feat(codegen): sound null-funcref-slot call_indirect — runtime null check (#664)

[avrabe]

Fixes #664. Builds on #650/#653 (multi-table R11 region) and #646 (the #642 closed-world guards).

The gap

call_indirect on a table with any null (uninitialized funcref) slot loud-declined: the #646 closed-world verifier treated an uninitialized slot as breaking the closed world for EVERY type ("the raw code-pointer table has no runtime null/type id to check"). Sound, but incomplete — component-model tables legitimately carry null slots (falcon-flight v1.112's (table 1 41 41) is sparsely populated), and WASM Core §4.4.8 says a call_indirect reaching one simply traps. All 20 of falcon's dispatch functions declined on this.

The relaxation (design)

The closed-world type verdict relaxes from "every slot in [0, size) initialized + type-equal" to "every INITIALIZED slot type-equal"; null slots become trap-on-call at runtime:

• Decoder (synth-core): TableGuards gains has_null_slots. table_type_reject no longer all-rejects on an uninitialized slot — it type-checks the initialized image and reports the null flag. A null slot can never produce a live callee of the wrong type, because the null check traps before the branch — so the type relaxation is sound. Heterogeneous initialized slots, unverifiable segments, growable imports: all still reject exactly as before.
• Selector (synth-synthesis): resolve_call_indirect_guards returns the flag; both arms (select_with_stack + select_default) thread it as ArmOp::CallIndirect { null_check }.
• Encoder (Thumb-2 + A32): when null_check, a three-insn null check lands between the pointer load and the BLX (same trap idiom as the thumb-2: call_indirect emits no bounds-check and no type-check — OOB/wrong-type index does an uncontrolled indirect branch instead of trapping (WASM 4.4.8) #642 bounds guard):

  ldr.w  ip, [r11, ip]     ; (or the #650 add/ldr-imm form)
  cmp.w  ip, #0            ; #664 — only when the table has null slots
  bne    .+4
  udf    #0                ; §4.4.8 uninitialized-element trap
  blx    ip
  

The null-region guarantee (emission finding)

synth does not emit the funcref table region — the #650 layout contract has the runtime/harness link it at R11. This PR extends that contract (documented on CallIndirectGuards): every uninitialized slot MUST be linked as a ZERO word. Zero is never a valid code pointer in the region, so the null check turns it into the deterministic trap. The differential harness links per this contract; meld/falcon integration inherits the same one-line rule (a BSS/zero-filled region satisfies it for free).

Single-table / fully-initialized byte-identity — BY CONSTRUCTION, then verified

null_check: false (any fully-initialized table) skips the encoder branch entirely — the #650 offset-0 trick. Verified against an origin/main-built binary: whole-ELF cmp identity, 24/24 — #642/#650/#594/#597 fixtures × cortex-m3/cortex-r5/cortex-m7dp × --relocatable/self-contained. Frozen anchors 10/10.

Oracle (CI-gated: call-indirect-664-nullslot-oracle)

scripts/repro/call_indirect_664_differential.py + call_indirect_664_nullslot.wat: 4-slot table, slots 1,3 initialized (two segments — the falcon shape), 0,2 null. Per case, unicorn-executed synth code (null slots linked as zero, decoys past the region) vs wasmtime:

• New binary: 12/12 green (2 initialized-match + 2 null-must-UDF + 2 OOB-must-UDF, Thumb-2 + A32). Non-vacuous: a build without the null check BLXes address 0 and faults (distinguished from the UDF trap) — red, never vacuously green.
• origin/main (v0.35.0): RED at compile — via declines (SYMBOL MISSING). Capability upgrade: red = "declines today", green = sound sparse dispatch.
• Existing thumb-2: call_indirect emits no bounds-check and no type-check — OOB/wrong-type index does an uncontrolled indirect branch instead of trapping (WASM 4.4.8) #642/arm backend links only table 0 (R11); call_indirect through table index ≥1 loud-declines — blocks multi-table fused components (falcon: 20 funcs) #650/call_indirect on the A32 path (--target cortex-r5) compiles to a NOP — silently returns wrong result instead of calling the target #594/Thumb-2 CallIndirect shift lands in the type field (mov.w ip, rm, ASR #32) — always dispatches table entry 0 (shipped miscompile, masked by index-0 probes) #597 oracles: still PASS with the new binary.
• The issue's exact via repro now compiles clean on cortex-m7dp (0 skips).

Scope notes

• RISC-V: call_indirect was never lowered on RV32 (pre-existing unsupported wasm op loud-skip) — unchanged; the decoder relaxation is shared, so the RV32 lowering inherits the flag when it lands.
• Estimator: CallIndirect still declines at optimizer_bridge (thumb-2: call_indirect emits no bounds-check and no type-check — OOB/wrong-type index does an uncontrolled indirect branch instead of trapping (WASM 4.4.8) #642) → stays direct-selector-only, on the test(vcr-oracle): estimator↔encoder agreement oracle for the optimized path (#498, #242) #511 oracle's exclusion list — verified, no estimator change.
• Explicit (ref.null) entries inside a segment still poison contents (unverifiable-contents rule unchanged); this PR addresses slots not covered by any segment — the falcon case.

Workspace tests green (108 suites), fmt clean, clippy -D warnings clean workspace-wide (chunked per-crate + full).

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 97.07602% with 5 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-synthesis/src/instruction_selector.rs	92.30%	3 Missing ⚠️
crates/synth-core/src/wasm_decoder.rs	96.42%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!