AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[wasm][asm2wasm] Fixes a bug in 8-bit heap view accesses.

Browse Source 
The bug was caused when validating expressions

X >> 0

for indexing into 8-bit heap views. If X was not an intish, the 'normal'
validation path would fail. That, however, left the type of X registered
in the AsmTyper::node_types_ member.

Later, in the 'lenient' code path for 8-bit views, the entire X >> 0
expression would be validated, which would cause X to be validated
again, at which point AsmTyper::SetTypeOf() would DCHECK because the
supplied node already had a type associated with it.

The fix was to simply FAIL() when X is not an intish. This is safe
because if X is not an intish, then

Validate(>>, !intish, FixNum)

will also fail.

BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=628803
BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST= cctest/asmjs/test-asm-typer.cc
LOG= N

Review-Url: https://codereview.chromium.org/2181723002
Cr-Commit-Position: refs/heads/master@{#38053}
This commit is contained in:
jpp 2016-07-26 07:03:02 -07:00 committed by Commit bot
parent 94606a88e2
commit 060d984c94
2 changed files with 31 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/asmjs/asm-typer.cc
View File

@ -2462,9 +2462,7 @@ AsmType* AsmTyper::ValidateHeapAccess(Property* heap,
}
return obj_type->StoreType();
}
// TODO(jpp): it may be the case that, if type is not an Intish, we could
// fail here instead of letting the validator try using the "leniency"
// rule (i.e., allow unshifted indexes for heap views of 8-bit integers.
FAIL(key_as_binop, "Invalid heap access index.");
}
}

30
test/cctest/asmjs/test-asm-typer.cc
View File

@ -1908,4 +1908,34 @@ TEST(InvalidSourceLayout) {
}
}
// This issue was triggered because of the "lenient" 8-bit heap access code
// path. The canonical heap access index validation fails because __34 is not an
// intish. Then, during the "lenient" code path for accessing elements in 8-bit
// heap views, the __34 node in the indexing expression would be re-tagged, thus
// causing the assertion failure.
TEST(B63099) {
const char* kTests[] = {
"function __f_109(stdlib, __v_36, buffer) {\n"
" 'use asm';\n"
" var __v_34 = new stdlib.Uint8Array(buffer);\n"
" function __f_22() {__v_34[__v_34>>0]|0 + 1 | 0;\n"
" }\n"
"}",
"function __f_109(stdlib, __v_36, buffer) {\n"
" 'use asm';\n"
" var __v_34 = new stdlib.Int8Array(buffer);\n"
" function __f_22() {__v_34[__v_34>>0]|0 + 1 | 0;\n"
" }\n"
"}",
};
for (size_t ii = 0; ii < arraysize(kTests); ++ii) {
if (!ValidationOf(Module(kTests[ii]))
->FailsWithMessage("Invalid heap access index")) {
std::cerr << "Test:\n" << kTests[ii];
CHECK(false);
}
}
}
} // namespace