AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[wasm] Fix bottom type handling in br-table

Browse Source 
Even in unreachable code, the targets of br_table have to have matching
types.

R=thibaudm@chromium.org

Bug: v8:10556
Change-Id: I2e85df3cb92f7910a6bcb5ac03927c424194660d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2218062
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68148}
This commit is contained in:
Andreas Haas 2020-05-28 12:31:38 +02:00 committed by Commit Bot
parent 57c8f1dabc
commit 641c1a4eff
4 changed files with 11 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/wasm/function-body-decoder-impl.h
View File

@ -3015,8 +3015,16 @@ class WasmFullDecoder : public WasmDecoder<validate> {
for (int i = 0; i < br_arity; ++i) {
if (this->enabled_.has_anyref()) {
// The expected type is the biggest common sub type of all targets.
ValueType type = (*result_types)[i];
(*result_types)[i] =
ValueType::CommonSubType((*result_types)[i], (*merge)[i].type);
if ((*result_types)[i] == kWasmBottom) {
this->errorf(pos,
"inconsistent type in br_table target %u (previous "
"was %s, this one is %s)",
index, type.type_name(), (*merge)[i].type.type_name());
return false;
}
} else {
// All target must have the same signature.
if ((*result_types)[i] != (*merge)[i].type) {

12
test/cctest/wasm/test-run-wasm.cc
View File

@ -1036,18 +1036,6 @@ WASM_EXEC_TEST(BrTable_loop_target) {
CHECK_EQ(1, r.Call(0));
}
WASM_EXEC_TEST(BrTableMeetBottom) {
EXPERIMENTAL_FLAG_SCOPE(anyref);
WasmRunner<int32_t> r(execution_tier);
BUILD(r,
WASM_BLOCK_I(WASM_STMTS(
WASM_BLOCK_F(WASM_STMTS(
WASM_UNREACHABLE, WASM_BR_TABLE(WASM_I32V_1(1), 2, BR_TARGET(0),
BR_TARGET(1), BR_TARGET(1)))),
WASM_DROP, WASM_I32V_1(14))));
CHECK_TRAP(r.Call());
}
WASM_EXEC_TEST(F32ReinterpretI32) {
WasmRunner<int32_t> r(execution_tier);
int32_t* memory =

5
test/mjsunit/regress/wasm/regress-1046472.js
View File

@ -28,6 +28,7 @@ kExprEnd, // @21
builder.addExport('main', 0);
assertThrows(
() => {builder.toModule()}, WebAssembly.CompileError,
'WebAssembly.Module(): Compiling function #0:\"main\" failed: type ' +
'error in merge[0] (expected <bot>, got i32) @+57');
'WebAssembly.Module(): Compiling function #0:\"main\" failed: ' +
'inconsistent type in br_table target 1 (previous was i32, ' +
'this one is f32) @+60');
})();

1
test/wasm-spec-tests/wasm-spec-tests.status
View File

@ -25,7 +25,6 @@
'proposals/reference-types/linking': [FAIL],
'proposals/reference-types/ref_func': [FAIL],
'proposals/reference-types/unreached-invalid': [FAIL],
# TODO(wasm): This test declares a table larger than allowed by the spec.
'table': [FAIL],