": "varint64"}],                                             "description": "a constant value interpreted as i64" },
>         "f64.const":           { "category": "special",    "value":  68, "return": ["f64"],      "parameter": [],                       "immediate": [{"name": "value",          "type": "double"}],                                               "description": "a constant value interpreted as f64" },
>         "f32.const":           { "category": "special",    "value":  67, "return": ["f32"],      "parameter": [],                       "immediate": [{"name": "value",          "type": "float"}],                                                "description": "a constant value interpreted as f32" },
>-        "ref.null":            { "category": "special",    "value": 208, "return": ["anyref"],   "parameter": [],                       "immediate": [],                                                                                           "description": "a constant null reference" },
>+        "ref.null":            { "category": "special",    "value": 208, "return": ["anyfunc"],  "parameter": [],                       "immediate": [],                                                                                           "description": "a constant null reference" },
>         "ref.is_null":         { "category": "special",    "value": 209, "return": ["i32"],      "parameter": ["anyref"],               "immediate": [],                                                                                           "description": "determine if a reference is null" },
>+        "ref.func":            { "category": "special",    "value": 210, "return": ["anyfunc"],  "parameter": [],                       "immediate": [{"name": "function_index",  "type": "varuint32"}],                                           "description": "return a reference to the function at the given index" },
>         "get_local":           { "category": "special",    "value":  32, "return": ["any"],      "parameter": [],                       "immediate": [{"name": "local_index",    "type": "varuint32"}],                                            "description": "read a local variable or parameter" },
>         "set_local":           { "category": "special",    "value":  33, "return": [],           "parameter": ["any"],                  "immediate": [{"name": "local_index",    "type": "varuint32"}],                                            "description": "write a local variable or parameter" },
>         "tee_local":           { "category": "special",    "value":  34, "return": ["any"],      "parameter": ["any"],                  "immediate": [{"name": "local_index",    "type": "varuint32"}],                                            "description": "write a local variable or parameter and return the same value" },

Actions: View | Formatted Diff | Diff

Attachments on bug 198157: 371816 | 372095 | 372170 | 372256 | 372257