AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Revert "[wasm] Use 64-bit comparison for bounds checks on 64-bit platforms"

Browse Source 
This reverts commit 972d460f4f.

Reason for revert: This CL is not the right solution, and it makes back-merging the right solution more difficult.

Original change's description:
> [wasm] Use 64-bit comparison for bounds checks on 64-bit platforms
> 
> By using 64-bit comparison we make sure that there will be no out of
> memory accesses even if there are stale values in the high word of a
> register.
> 
> R=​titzer@chromium.org
> 
> Change-Id: I2627b15e1598f35cc480d7028031e8de405164ea
> Reviewed-on: https://chromium-review.googlesource.com/721323
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48604}

TBR=titzer@chromium.org,ahaas@chromium.org

Change-Id: I0c15e9d8ac72def2e22543a17366126d90a17918
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/721702
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48628}
This commit is contained in:
Andreas Haas 2017-10-17 10:00:28 +00:00 committed by Commit Bot
parent 4fe179cd7c
commit 1347891dcd
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/compiler/wasm-compiler.cc
View File

@ -3405,9 +3405,10 @@ void WasmGraphBuilder::BoundsCheckMem(MachineType memtype, Node* index,
// The end offset is larger than the smallest memory.
// Dynamically check the end offset against the actual memory size, which
// is not known at compile time.
Node* cond =
graph()->NewNode(jsgraph()->machine()->Uint32LessThanOrEqual(),
jsgraph()->Int32Constant(end_offset), *mem_size_);
Node* cond = graph()->NewNode(
jsgraph()->machine()->Uint32LessThanOrEqual(),
jsgraph()->IntPtrConstant(static_cast<uintptr_t>(end_offset)),
*mem_size_);
TrapIfFalse(wasm::kTrapMemOutOfBounds, cond, position);
} else {
// The end offset is within the bounds of the smallest memory, so only
@ -3427,10 +3428,8 @@ void WasmGraphBuilder::BoundsCheckMem(MachineType memtype, Node* index,
graph()->NewNode(jsgraph()->machine()->Int32Sub(), *mem_size_,
jsgraph()->Int32Constant(end_offset - 1));
const Operator* less = jsgraph()->machine()->Is32()
? jsgraph()->machine()->Uint32LessThan()
: jsgraph()->machine()->Uint64LessThan();
Node* cond = graph()->NewNode(less, index, effective_size);
Node* cond = graph()->NewNode(jsgraph()->machine()->Uint32LessThan(), index,
effective_size);
TrapIfFalse(wasm::kTrapMemOutOfBounds, cond, position);
}