[wasm] Remove --experimental-wasm-reftypes flag

Since the reftypes proposal has shipped, we remove the respective flag
and the code that handled its absence. We maintain a WasmFeature for
reftypes for feature detection purposes. We remove the flag declaration
from tests, and adapt some tests that make no sense without the flag.

Bug: v8:7581
Change-Id: Icf2f8d0feae8f30ec68d5560f1e7ee5959481483
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3329781Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78351}

src/flags/flag-definitions.h

@@ -1054,7 +1054,6 @@ FOREACH_WASM_FEATURE_FLAG(DECL_WASM_FLAG)
 #undef DECL_WASM_FLAG
 
 DEFINE_IMPLICATION(experimental_wasm_gc, experimental_wasm_typed_funcref)
-DEFINE_IMPLICATION(experimental_wasm_typed_funcref, experimental_wasm_reftypes)
 
 DEFINE_BOOL(wasm_gc_js_interop, false, "experimental WasmGC-JS interop")
 

src/wasm/baseline/liftoff-compiler.cc

@@ -586,7 +586,7 @@ class LiftoffCompiler {
       case kRttWithDepth:
       case kI8:
       case kI16:
-        bailout_reason = kRefTypes;
+        bailout_reason = kGC;
         break;
       default:
         UNREACHABLE();

src/wasm/c-api.cc

@@ -392,7 +392,6 @@ void Engine::operator delete(void* p) { ::operator delete(p); }
 
 auto Engine::make(own<Config>&& config) -> own<Engine> {
   i::FLAG_expose_gc = true;
-  i::FLAG_experimental_wasm_reftypes = true;
   auto engine = new (std::nothrow) EngineImpl;
   if (!engine) return own<Engine>();
   engine->platform = v8::platform::NewDefaultPlatform();
@@ -1931,7 +1930,6 @@ auto Table::make(Store* store_abs, const TableType* type, const Ref* ref)
       break;
     case ANYREF:
       // See Engine::make().
-      DCHECK(i::wasm::WasmFeatures::FromFlags().has_reftypes());
       i_type = i::wasm::kWasmExternRef;
       break;
     default:

src/wasm/function-body-decoder-impl.h

@@ -183,21 +183,6 @@ void DecodeError(Decoder* decoder, const char* str) {
 
 namespace value_type_reader {
 
-V8_INLINE WasmFeature feature_for_heap_type(HeapType heap_type) {
-  switch (heap_type.representation()) {
-    case HeapType::kFunc:
-    case HeapType::kExtern:
-      return WasmFeature::kFeature_reftypes;
-    case HeapType::kEq:
-    case HeapType::kI31:
-    case HeapType::kData:
-    case HeapType::kAny:
-      return WasmFeature::kFeature_gc;
-    case HeapType::kBottom:
-      UNREACHABLE();
-  }
-}
-
 // If {module} is not null, the read index will be checked against the module's
 // type capacity.
 template <Decoder::ValidateFlag validate>
@@ -215,29 +200,26 @@ HeapType read_heap_type(Decoder* decoder, const byte* pc,
     uint8_t uint_7_mask = 0x7F;
     uint8_t code = static_cast<ValueTypeCode>(heap_index) & uint_7_mask;
     switch (code) {
-      case kFuncRefCode:
       case kEqRefCode:
-      case kExternRefCode:
       case kI31RefCode:
       case kDataRefCode:
-      case kAnyRefCode: {
-        HeapType result = HeapType::from_code(code);
-        if (!VALIDATE(enabled.contains(feature_for_heap_type(result)))) {
+      case kAnyRefCode:
+        if (!VALIDATE(enabled.has_gc())) {
           DecodeError<validate>(
               decoder, pc,
-              "invalid heap type '%s', enable with --experimental-wasm-%s",
-              result.name().c_str(),
-              WasmFeatures::name_for_feature(feature_for_heap_type(result)));
+              "invalid heap type '%s', enable with --experimental-wasm-gc",
+              HeapType::from_code(code).name().c_str());
           return HeapType(HeapType::kBottom);
         }
-        return result;
-      }
+        V8_FALLTHROUGH;
+      case kExternRefCode:
+      case kFuncRefCode:
+        return HeapType::from_code(code);
       default:
         DecodeError<validate>(decoder, pc, "Unknown heap type %" PRId64,
                               heap_index);
         return HeapType(HeapType::kBottom);
     }
-    UNREACHABLE();
   } else {
     if (!VALIDATE(enabled.has_typed_funcref())) {
       DecodeError<validate>(decoder, pc,
@@ -281,26 +263,25 @@ ValueType read_value_type(Decoder* decoder, const byte* pc,
   }
   ValueTypeCode code = static_cast<ValueTypeCode>(val);
   switch (code) {
-    case kFuncRefCode:
     case kEqRefCode:
-    case kExternRefCode:
     case kI31RefCode:
     case kDataRefCode:
-    case kAnyRefCode: {
-      HeapType heap_type = HeapType::from_code(code);
-      Nullability nullability = code == kI31RefCode || code == kDataRefCode
-                                    ? kNonNullable
-                                    : kNullable;
-      ValueType result = ValueType::Ref(heap_type, nullability);
-      if (!VALIDATE(enabled.contains(feature_for_heap_type(heap_type)))) {
+    case kAnyRefCode:
+      if (!VALIDATE(enabled.has_gc())) {
         DecodeError<validate>(
             decoder, pc,
-            "invalid value type '%s', enable with --experimental-wasm-%s",
-            result.name().c_str(),
-            WasmFeatures::name_for_feature(feature_for_heap_type(heap_type)));
+            "invalid value type '%sref', enable with --experimental-wasm-gc",
+            HeapType::from_code(code).name().c_str());
         return kWasmBottom;
       }
-      return result;
+      V8_FALLTHROUGH;
+    case kExternRefCode:
+    case kFuncRefCode: {
+      HeapType heap_type = HeapType::from_code(code);
+      Nullability nullability = code == kI31RefCode || code == kDataRefCode
+                                    ? kNonNullable
+                                    : kNullable;
+      return ValueType::Ref(heap_type, nullability);
     }
     case kI32Code:
       return kWasmI32;
@@ -1354,13 +1335,6 @@ class WasmDecoder : public Decoder {
 
   bool Validate(const byte* pc, CallIndirectImmediate<validate>& imm) {
     if (!ValidateSignature(pc, imm.sig_imm)) return false;
-    // call_indirect is not behind the reftypes feature, so we have to impose
-    // the older format if reftypes is not enabled.
-    if (!VALIDATE((imm.table_imm.index == 0 && imm.table_imm.length == 1) ||
-                  this->enabled_.has_reftypes())) {
-      DecodeError(pc + imm.sig_imm.length, "expected table index 0, found %u",
-                  imm.table_imm.index);
-    }
     if (!ValidateTable(pc + imm.sig_imm.length, imm.table_imm)) {
       return false;
     }
@@ -1538,6 +1512,9 @@ class WasmDecoder : public Decoder {
   // The following Validate* functions all validate an IndexImmediate, albeit
   // differently according to context.
   bool ValidateTable(const byte* pc, IndexImmediate<validate>& imm) {
+    if (imm.index > 0 || imm.length > 1) {
+      this->detected_->Add(kFeature_reftypes);
+    }
     if (!VALIDATE(imm.index < module_->tables.size())) {
       DecodeError(pc, "invalid table index: %u", imm.index);
       return false;
@@ -2941,7 +2918,7 @@ class WasmFullDecoder : public WasmDecoder<validate, decoding_mode> {
   }
 
   DECODE(SelectWithType) {
-    CHECK_PROTOTYPE_OPCODE(reftypes);
+    this->detected_->Add(kFeature_reftypes);
     SelectTypeImmediate<validate> imm(this->enabled_, this, this->pc_ + 1,
                                       this->module_);
     if (this->failed()) return 0;
@@ -3075,7 +3052,7 @@ class WasmFullDecoder : public WasmDecoder<validate, decoding_mode> {
   }
 
   DECODE(RefNull) {
-    CHECK_PROTOTYPE_OPCODE(reftypes);
+    this->detected_->Add(kFeature_reftypes);
     HeapTypeImmediate<validate> imm(this->enabled_, this, this->pc_ + 1,
                                     this->module_);
     if (!VALIDATE(this->ok())) return 0;
@@ -3087,7 +3064,7 @@ class WasmFullDecoder : public WasmDecoder<validate, decoding_mode> {
   }
 
   DECODE(RefIsNull) {
-    CHECK_PROTOTYPE_OPCODE(reftypes);
+    this->detected_->Add(kFeature_reftypes);
     Value value = Peek(0, 0);
     Value result = CreateValue(kWasmI32);
     switch (value.type.kind()) {
@@ -3116,7 +3093,7 @@ class WasmFullDecoder : public WasmDecoder<validate, decoding_mode> {
   }
 
   DECODE(RefFunc) {
-    CHECK_PROTOTYPE_OPCODE(reftypes);
+    this->detected_->Add(kFeature_reftypes);
     IndexImmediate<validate> imm(this, this->pc_ + 1, "function index");
     if (!this->ValidateFunction(this->pc_ + 1, imm)) return 0;
     HeapType heap_type(this->enabled_.has_typed_funcref()
@@ -3221,7 +3198,7 @@ class WasmFullDecoder : public WasmDecoder<validate, decoding_mode> {
   }
 
   DECODE(TableGet) {
-    CHECK_PROTOTYPE_OPCODE(reftypes);
+    this->detected_->Add(kFeature_reftypes);
     IndexImmediate<validate> imm(this, this->pc_ + 1, "table index");
     if (!this->ValidateTable(this->pc_ + 1, imm)) return 0;
     Value index = Peek(0, 0, kWasmI32);
@@ -3233,7 +3210,7 @@ class WasmFullDecoder : public WasmDecoder<validate, decoding_mode> {
   }
 
   DECODE(TableSet) {
-    CHECK_PROTOTYPE_OPCODE(reftypes);
+    this->detected_->Add(kFeature_reftypes);
     IndexImmediate<validate> imm(this, this->pc_ + 1, "table index");
     if (!this->ValidateTable(this->pc_ + 1, imm)) return 0;
     Value value = Peek(0, 1, this->module_->tables[imm.index].type);
@@ -3419,7 +3396,7 @@ class WasmFullDecoder : public WasmDecoder<validate, decoding_mode> {
         this->pc_, &opcode_length, "numeric index");
     if (full_opcode == kExprTableGrow || full_opcode == kExprTableSize ||
         full_opcode == kExprTableFill) {
-      CHECK_PROTOTYPE_OPCODE(reftypes);
+      this->detected_->Add(kFeature_reftypes);
     }
     trace_msg->AppendOpcode(full_opcode);
     return DecodeNumericOpcode(full_opcode, opcode_length);

src/wasm/module-decoder.cc

@@ -722,7 +722,6 @@ class ModuleDecoderImpl : public Decoder {
         }
         case kExternalTable: {
           // ===== Imported table ==============================================
-          if (!AddTable(module_.get())) break;
           import->index = static_cast<uint32_t>(module_->tables.size());
           module_->num_imported_tables++;
           module_->tables.emplace_back();
@@ -818,14 +817,9 @@ class ModuleDecoderImpl : public Decoder {
   }
 
   void DecodeTableSection() {
-    // TODO(ahaas): Set the correct limit to {kV8MaxWasmTables} once the
-    // implementation of ExternRef landed.
-    uint32_t max_count =
-        enabled_features_.has_reftypes() ? 100000 : kV8MaxWasmTables;
-    uint32_t table_count = consume_count("table count", max_count);
+    uint32_t table_count = consume_count("table count", kV8MaxWasmTables);
 
     for (uint32_t i = 0; ok() && i < table_count; i++) {
-      if (!AddTable(module_.get())) break;
       module_->tables.emplace_back();
       WasmTable* table = &module_->tables.back();
       const byte* type_position = pc();
@@ -1536,16 +1530,6 @@ class ModuleDecoderImpl : public Decoder {
     return static_cast<uint32_t>(ptr - start_) + buffer_offset_;
   }
 
-  bool AddTable(WasmModule* module) {
-    if (enabled_features_.has_reftypes()) return true;
-    if (module->tables.size() > 0) {
-      error("At most one table is supported");
-      return false;
-    } else {
-      return true;
-    }
-  }
-
   bool AddMemory(WasmModule* module) {
     if (module->has_memory) {
       error("At most one memory is supported");
@@ -1854,27 +1838,13 @@ class ModuleDecoderImpl : public Decoder {
   }
 
   // Reads a reference type for tables and element segment headers.
-  // Unless extensions are enabled, only funcref is allowed.
-  // TODO(manoskouk): Replace this with consume_value_type (and checks against
-  //                  the returned type at callsites as needed) once the
-  //                  'reftypes' proposal is standardized.
   ValueType consume_reference_type() {
-    if (!enabled_features_.has_reftypes()) {
-      uint8_t ref_type = consume_u8("reference type");
-      if (ref_type != kFuncRefCode) {
-        error(pc_ - 1,
-              "invalid table type. Consider using experimental flags.");
-        return kWasmBottom;
-      }
-      return kWasmFuncRef;
-    } else {
-      const byte* position = pc();
-      ValueType result = consume_value_type();
-      if (!result.is_reference()) {
-        error(position, "expected reference type");
-      }
-      return result;
+    const byte* position = pc();
+    ValueType result = consume_value_type();
+    if (!result.is_reference()) {
+      error(position, "expected reference type");
     }
+    return result;
   }
 
   const FunctionSig* consume_sig(Zone* zone) {
@@ -1969,12 +1939,6 @@ class ModuleDecoderImpl : public Decoder {
                                       ? WasmElemSegment::kStatusDeclarative
                                       : WasmElemSegment::kStatusPassive
                                 : WasmElemSegment::kStatusActive;
-    if (status == WasmElemSegment::kStatusDeclarative &&
-        !enabled_features_.has_reftypes()) {
-      error(
-          "Declarative element segments require --experimental-wasm-reftypes");
-      return {};
-    }
     const bool is_active = status == WasmElemSegment::kStatusActive;
 
     *expressions_as_elements = flag & kExpressionsAsElementsMask;
@@ -2093,9 +2057,8 @@ class ModuleDecoderImpl : public Decoder {
     return index;
   }
 
-  // TODO(manoskouk): When reftypes lands, consider if we can implement this
-  // with consume_init_expr(). It will require changes in module-instantiate.cc,
-  // in {LoadElemSegmentImpl}.
+  // TODO(manoskouk): Implement this with consume_init_expr(). It will require
+  // changes in module-instantiate.cc, in {LoadElemSegmentImpl}.
   WasmElemSegment::Entry consume_element_expr() {
     uint8_t opcode = consume_u8("element opcode");
     if (failed()) return {};
@@ -2115,13 +2078,6 @@ class ModuleDecoderImpl : public Decoder {
         return {WasmElemSegment::Entry::kRefFuncEntry, index};
       }
       case kExprGlobalGet: {
-        if (!enabled_features_.has_reftypes()) {
-          errorf(
-              "Unexpected opcode 0x%x in element. Enable with "
-              "--experimental-wasm-reftypes",
-              kExprGlobalGet);
-          return {};
-        }
         uint32_t index = this->consume_u32v("global index");
         if (failed()) return {};
         if (index >= module_->globals.size()) {

src/wasm/wasm-constants.h

@@ -24,7 +24,7 @@ constexpr uint32_t kWasmVersion = 0x01;
 
 // Binary encoding of value and heap types.
 enum ValueTypeCode : uint8_t {
-  // Current wasm types
+  // Current value types
   kVoidCode = 0x40,
   kI32Code = 0x7f,
   kI64Code = 0x7e,
@@ -32,11 +32,13 @@ enum ValueTypeCode : uint8_t {
   kF64Code = 0x7c,
   // Simd proposal
   kS128Code = 0x7b,
-  // reftypes, typed-funcref, and GC proposals
+  // GC proposal packed types
   kI8Code = 0x7a,
   kI16Code = 0x79,
+  // Current reference types
   kFuncRefCode = 0x70,
   kExternRefCode = 0x6f,
+  // typed-funcref and GC proposal types
   kAnyRefCode = 0x6e,
   kEqRefCode = 0x6d,
   kOptRefCode = 0x6c,

src/wasm/wasm-feature-flags.h

@@ -98,13 +98,6 @@
   /* Shipped in v9.1 * */                                                      \
   V(simd, "SIMD opcodes", true)                                                \
                                                                                \
-  /* Reference Types, a.k.a. reftypes proposal. */                             \
-  /* https://github.com/WebAssembly/reference-types */                         \
-  /* V8 side owner: ahaas */                                                   \
-  /* Staged in v7.8. */                                                        \
-  /* Shipped in v9.6 * */                                                      \
-  V(reftypes, "reference type opcodes", true)                                  \
-                                                                               \
   /* Threads proposal. */                                                      \
   /* https://github.com/webassembly/threads */                                 \
   /* NOTE: This is enabled via chromium flag on desktop systems since v7.4, */ \

src/wasm/wasm-features.cc

@@ -16,8 +16,11 @@ WasmFeatures WasmFeatures::FromFlags() {
   WasmFeatures features = WasmFeatures::None();
 #define FLAG_REF(feat, ...) \
   if (FLAG_experimental_wasm_##feat) features.Add(kFeature_##feat);
-  FOREACH_WASM_FEATURE(FLAG_REF)
+  FOREACH_WASM_FEATURE_FLAG(FLAG_REF)
 #undef FLAG_REF
+#define NON_FLAG_REF(feat, ...) features.Add(kFeature_##feat);
+  FOREACH_WASM_NON_FLAG_FEATURE(NON_FLAG_REF)
+#undef NON_FLAG_REF
   return features;
 }
 

src/wasm/wasm-features.h

@@ -14,8 +14,14 @@
 #include "src/base/macros.h"
 #include "src/wasm/wasm-feature-flags.h"
 
+// Features that are always enabled and do not have a flag.
+#define FOREACH_WASM_NON_FLAG_FEATURE(V) \
+  V(reftypes, "reference type opcodes", true)
+
 // All features, including features that do not have flags.
-#define FOREACH_WASM_FEATURE FOREACH_WASM_FEATURE_FLAG
+#define FOREACH_WASM_FEATURE(V) \
+  FOREACH_WASM_FEATURE_FLAG(V)  \
+  FOREACH_WASM_NON_FLAG_FEATURE(V)
 
 namespace v8 {
 namespace internal {
@@ -58,6 +64,8 @@ class WasmFeatures : public base::EnumSet<WasmFeature> {
   static inline constexpr WasmFeatures All();
   static inline constexpr WasmFeatures None();
   static inline constexpr WasmFeatures ForAsmjs();
+  // Retuns optional features that are enabled by flags, plus features that are
+  // not enabled by a flag and are always on.
   static WasmFeatures FromFlags();
   static V8_EXPORT_PRIVATE WasmFeatures FromIsolate(Isolate*);
   static V8_EXPORT_PRIVATE WasmFeatures FromContext(Isolate*,

src/wasm/wasm-js.cc

@@ -1158,8 +1158,7 @@ void WebAssemblyTable(const v8::FunctionCallbackInfo<v8::Value>& args) {
       // With the type reflection proposal, "funcref" replaces "anyfunc",
       // and anyfunc just becomes an alias for "funcref".
       type = i::wasm::kWasmFuncRef;
-    } else if (enabled_features.has_reftypes() &&
-               string->StringEquals(v8_str(isolate, "externref"))) {
+    } else if (string->StringEquals(v8_str(isolate, "externref"))) {
       type = i::wasm::kWasmExternRef;
     } else {
       thrower.TypeError(
@@ -1331,16 +1330,14 @@ bool GetValueType(Isolate* isolate, MaybeLocal<Value> maybe,
     *type = i::wasm::kWasmI64;
   } else if (string->StringEquals(v8_str(isolate, "f64"))) {
     *type = i::wasm::kWasmF64;
-  } else if (enabled_features.has_reftypes() &&
-             string->StringEquals(v8_str(isolate, "externref"))) {
+  } else if (string->StringEquals(v8_str(isolate, "externref"))) {
     *type = i::wasm::kWasmExternRef;
   } else if (enabled_features.has_type_reflection() &&
              string->StringEquals(v8_str(isolate, "funcref"))) {
     // The type reflection proposal renames "anyfunc" to "funcref", and makes
     // "anyfunc" an alias of "funcref".
     *type = i::wasm::kWasmFuncRef;
-  } else if (enabled_features.has_reftypes() &&
-             string->StringEquals(v8_str(isolate, "anyfunc"))) {
+  } else if (string->StringEquals(v8_str(isolate, "anyfunc"))) {
     // The JS api spec uses 'anyfunc' instead of 'funcref'.
     *type = i::wasm::kWasmFuncRef;
   } else if (enabled_features.has_gc() &&

src/wasm/wasm-limits.h

@@ -52,7 +52,7 @@ constexpr size_t kV8MaxWasmFunctionBrTableSize = 65520;
 // Don't use this limit directly, but use the value of FLAG_wasm_max_table_size.
 constexpr size_t kV8MaxWasmTableSize = 10000000;
 constexpr size_t kV8MaxWasmTableInitEntries = 10000000;
-constexpr size_t kV8MaxWasmTables = 1;
+constexpr size_t kV8MaxWasmTables = 100000;
 constexpr size_t kV8MaxWasmMemories = 1;
 
 // GC proposal. These limits are not standardized yet.

src/wasm/wasm-module-builder.cc

@@ -785,59 +785,40 @@ void WasmModuleBuilder::WriteTo(ZoneBuffer* buffer) const {
     buffer->write_size(element_segments_.size());
     for (const WasmElemSegment& segment : element_segments_) {
       bool is_active = segment.status == WasmElemSegment::kStatusActive;
-      // If this segment is expressible in the backwards-compatible syntax
-      // (before reftypes proposal), we should emit it in that syntax.
-      // This is the case if the segment is active and all entries are function
-      // references. Note that this is currently the only path that allows
-      // kRelativeToImports function indexing mode.
-      // TODO(manoskouk): Remove this logic once reftypes has shipped.
-      bool backwards_compatible =
-          is_active && segment.table_index == 0 &&
-          std::all_of(
-              segment.entries.begin(), segment.entries.end(), [](auto& entry) {
-                return entry.kind ==
-                       WasmModuleBuilder::WasmElemSegment::Entry::kRefFuncEntry;
-              });
-      if (backwards_compatible) {
-        buffer->write_u8(0);
+      // We pick the most general syntax, i.e., we always explicitly emit the
+      // table index and the type, and use the expressions-as-elements syntax.
+      // The initial byte is one of 0x05, 0x06, and 0x07.
+      uint8_t kind_mask =
+          segment.status == WasmElemSegment::kStatusActive
+              ? 0b10
+              : segment.status == WasmElemSegment::kStatusDeclarative ? 0b11
+                                                                      : 0b01;
+      uint8_t expressions_as_elements_mask = 0b100;
+      buffer->write_u8(kind_mask | expressions_as_elements_mask);
+      if (is_active) {
+        buffer->write_u32v(segment.table_index);
         WriteInitializerExpression(buffer, segment.offset, segment.type);
-        buffer->write_size(segment.entries.size());
-        for (const WasmElemSegment::Entry entry : segment.entries) {
-          buffer->write_u32v(
-              segment.indexing_mode == WasmElemSegment::kRelativeToImports
-                  ? entry.index
-                  : entry.index +
-                        static_cast<uint32_t>(function_imports_.size()));
-        }
-      } else {
-        DCHECK_EQ(segment.indexing_mode, WasmElemSegment::kRelativeToImports);
-        // If we pick the general syntax, we always explicitly emit the table
-        // index and the type, and use the expressions-as-elements syntax. I.e.
-        // the initial byte is one of 0x05, 0x06, and 0x07.
-        uint8_t kind_mask =
-            segment.status == WasmElemSegment::kStatusActive
-                ? 0b10
-                : segment.status == WasmElemSegment::kStatusDeclarative ? 0b11
-                                                                        : 0b01;
-        uint8_t expressions_as_elements_mask = 0b100;
-        buffer->write_u8(kind_mask | expressions_as_elements_mask);
-        if (is_active) {
-          buffer->write_u32v(segment.table_index);
-          WriteInitializerExpression(buffer, segment.offset, segment.type);
-        }
-        WriteValueType(buffer, segment.type);
-        buffer->write_size(segment.entries.size());
-        for (const WasmElemSegment::Entry entry : segment.entries) {
-          uint8_t opcode =
-              entry.kind == WasmElemSegment::Entry::kGlobalGetEntry
-                  ? kExprGlobalGet
-                  : entry.kind == WasmElemSegment::Entry::kRefFuncEntry
-                        ? kExprRefFunc
-                        : kExprRefNull;
-          buffer->write_u8(opcode);
-          buffer->write_u32v(entry.index);
-          buffer->write_u8(kExprEnd);
-        }
+      }
+      WriteValueType(buffer, segment.type);
+      buffer->write_size(segment.entries.size());
+      for (const WasmElemSegment::Entry entry : segment.entries) {
+        uint8_t opcode =
+            entry.kind == WasmElemSegment::Entry::kGlobalGetEntry
+                ? kExprGlobalGet
+                : entry.kind == WasmElemSegment::Entry::kRefFuncEntry
+                      ? kExprRefFunc
+                      : kExprRefNull;
+        bool needs_function_offset =
+            segment.indexing_mode ==
+                WasmElemSegment::kRelativeToDeclaredFunctions &&
+            entry.kind == WasmElemSegment::Entry::kRefFuncEntry;
+        uint32_t index =
+            entry.index + (needs_function_offset
+                               ? static_cast<uint32_t>(function_imports_.size())
+                               : 0);
+        buffer->write_u8(opcode);
+        buffer->write_u32v(index);
+        buffer->write_u8(kExprEnd);
       }
     }
     FixupSection(buffer, start);

test/cctest/wasm/test-gc.cc

@@ -33,7 +33,6 @@ class WasmGCTester {
   explicit WasmGCTester(
       TestExecutionTier execution_tier = TestExecutionTier::kTurbofan)
       : flag_gc(&v8::internal::FLAG_experimental_wasm_gc, true),
-        flag_reftypes(&v8::internal::FLAG_experimental_wasm_reftypes, true),
         flag_typedfuns(&v8::internal::FLAG_experimental_wasm_typed_funcref,
                        true),
         flag_liftoff(&v8::internal::FLAG_liftoff,
@@ -176,7 +175,6 @@ class WasmGCTester {
 
  private:
   const FlagScope<bool> flag_gc;
-  const FlagScope<bool> flag_reftypes;
   const FlagScope<bool> flag_typedfuns;
   const FlagScope<bool> flag_liftoff;
   const FlagScope<bool> flag_liftoff_only;

test/cctest/wasm/test-run-wasm-bulk-memory.cc

@@ -359,17 +359,14 @@ WASM_COMPILED_EXEC_TEST(TableCopyInboundsFrom0To0) {
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyInboundsFrom3To0) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyInbounds(execution_tier, 3, 0);
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyInboundsFrom5To9) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyInbounds(execution_tier, 5, 9);
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyInboundsFrom6To6) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyInbounds(execution_tier, 6, 6);
 }
 
@@ -466,11 +463,9 @@ WASM_COMPILED_EXEC_TEST(TableInitElems0) {
   TestTableInitElems(execution_tier, 0);
 }
 WASM_COMPILED_EXEC_TEST(TableInitElems7) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableInitElems(execution_tier, 7);
 }
 WASM_COMPILED_EXEC_TEST(TableInitElems9) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableInitElems(execution_tier, 9);
 }
 
@@ -543,14 +538,8 @@ void TestTableInitOob(TestExecutionTier execution_tier, int table_index) {
 }
 
 WASM_COMPILED_EXEC_TEST(TableInitOob0) { TestTableInitOob(execution_tier, 0); }
-WASM_COMPILED_EXEC_TEST(TableInitOob7) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
-  TestTableInitOob(execution_tier, 7);
-}
-WASM_COMPILED_EXEC_TEST(TableInitOob9) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
-  TestTableInitOob(execution_tier, 9);
-}
+WASM_COMPILED_EXEC_TEST(TableInitOob7) { TestTableInitOob(execution_tier, 7); }
+WASM_COMPILED_EXEC_TEST(TableInitOob9) { TestTableInitOob(execution_tier, 9); }
 
 void TestTableCopyElems(TestExecutionTier execution_tier, int table_dst,
                         int table_src) {
@@ -619,17 +608,14 @@ WASM_COMPILED_EXEC_TEST(TableCopyElemsFrom0To0) {
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyElemsFrom3To0) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyElems(execution_tier, 3, 0);
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyElemsFrom5To9) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyElems(execution_tier, 5, 9);
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyElemsFrom6To6) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyElems(execution_tier, 6, 6);
 }
 
@@ -693,17 +679,14 @@ WASM_COMPILED_EXEC_TEST(TableCopyCallsTo0From0) {
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyCallsTo3From0) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyCalls(execution_tier, 3, 0);
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyCallsTo5From9) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyCalls(execution_tier, 5, 9);
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyCallsTo6From6) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyCalls(execution_tier, 6, 6);
 }
 
@@ -768,17 +751,14 @@ WASM_COMPILED_EXEC_TEST(TableCopyOobWritesFrom0To0) {
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyOobWritesFrom3To0) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyOobWrites(execution_tier, 3, 0);
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyOobWritesFrom5To9) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyOobWrites(execution_tier, 5, 9);
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyOobWritesFrom6To6) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyOobWrites(execution_tier, 6, 6);
 }
 
@@ -826,17 +806,14 @@ WASM_COMPILED_EXEC_TEST(TableCopyOob1From0To0) {
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyOob1From3To0) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyOob1(execution_tier, 3, 0);
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyOob1From5To9) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyOob1(execution_tier, 5, 9);
 }
 
 WASM_COMPILED_EXEC_TEST(TableCopyOob1From6To6) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   TestTableCopyOob1(execution_tier, 6, 6);
 }
 

test/cctest/wasm/test-run-wasm-exceptions.cc

@@ -565,7 +565,6 @@ WASM_EXEC_TEST(TryCatchTrapRemByZero) {
 }
 
 WASM_EXEC_TEST(TryCatchTrapTableFill) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   int table_index = 0;
   int length = 10;  // OOB.
   int start = 10;   // OOB.

test/cctest/wasm/test-run-wasm.cc

@@ -801,7 +801,6 @@ WASM_EXEC_TEST(Select_s128_parameters) {
 }
 
 WASM_EXEC_TEST(SelectWithType_float_parameters) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   WasmRunner<float, float, float, int32_t> r(execution_tier);
   BUILD(r,
         WASM_SELECT_F(WASM_LOCAL_GET(0), WASM_LOCAL_GET(1), WASM_LOCAL_GET(2)));
@@ -819,7 +818,6 @@ WASM_EXEC_TEST(Select) {
 }
 
 WASM_EXEC_TEST(SelectWithType) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   WasmRunner<int32_t, int32_t> r(execution_tier);
   // return select(11, 22, a);
   BUILD(r, WASM_SELECT_I(WASM_I32V_1(11), WASM_I32V_1(22), WASM_LOCAL_GET(0)));
@@ -841,7 +839,6 @@ WASM_EXEC_TEST(Select_strict1) {
 }
 
 WASM_EXEC_TEST(SelectWithType_strict1) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   WasmRunner<int32_t, int32_t> r(execution_tier);
   // select(a=0, a=1, a=2); return a
   BUILD(r,
@@ -866,7 +863,6 @@ WASM_EXEC_TEST(Select_strict2) {
 }
 
 WASM_EXEC_TEST(SelectWithType_strict2) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   WasmRunner<int32_t, int32_t> r(execution_tier);
   r.AllocateLocal(kWasmI32);
   r.AllocateLocal(kWasmI32);
@@ -894,7 +890,6 @@ WASM_EXEC_TEST(Select_strict3) {
 }
 
 WASM_EXEC_TEST(SelectWithType_strict3) {
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   WasmRunner<int32_t, int32_t> r(execution_tier);
   r.AllocateLocal(kWasmI32);
   r.AllocateLocal(kWasmI32);

test/fuzzer/wasm-compile.cc

@@ -2581,7 +2581,6 @@ class WasmCompileFuzzer : public WasmExecutionFuzzer {
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   constexpr bool require_valid = true;
-  EXPERIMENTAL_FLAG_SCOPE(reftypes);
   EXPERIMENTAL_FLAG_SCOPE(typed_funcref);
   EXPERIMENTAL_FLAG_SCOPE(gc);
   EXPERIMENTAL_FLAG_SCOPE(simd);

test/inspector/debugger/wasm-externref-global.js

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --experimental-wasm-reftypes
-
 utils.load('test/inspector/wasm-inspector-test.js');
 
 let {session, contextGroup, Protocol} =

test/inspector/debugger/wasm-gc-in-debug-break.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --experimental-wasm-reftypes --expose-gc
+// Flags: --expose-gc
 utils.load('test/inspector/wasm-inspector-test.js');
 
 let {session, contextGroup, Protocol} =

test/mjsunit/regress/wasm/regress-1185464.js

@@ -3,7 +3,6 @@
 // found in the LICENSE file.
 
 // Flags: --liftoff --no-wasm-tier-up --wasm-tier-mask-for-testing=2
-// Flags: --experimental-wasm-reftypes
 
 d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
 

test/mjsunit/regress/wasm/regress-1200231.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --experimental-wasm-reftypes --trace-turbo-graph
+// Flags: --trace-turbo-graph
 
 d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
 

test/mjsunit/regress/wasm/regress-7785.js

@@ -4,7 +4,7 @@
 
 // The test needs --wasm-tier-up because we can't serialize and deserialize
 // Liftoff code.
-// Flags: --allow-natives-syntax --experimental-wasm-reftypes --wasm-tier-up
+// Flags: --allow-natives-syntax --wasm-tier-up
 
 d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
 

test/mjsunit/regress/wasm/regress-964607.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm --experimental-wasm-reftypes
+// Flags: --expose-wasm
 
 d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
 

test/mjsunit/regress/wasm/regress-crbug-1172912.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --experimental-wasm-reftypes --experimental-wasm-typed-funcref
+// Flags: --experimental-wasm-typed-funcref
 
 let raw = new Uint8Array([
   0x00, 0x61, 0x73, 0x6d,  // wasm magic

test/mjsunit/wasm/anyfunc.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm --experimental-wasm-reftypes --expose-gc
+// Flags: --expose-wasm --expose-gc
 
 d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
 

test/mjsunit/wasm/exceptions-api.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --experimental-wasm-eh --experimental-wasm-reftypes
+// Flags: --experimental-wasm-eh
 
 load("test/mjsunit/wasm/wasm-module-builder.js");
 

test/mjsunit/wasm/exceptions-externref.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --experimental-wasm-eh --experimental-wasm-reftypes --allow-natives-syntax
+// Flags: --experimental-wasm-eh --allow-natives-syntax
 
 d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
 d8.file.execute("test/mjsunit/wasm/exceptions-utils.js");

test/mjsunit/wasm/externref-globals-liftoff.js

@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --experimental-wasm-reftypes --expose-gc --liftoff
-// Flags: --no-wasm-tier-up --experimental-liftoff-extern-ref
+// Flags: --expose-gc --liftoff --no-wasm-tier-up
 
 d8.file.execute("test/mjsunit/wasm/externref-globals.js");

test/mjsunit/wasm/externref-globals.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --experimental-wasm-reftypes --expose-gc
+// Flags: --expose-gc
 
 d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
 

test/mjsunit/wasm/externref-liftoff.js

@@ -2,8 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm --experimental-wasm-reftypes --expose-gc --liftoff
-// Flags: --no-wasm-tier-up --experimental-liftoff-extern-ref
+// Flags: --expose-wasm --expose-gc --liftoff --no-wasm-tier-up
 // Flags: --allow-natives-syntax
 
 d8.file.execute("test/mjsunit/wasm/externref.js");

test/mjsunit/wasm/externref.js

@@ -2,8 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm --experimental-wasm-reftypes --expose-gc
-// Flags: --allow-natives-syntax
+// Flags: --expose-wasm --expose-gc --allow-natives-syntax
 
 d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
 

test/mjsunit/wasm/indirect-call-non-zero-table.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm --experimental-wasm-reftypes --experimental-wasm-return-call
+// Flags: --expose-wasm --experimental-wasm-return-call
 
 d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
 

test/mjsunit/wasm/multi-table-element-section.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm --experimental-wasm-reftypes
+// Flags: --expose-wasm
 
 d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
 

test/mjsunit/wasm/table-access-liftoff.js

@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --experimental-wasm-reftypes --liftoff
-// Flags: --no-wasm-tier-up --liftoff-extern-ref
+// Flags: --liftoff --no-wasm-tier-up
 
 d8.file.execute("test/mjsunit/wasm/table-access.js");

test/mjsunit/wasm/table-access.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm --experimental-wasm-reftypes
+// Flags: --expose-wasm
 
 d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
 

test/mjsunit/wasm/table-copy-externref.js

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --experimental-wasm-reftypes
-
 d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
 
 let kTableSize = 5;

test/mjsunit/wasm/table-fill.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm --experimental-wasm-reftypes
+// Flags: --expose-wasm
 
 d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
 

test/mjsunit/wasm/table-grow-from-wasm.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm --experimental-wasm-reftypes
+// Flags: --expose-wasm
 
 d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
 

test/mjsunit/wasm/type-reflection-with-externref.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --experimental-wasm-type-reflection --experimental-wasm-reftypes
+// Flags: --experimental-wasm-type-reflection
 
 d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
 
@@ -79,9 +79,6 @@ d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
   assertEquals(fun2, instance.exports.get_global());
 })();
 
-// This is an extension of "type-reflection.js/TestFunctionTableSetAndCall" to
-// multiple table indexes. If --experimental-wasm-reftypes is enabled by default
-// this test case can supersede the other one.
 (function TestFunctionMultiTableSetAndCall() {
   let builder = new WasmModuleBuilder();
   let v1 = 7; let v2 = 9; let v3 = 0.0;

test/mjsunit/wasm/type-reflection.js

@@ -528,29 +528,6 @@ d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
   });
 })();
 
-(function TestFunctionTableSetAndCall() {
-  let builder = new WasmModuleBuilder();
-  let fun1 = new WebAssembly.Function({parameters:[], results:["i32"]}, _ => 7);
-  let fun2 = new WebAssembly.Function({parameters:[], results:["i32"]}, _ => 9);
-  let fun3 = new WebAssembly.Function({parameters:[], results:["f64"]}, _ => 0);
-  let table = new WebAssembly.Table({element: "anyfunc", initial: 2});
-  let table_index = builder.addImportedTable("m", "table", 2);
-  let sig_index = builder.addType(kSig_i_v);
-  table.set(0, fun1);
-  builder.addFunction('main', kSig_i_i)
-      .addBody([
-        kExprLocalGet, 0,
-        kExprCallIndirect, sig_index, table_index
-      ])
-      .exportFunc();
-  let instance = builder.instantiate({ m: { table: table }});
-  assertEquals(7, instance.exports.main(0));
-  table.set(1, fun2);
-  assertEquals(9, instance.exports.main(1));
-  table.set(1, fun3);
-  assertTraps(kTrapFuncSigMismatch, () => instance.exports.main(1));
-})();
-
 (function TestFunctionTableSetI64() {
   let builder = new WasmModuleBuilder();
   let fun = new WebAssembly.Function({parameters:[], results:["i64"]}, _ => 0n);

test/wasm-spec-tests/testcfg.py

@@ -47,7 +47,7 @@ class TestCase(testcase.D8TestCase):
     for proposal in proposal_flags:
       if os.sep.join(['proposals', proposal['name']]) in self.path:
         return proposal['flags']
-    return ['--experimental-wasm-reftypes']
+    return []
 
 
 def GetSuite(*args, **kwargs):