AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[wasm][interpreter] Clear thread in wasm flag on exceptional return

Browse Source 
A stack overflow can be thrown by JSEntryStub, which means the
thread-in-wasm flag will not have the expected value. To accommodate
this, we now clear the flag during exceptional returns if it is set.

Bug: chromium:834624
Change-Id: I8359af79886ab98dfecc2fb39ca19118b7fa38eb
Reviewed-on: https://chromium-review.googlesource.com/1019570
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52891}
This commit is contained in:
Eric Holk 2018-04-27 10:37:07 -07:00 committed by Commit Bot
parent 39f5f79e3c
commit 9286358071
2 changed files with 36 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/wasm/wasm-interpreter.cc
View File

@ -2349,7 +2349,12 @@ class ThreadImpl {
maybe_retval.is_null() ? " with exception" : "");
if (maybe_retval.is_null()) {
DCHECK(!trap_handler::IsThreadInWasm());
// JSEntryStub may through a stack overflow before we actually get to wasm
// code or back to the interpreter, meaning the thread-in-wasm flag won't
// be cleared.
if (trap_handler::IsThreadInWasm()) {
trap_handler::ClearThreadInWasm();
}
return TryHandleException(isolate);
}

30
test/mjsunit/regress/wasm/regress-834624.js Normal file
View File

@ -0,0 +1,30 @@
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --wasm-interpret-all
load("test/mjsunit/wasm/wasm-constants.js");
load("test/mjsunit/wasm/wasm-module-builder.js");
let instance;
(function DoTest() {
function call_main() {
instance.exports.main();
}
let module = new WasmModuleBuilder();
module.addImport('mod', 'func', kSig_v_i);
module.addFunction('main', kSig_v_i)
.addBody([kExprGetLocal, 0, kExprCallFunction, 0])
.exportFunc();
instance = module.instantiate({
mod: {
func: call_main
}
});
try {
instance.exports.main();
} catch (e) {
// ignore
}
})();