[wasm-gc] Implement rtt.sub

RTTs are internally represented as Maps. To store supertype information,
this patch introduces a WasmTypeInfo object, which is installed on Wasm
objects' Maps and points at both the off-heap type information and the
parent RTT.
In this patch, rtt.sub always creates a fresh RTT. The canonicalization
that the proposal requires will be implemented later.

Bug: v8:7748
Change-Id: I8286dd11f520966155cd95c2bd844ec34fccd131
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2260566
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68564}

src/builtins/wasm.tq

@@ -29,6 +29,7 @@ extern runtime WasmI32AtomicWait(
     Context, WasmInstanceObject, Number, Number, BigInt): Smi;
 extern runtime WasmI64AtomicWait(
     Context, WasmInstanceObject, Number, BigInt, BigInt): Smi;
+extern runtime WasmAllocateRtt(Context, Smi, Map): Map;
 }
 
 namespace unsafe {
@@ -237,6 +238,11 @@ builtin WasmAllocateStruct(implicit context: Context)(mapIndex: Smi):
   return result;
 }
 
+builtin WasmAllocateRtt(implicit context: Context)(
+    typeIndex: Smi, parent: Map): Map {
+  tail runtime::WasmAllocateRtt(context, typeIndex, parent);
+}
+
 builtin WasmInt32ToNumber(value: int32): Number {
   return ChangeInt32ToTagged(value);
 }

src/compiler/types.cc

@@ -324,6 +324,7 @@ Type::bitset BitsetType::Lub(const MapRefLike& map) {
     case UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE:
     case UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE:
     case COVERAGE_INFO_TYPE:
+    case WASM_TYPE_INFO_TYPE:
       return kOtherInternal;
 
     // Remaining instance types are unsupported for now. If any of them do

src/compiler/wasm-compiler.cc

@@ -5329,6 +5329,18 @@ Node* WasmGraphBuilder::RttCanon(wasm::HeapType type) {
   return LOAD_FIXED_ARRAY_SLOT_PTR(maps_list, type_index);
 }
 
+Node* WasmGraphBuilder::RttSub(wasm::HeapType type, Node* parent_rtt) {
+  if (is_generic_heap_type(type)) {
+    // TODO(7748): Implement this. {type} could be eqref, with {parent_rtt}
+    // being (rtt.canon anyref).
+    UNIMPLEMENTED();
+  }
+  return CALL_BUILTIN(
+      WasmAllocateRtt,
+      graph()->NewNode(mcgraph()->common()->NumberConstant(type)), parent_rtt,
+      LOAD_INSTANCE_FIELD(NativeContext, MachineType::TaggedPointer()));
+}
+
 Node* WasmGraphBuilder::StructGet(Node* struct_object,
                                   const wasm::StructType* struct_type,
                                   uint32_t field_index, CheckForNull null_check,

src/compiler/wasm-compiler.h

@@ -400,6 +400,7 @@ class WasmGraphBuilder {
                  wasm::WasmCodePosition position);
   Node* ArrayLen(Node* array_object, wasm::WasmCodePosition position);
   Node* RttCanon(wasm::HeapType type);
+  Node* RttSub(wasm::HeapType type, Node* parent_rtt);
 
   bool has_simd() const { return has_simd_; }
 

src/diagnostics/objects-debug.cc

@@ -251,6 +251,9 @@ void HeapObject::HeapObjectVerify(Isolate* isolate) {
       TORQUE_INSTANCE_CHECKERS_MULTIPLE_FULLY_DEFINED(MAKE_TORQUE_CASE)
 #undef MAKE_TORQUE_CASE
 
+    case FOREIGN_TYPE:
+      break;  // No interesting fields.
+
     case ALLOCATION_SITE_TYPE:
       AllocationSite::cast(*this).AllocationSiteVerify(isolate);
       break;

src/diagnostics/objects-printer.cc

@@ -220,6 +220,9 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
       TORQUE_INSTANCE_CHECKERS_MULTIPLE_FULLY_DEFINED(MAKE_TORQUE_CASE)
 #undef MAKE_TORQUE_CASE
 
+    case FOREIGN_TYPE:
+      Foreign::cast(*this).ForeignPrint(os);
+      break;
     case ALLOCATION_SITE_TYPE:
       AllocationSite::cast(*this).AllocationSitePrint(os);
       break;
@@ -1651,6 +1654,13 @@ void AsmWasmData::AsmWasmDataPrint(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
+void WasmTypeInfo::WasmTypeInfoPrint(std::ostream& os) {  // NOLINT
+  PrintHeader(os, "WasmTypeInfo");
+  os << "\n - type address: " << reinterpret_cast<void*>(foreign_address());
+  os << "\n - parent: " << Brief(parent());
+  os << "\n";
+}
+
 void WasmStruct::WasmStructPrint(std::ostream& os) {  // NOLINT
   PrintHeader(os, "WasmStruct");
   wasm::StructType* struct_type = type();

src/heap/factory.cc

@@ -1347,6 +1347,17 @@ Handle<Foreign> Factory::NewForeign(Address addr) {
   return foreign;
 }
 
+Handle<WasmTypeInfo> Factory::NewWasmTypeInfo(Address type_address,
+                                              Handle<Map> parent) {
+  Map map = *wasm_type_info_map();
+  HeapObject result = AllocateRawWithImmortalMap(map.instance_size(),
+                                                 AllocationType::kYoung, map);
+  Handle<WasmTypeInfo> info(WasmTypeInfo::cast(result), isolate());
+  info->set_foreign_address(isolate(), type_address);
+  info->set_parent(*parent);
+  return info;
+}
+
 Handle<Cell> Factory::NewCell(Handle<Object> value) {
   STATIC_ASSERT(Cell::kSize <= kMaxRegularHeapObjectSize);
   HeapObject result = AllocateRawWithImmortalMap(
@@ -2488,13 +2499,6 @@ Handle<JSGeneratorObject> Factory::NewJSGeneratorObject(
   return Handle<JSGeneratorObject>::cast(NewJSObjectFromMap(map));
 }
 
-Handle<WasmStruct> Factory::NewWasmStruct(Handle<Map> map) {
-  int size = map->instance_size();
-  HeapObject result = AllocateRaw(size, AllocationType::kYoung);
-  result.set_map_after_allocation(*map);
-  return handle(WasmStruct::cast(result), isolate());
-}
-
 Handle<SourceTextModule> Factory::NewSourceTextModule(
     Handle<SharedFunctionInfo> code) {
   Handle<SourceTextModuleInfo> module_info(

src/heap/factory.h

@@ -553,7 +553,8 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
 
   Handle<JSModuleNamespace> NewJSModuleNamespace();
 
-  Handle<WasmStruct> NewWasmStruct(Handle<Map> map);
+  Handle<WasmTypeInfo> NewWasmTypeInfo(Address type_address,
+                                       Handle<Map> parent);
 
   Handle<SourceTextModule> NewSourceTextModule(Handle<SharedFunctionInfo> code);
   Handle<SyntheticModule> NewSyntheticModule(

src/heap/objects-visiting.h

@@ -61,7 +61,8 @@ namespace internal {
   V(WasmCapiFunctionData)              \
   V(WasmIndirectFunctionTable)         \
   V(WasmInstanceObject)                \
-  V(WasmStruct)
+  V(WasmStruct)                        \
+  V(WasmTypeInfo)
 
 #define FORWARD_DECLARE(TypeName) class TypeName;
 TYPED_VISITOR_ID_LIST(FORWARD_DECLARE)

src/heap/setup-heap-internal.cc

@@ -505,6 +505,8 @@ bool Heap::CreateInitialMaps() {
     ALLOCATE_MAP(CODE_DATA_CONTAINER_TYPE, CodeDataContainer::kSize,
                  code_data_container)
 
+    ALLOCATE_MAP(WASM_TYPE_INFO_TYPE, WasmTypeInfo::kSize, wasm_type_info)
+
     ALLOCATE_MAP(WEAK_CELL_TYPE, WeakCell::kSize, weak_cell)
 
     ALLOCATE_MAP(JS_MESSAGE_OBJECT_TYPE, JSMessageObject::kHeaderSize,

src/objects/map-inl.h

@@ -5,8 +5,6 @@
 #ifndef V8_OBJECTS_MAP_INL_H_
 #define V8_OBJECTS_MAP_INL_H_
 
-#include "src/objects/map.h"
-
 #include "src/heap/heap-write-barrier-inl.h"
 #include "src/objects/api-callbacks-inl.h"
 #include "src/objects/cell-inl.h"
@@ -14,12 +12,14 @@
 #include "src/objects/field-type.h"
 #include "src/objects/instance-type-inl.h"
 #include "src/objects/layout-descriptor-inl.h"
+#include "src/objects/map.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/property.h"
 #include "src/objects/prototype-info-inl.h"
 #include "src/objects/shared-function-info.h"
 #include "src/objects/templates-inl.h"
 #include "src/objects/transitions-inl.h"
+#include "src/wasm/wasm-objects-inl.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -754,7 +754,7 @@ ACCESSORS_CHECKED2(Map, constructor_or_backpointer, Object,
 ACCESSORS_CHECKED(Map, native_context, NativeContext,
                   kConstructorOrBackPointerOrNativeContextOffset,
                   IsContextMap())
-ACCESSORS_CHECKED(Map, wasm_type_info, Foreign,
+ACCESSORS_CHECKED(Map, wasm_type_info, WasmTypeInfo,
                   kConstructorOrBackPointerOrNativeContextOffset,
                   IsWasmStructMap() || IsWasmArrayMap())
 

src/objects/map.cc

@@ -368,6 +368,8 @@ VisitorId Map::GetVisitorId(Map map) {
       return kVisitWasmArray;
     case WASM_STRUCT_TYPE:
       return kVisitWasmStruct;
+    case WASM_TYPE_INFO_TYPE:
+      return kVisitWasmTypeInfo;
 
 #define MAKE_TQ_CASE(TYPE, Name) \
   case TYPE:                     \

src/objects/map.h

@@ -77,6 +77,7 @@ enum InstanceType : uint16_t;
   V(WasmInstanceObject)                \
   V(WasmArray)                         \
   V(WasmStruct)                        \
+  V(WasmTypeInfo)                      \
   V(WeakCell)
 
 #define TORQUE_VISITOR_ID_LIST(V)     \
@@ -578,7 +579,7 @@ class Map : public HeapObject {
   // and with the Wasm type info for WebAssembly object maps.
   DECL_ACCESSORS(constructor_or_backpointer, Object)
   DECL_ACCESSORS(native_context, NativeContext)
-  DECL_ACCESSORS(wasm_type_info, Foreign)
+  DECL_ACCESSORS(wasm_type_info, WasmTypeInfo)
   DECL_GETTER(GetConstructor, Object)
   DECL_GETTER(GetFunctionTemplateInfo, FunctionTemplateInfo)
   inline void SetConstructor(Object constructor,

src/objects/object-list-macros.h

@@ -232,6 +232,7 @@ class ZoneForwardList;
   V(WasmMemoryObject)                          \
   V(WasmModuleObject)                          \
   V(WasmStruct)                                \
+  V(WasmTypeInfo)                              \
   V(WasmTableObject)                           \
   V(WeakFixedArray)                            \
   V(WeakArrayList)                             \

src/objects/objects-body-descriptors-inl.h

@@ -601,6 +601,23 @@ class Foreign::BodyDescriptor final : public BodyDescriptorBase {
   static inline int SizeOf(Map map, HeapObject object) { return kSize; }
 };
 
+class WasmTypeInfo::BodyDescriptor final : public BodyDescriptorBase {
+ public:
+  static bool IsValidSlot(Map map, HeapObject obj, int offset) {
+    UNREACHABLE();
+  }
+
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Map map, HeapObject obj, int object_size,
+                                 ObjectVisitor* v) {
+    Foreign::BodyDescriptor::IterateBody<ObjectVisitor>(map, obj, object_size,
+                                                        v);
+    IteratePointer(obj, kParentOffset, v);
+  }
+
+  static inline int SizeOf(Map map, HeapObject object) { return kSize; }
+};
+
 class ExternalOneByteString::BodyDescriptor final : public BodyDescriptorBase {
  public:
   static bool IsValidSlot(Map map, HeapObject obj, int offset) { return false; }
@@ -970,6 +987,8 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
       return Op::template apply<WasmArray::BodyDescriptor>(p1, p2, p3, p4);
     case WASM_STRUCT_TYPE:
       return Op::template apply<WasmStruct::BodyDescriptor>(p1, p2, p3, p4);
+    case WASM_TYPE_INFO_TYPE:
+      return Op::template apply<WasmTypeInfo::BodyDescriptor>(p1, p2, p3, p4);
     case JS_OBJECT_TYPE:
     case JS_ERROR_TYPE:
     case JS_ARGUMENTS_OBJECT_TYPE:

src/objects/objects.cc

@@ -5190,7 +5190,8 @@ bool SharedFunctionInfo::PassesFilter(const char* raw_filter) {
 bool SharedFunctionInfo::HasSourceCode() const {
   ReadOnlyRoots roots = GetReadOnlyRoots();
   return !script().IsUndefined(roots) &&
-         !Script::cast(script()).source().IsUndefined(roots);
+         !Script::cast(script()).source().IsUndefined(roots) &&
+         String::cast(Script::cast(script()).source()).length() > 0;
 }
 
 void SharedFunctionInfo::DiscardCompiledMetadata(

src/roots/roots.h

@@ -118,6 +118,7 @@ class Symbol;
     UncompiledDataWithoutPreparseDataMap)                                      \
   V(Map, uncompiled_data_with_preparse_data_map,                               \
     UncompiledDataWithPreparseDataMap)                                         \
+  V(Map, wasm_type_info_map, WasmTypeInfoMap)                                  \
   V(Map, weak_fixed_array_map, WeakFixedArrayMap)                              \
   V(Map, weak_array_list_map, WeakArrayListMap)                                \
   V(Map, ephemeron_hash_table_map, EphemeronHashTableMap)                      \

src/runtime/runtime-wasm.cc

@@ -493,5 +493,25 @@ RUNTIME_FUNCTION(Runtime_WasmDebugBreak) {
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
+RUNTIME_FUNCTION(Runtime_WasmAllocateRtt) {
+  ClearThreadInWasmScope flag_scope;
+  HandleScope scope(isolate);
+  DCHECK_EQ(2, args.length());
+  CONVERT_UINT32_ARG_CHECKED(type_index, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Map, parent, 1);
+  Handle<WasmInstanceObject> instance(GetWasmInstanceOnStackTop(isolate),
+                                      isolate);
+  const wasm::WasmModule* module = instance->module();
+  Handle<Map> rtt;
+  if (module->has_struct(type_index)) {
+    rtt = wasm::CreateStructMap(isolate, module, type_index, parent);
+  } else if (module->has_array(type_index)) {
+    rtt = wasm::CreateArrayMap(isolate, module, type_index, parent);
+  } else {
+    UNREACHABLE();
+  }
+  return *rtt;
+}
+
 }  // namespace internal
 }  // namespace v8

src/runtime/runtime.h

@@ -574,7 +574,8 @@ namespace internal {
   F(WasmTableFill, 4, 1)              \
   F(WasmIsValidFuncRefValue, 1, 1)    \
   F(WasmCompileLazy, 2, 1)            \
-  F(WasmDebugBreak, 0, 1)
+  F(WasmDebugBreak, 0, 1)             \
+  F(WasmAllocateRtt, 2, 1)
 
 #define FOR_EACH_INTRINSIC_WEAKREF(F, I) \
   F(ShrinkFinalizationRegistryUnregisterTokenMap, 1, 1)

src/wasm/baseline/liftoff-compiler.cc

@@ -3617,6 +3617,11 @@ class LiftoffCompiler {
     // TODO(7748): Implement.
     unsupported(decoder, kGC, "rtt.canon");
   }
+  void RttSub(FullDecoder* decoder, const HeapTypeImmediate<validate>& imm,
+              const Value& parent, Value* result) {
+    // TODO(7748): Implement.
+    unsupported(decoder, kGC, "rtt.sub");
+  }
 
   void PassThrough(FullDecoder* decoder, const Value& from, Value* to) {
     // TODO(7748): Implement.

src/wasm/function-body-decoder-impl.h

@@ -966,6 +966,8 @@ struct ControlBase {
     const Value& value)                                                        \
   F(ArrayLen, const Value& array_obj, Value* result)                           \
   F(RttCanon, const HeapTypeImmediate<validate>& imm, Value* result)           \
+  F(RttSub, const HeapTypeImmediate<validate>& imm, const Value& parent,       \
+    Value* result)                                                             \
   F(PassThrough, const Value& from, Value* to)
 
 // Generic Wasm bytecode decoder with utilities for decoding immediates,
@@ -1688,15 +1690,14 @@ class WasmDecoder : public Decoder {
             BranchDepthImmediate<validate> imm(decoder, pc + 2);
             return 2 + imm.length;
           }
-          case kExprRttCanon: {
+          case kExprRttCanon:
+          case kExprRttSub: {
+            // TODO(7748): Account for rtt.sub's additional immediates if
+            // they stick.
             HeapTypeImmediate<validate> imm(WasmFeatures::All(), decoder,
                                             pc + 2);
             return 2 + imm.length;
           }
-          case kExprRttSub:
-            // TODO(7748): Implement.
-            decoder->error(pc, "rtt.sub not implemented yet");
-            return 2;
 
           case kExprI31New:
           case kExprI31GetS:
@@ -3458,6 +3459,31 @@ class WasmFullDecoder : public WasmDecoder<validate> {
         CALL_INTERFACE_IF_REACHABLE(RttCanon, imm, value);
         break;
       }
+      case kExprRttSub: {
+        // TODO(7748): The proposal currently includes additional immediates
+        // here: the subtyping depth <n> and the "parent type", see:
+        // https://github.com/WebAssembly/gc/commit/20a80e34 .
+        // If these immediates don't get dropped (in the spirit of
+        // https://github.com/WebAssembly/function-references/pull/31 ),
+        // implement them here.
+        HeapTypeImmediate<validate> imm(this->enabled_, this, this->pc_ + 2);
+        len += imm.length;
+        if (!this->Validate(this->pc_ + 2, imm)) break;
+        Value parent = Pop();
+        // TODO(7748): Consider exposing "IsSubtypeOfHeap(HeapType t1, t2)" so
+        // we can avoid creating (ref heaptype) wrappers here.
+        if (!VALIDATE(parent.type.kind() == ValueType::kRtt &&
+                      IsSubtypeOf(
+                          ValueType::Ref(imm.type, kNonNullable),
+                          ValueType::Ref(parent.type.heap_type(), kNonNullable),
+                          this->module_))) {
+          this->error(this->pc_, "rtt.sub requires a supertype rtt on stack");
+          break;
+        }
+        Value* value = Push(ValueType::Rtt(imm.type, parent.type.depth() + 1));
+        CALL_INTERFACE_IF_REACHABLE(RttSub, imm, parent, value);
+        break;
+      }
       default:
         this->error("invalid gc opcode");
         return 0;

src/wasm/graph-builder-interface.cc

@@ -714,6 +714,11 @@ class WasmGraphBuildingInterface {
     result->node = BUILD(RttCanon, imm.type);
   }
 
+  void RttSub(FullDecoder* decoder, const HeapTypeImmediate<validate>& imm,
+              const Value& parent, Value* result) {
+    result->node = BUILD(RttSub, imm.type, parent.node);
+  }
+
   void PassThrough(FullDecoder* decoder, const Value& from, Value* to) {
     to->node = from.node;
   }

src/wasm/module-instantiate.cc

@@ -86,8 +86,11 @@ class CompileImportWrapperTask final : public CancelableTask {
   WasmImportWrapperCache::ModificationScope* const cache_scope_;
 };
 
+}  // namespace
+
+// TODO(jkummerow): Move these elsewhere.
 Handle<Map> CreateStructMap(Isolate* isolate, const WasmModule* module,
-                            int struct_index) {
+                            int struct_index, Handle<Map> rtt_parent) {
   const wasm::StructType* type = module->struct_type(struct_index);
   int inobject_properties = 0;
   DCHECK_LE(type->total_fields_size(), kMaxInt - WasmStruct::kHeaderSize);
@@ -96,8 +99,8 @@ Handle<Map> CreateStructMap(Isolate* isolate, const WasmModule* module,
   InstanceType instance_type = WASM_STRUCT_TYPE;
   // TODO(jkummerow): If NO_ELEMENTS were supported, we could use that here.
   ElementsKind elements_kind = TERMINAL_FAST_ELEMENTS_KIND;
-  Handle<Foreign> type_info =
-      isolate->factory()->NewForeign(reinterpret_cast<Address>(type));
+  Handle<WasmTypeInfo> type_info = isolate->factory()->NewWasmTypeInfo(
+      reinterpret_cast<Address>(type), rtt_parent);
   Handle<Map> map = isolate->factory()->NewMap(
       instance_type, instance_size, elements_kind, inobject_properties);
   map->set_wasm_type_info(*type_info);
@@ -105,22 +108,20 @@ Handle<Map> CreateStructMap(Isolate* isolate, const WasmModule* module,
 }
 
 Handle<Map> CreateArrayMap(Isolate* isolate, const WasmModule* module,
-                           int array_index) {
+                           int array_index, Handle<Map> rtt_parent) {
   const wasm::ArrayType* type = module->array_type(array_index);
   int inobject_properties = 0;
   int instance_size = kVariableSizeSentinel;
   InstanceType instance_type = WASM_ARRAY_TYPE;
   ElementsKind elements_kind = TERMINAL_FAST_ELEMENTS_KIND;
-  Handle<Foreign> type_info =
-      isolate->factory()->NewForeign(reinterpret_cast<Address>(type));
+  Handle<WasmTypeInfo> type_info = isolate->factory()->NewWasmTypeInfo(
+      reinterpret_cast<Address>(type), rtt_parent);
   Handle<Map> map = isolate->factory()->NewMap(
       instance_type, instance_size, elements_kind, inobject_properties);
   map->set_wasm_type_info(*type_info);
   return map;
 }
 
-}  // namespace
-
 // A helper class to simplify instantiating a module from a module object.
 // It closes over the {Isolate}, the {ErrorThrower}, etc.
 class InstanceBuilder {
@@ -580,15 +581,19 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
     }
     Handle<FixedArray> maps =
         isolate_->factory()->NewUninitializedFixedArray(count);
+    // TODO(7748): Do we want a different sentinel here?
+    Handle<Map> anyref_sentinel_map = isolate_->factory()->null_map();
+    int map_index = 0;
     for (int i = 0; i < static_cast<int>(module_->type_kinds.size()); i++) {
-      int index = 0;
       if (module_->type_kinds[i] == kWasmStructTypeCode) {
-        Handle<Map> map = CreateStructMap(isolate_, module_, i);
-        maps->set(index++, *map);
+        Handle<Map> map =
+            CreateStructMap(isolate_, module_, i, anyref_sentinel_map);
+        maps->set(map_index++, *map);
       }
       if (module_->type_kinds[i] == kWasmArrayTypeCode) {
-        Handle<Map> map = CreateArrayMap(isolate_, module_, i);
-        maps->set(index++, *map);
+        Handle<Map> map =
+            CreateArrayMap(isolate_, module_, i, anyref_sentinel_map);
+        maps->set(map_index++, *map);
       }
     }
     instance->set_managed_object_maps(*maps);

src/wasm/wasm-objects-inl.h

@@ -36,6 +36,7 @@ OBJECT_CONSTRUCTORS_IMPL(WasmMemoryObject, JSObject)
 OBJECT_CONSTRUCTORS_IMPL(WasmModuleObject, JSObject)
 OBJECT_CONSTRUCTORS_IMPL(WasmTableObject, JSObject)
 OBJECT_CONSTRUCTORS_IMPL(AsmWasmData, Struct)
+TQ_OBJECT_CONSTRUCTORS_IMPL(WasmTypeInfo)
 TQ_OBJECT_CONSTRUCTORS_IMPL(WasmStruct)
 TQ_OBJECT_CONSTRUCTORS_IMPL(WasmArray)
 
@@ -47,6 +48,7 @@ CAST_ACCESSOR(WasmMemoryObject)
 CAST_ACCESSOR(WasmModuleObject)
 CAST_ACCESSOR(WasmTableObject)
 CAST_ACCESSOR(AsmWasmData)
+CAST_ACCESSOR(WasmTypeInfo)
 CAST_ACCESSOR(WasmStruct)
 CAST_ACCESSOR(WasmArray)
 
@@ -399,8 +401,8 @@ ACCESSORS(AsmWasmData, export_wrappers, FixedArray, kExportWrappersOffset)
 ACCESSORS(AsmWasmData, uses_bitset, HeapNumber, kUsesBitsetOffset)
 
 wasm::StructType* WasmStruct::type(Map map) {
-  Foreign foreign = map.wasm_type_info();
-  return reinterpret_cast<wasm::StructType*>(foreign.foreign_address());
+  WasmTypeInfo type_info = map.wasm_type_info();
+  return reinterpret_cast<wasm::StructType*>(type_info.foreign_address());
 }
 
 wasm::StructType* WasmStruct::GcSafeType(Map map) {
@@ -422,8 +424,8 @@ ObjectSlot WasmStruct::RawField(int raw_offset) {
 
 wasm::ArrayType* WasmArray::type(Map map) {
   DCHECK_EQ(WASM_ARRAY_TYPE, map.instance_type());
-  Foreign foreign = map.wasm_type_info();
-  return reinterpret_cast<wasm::ArrayType*>(foreign.foreign_address());
+  WasmTypeInfo type_info = map.wasm_type_info();
+  return reinterpret_cast<wasm::ArrayType*>(type_info.foreign_address());
 }
 
 wasm::ArrayType* WasmArray::GcSafeType(Map map) {

src/wasm/wasm-objects.h

@@ -894,6 +894,16 @@ class AsmWasmData : public Struct {
   OBJECT_CONSTRUCTORS(AsmWasmData, Struct);
 };
 
+class WasmTypeInfo : public TorqueGeneratedWasmTypeInfo<WasmTypeInfo, Foreign> {
+ public:
+  DECL_CAST(WasmTypeInfo)
+  DECL_PRINTER(WasmTypeInfo)
+
+  class BodyDescriptor;
+
+  TQ_OBJECT_CONSTRUCTORS(WasmTypeInfo)
+};
+
 class WasmStruct : public TorqueGeneratedWasmStruct<WasmStruct, HeapObject> {
  public:
   static inline wasm::StructType* type(Map map);
@@ -928,6 +938,15 @@ class WasmArray : public TorqueGeneratedWasmArray<WasmArray, HeapObject> {
 
 #undef DECL_OPTIONAL_ACCESSORS
 
+namespace wasm {
+
+Handle<Map> CreateStructMap(Isolate* isolate, const WasmModule* module,
+                            int struct_index, Handle<Map> rtt_parent);
+Handle<Map> CreateArrayMap(Isolate* isolate, const WasmModule* module,
+                           int array_index, Handle<Map> rtt_parent);
+
+}  // namespace wasm
+
 }  // namespace internal
 }  // namespace v8
 

src/wasm/wasm-objects.tq

@@ -92,6 +92,11 @@ extern class AsmWasmData extends Struct {
   uses_bitset: HeapNumber;
 }
 
+@generateCppClass
+extern class WasmTypeInfo extends Foreign {
+  parent: Map;
+}
+
 @generateCppClass
 extern class WasmStruct extends HeapObject {
 }

test/cctest/wasm/test-gc.cc

@@ -547,12 +547,20 @@ TEST(WasmPackedArrayS) {
 TEST(BasicRTT) {
   WasmGCTester tester;
   uint32_t type_index = tester.DefineStruct({F(wasm::kWasmI32, true)});
+  uint32_t subtype_index =
+      tester.DefineStruct({F(wasm::kWasmI32, true), F(wasm::kWasmF64, true)});
   ValueType kRttTypes[] = {
       ValueType::Rtt(static_cast<HeapType>(type_index), 1)};
   FunctionSig sig_t_v(1, 0, kRttTypes);
+  ValueType kRttSubtypes[] = {
+      ValueType::Rtt(static_cast<HeapType>(subtype_index), 2)};
+  FunctionSig sig_t2_v(1, 0, kRttSubtypes);
 
   tester.DefineFunction("f", &sig_t_v, {},
                         {WASM_RTT_CANON(type_index), kExprEnd});
+  tester.DefineFunction(
+      "g", &sig_t2_v, {},
+      {WASM_RTT_CANON(type_index), WASM_RTT_SUB(subtype_index), kExprEnd});
 
   tester.CompileModule();
 
@@ -564,6 +572,14 @@ TEST(BasicRTT) {
   CHECK_EQ(reinterpret_cast<Address>(
                tester.instance()->module()->struct_type(type_index)),
            map->wasm_type_info().foreign_address());
+
+  Handle<Object> subref_result = tester.GetJSResult("g", {}).ToHandleChecked();
+  CHECK(subref_result->IsMap());
+  Handle<Map> submap = Handle<Map>::cast(subref_result);
+  CHECK_EQ(*map, submap->wasm_type_info().parent());
+  CHECK_EQ(reinterpret_cast<Address>(
+               tester.instance()->module()->struct_type(subtype_index)),
+           submap->wasm_type_info().foreign_address());
 }
 
 }  // namespace test_gc

test/common/wasm/wasm-macro-gen.h

@@ -459,6 +459,8 @@ inline WasmOpcode LoadStoreOpcodeOf(MachineType type, bool store) {
 
 #define WASM_RTT_CANON(typeidx) \
   WASM_GC_OP(kExprRttCanon), static_cast<byte>(typeidx)
+#define WASM_RTT_SUB(typeidx) \
+  WASM_GC_OP(kExprRttSub), static_cast<byte>(typeidx)
 
 #define WASM_BR_ON_NULL(depth, ref_object) \
   ref_object, kExprBrOnNull, static_cast<byte>(depth)