AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[wasm] Fix return from unreachable code

Browse Source 
We hit a DCHECK in the wasm graph builder because the current SSA
environment is unreachable. We were using the wrong block (the target
block) to do the reachability check.

R=titzer@chromium.org

Bug: chromium:913804
Change-Id: I4cfd3a0c696fb63903a47e4448362626a524340d
Reviewed-on: https://chromium-review.googlesource.com/c/1371566
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58150}
This commit is contained in:
Clemens Hammacher 2018-12-11 12:19:26 +01:00 committed by Commit Bot
parent f68ee6e7e4
commit 573e4120fb
2 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/wasm/function-body-decoder-impl.h
View File

@ -1825,10 +1825,10 @@ class WasmFullDecoder : public WasmDecoder<validate> {
case kExprBr: {
BreakDepthImmediate<validate> imm(this, this->pc_);
if (!this->Validate(this->pc_, imm, control_.size())) break;
Control* c = control_at(imm.depth);
if (imm.depth == control_.size() - 1) {
DoReturn(c, false);
DoReturn(&control_.back(), false);
} else {
Control* c = control_at(imm.depth);
if (!TypeCheckBreak(c)) break;
if (control_.back().reachable()) {
CALL_INTERFACE(Br, c);

17
test/mjsunit/regress/wasm/regress-913804.js Normal file
View File

@ -0,0 +1,17 @@
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load('test/mjsunit/wasm/wasm-constants.js');
load('test/mjsunit/wasm/wasm-module-builder.js');
const builder = new WasmModuleBuilder();
builder.addFunction('main', kSig_v_v).addBody([
kExprLoop, kWasmStmt, // loop
/**/ kExprBr, 0x01, // br depth=1
/**/ kExprBlock, kWasmStmt, // block
/**/ /**/ kExprBr, 0x02, // br depth=2
/**/ /**/ kExprEnd, // end [block]
/**/ kExprEnd // end [loop]
]);
builder.instantiate();