AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[wasm-gc][turbofan] Fix node typing in ref.cast optimized path

Browse Source 
Bug: v8:7748
Change-Id: Id886fa4c734bbd826770239ea145630570915749
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3723505
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81355}
This commit is contained in:
Manos Koukoutos 2022-06-24 13:01:37 +00:00 committed by V8 LUCI CQ
parent 1d8a669ee5
commit b20cd0e2a6
2 changed files with 36 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/wasm/graph-builder-interface.cc
View File

@ -486,7 +486,7 @@ class WasmGraphBuildingInterface {
void AssertNull(FullDecoder* decoder, const Value& obj, Value* result) {
builder_->TrapIfFalse(wasm::TrapReason::kTrapIllegalCast,
builder_->IsNull(obj.node), decoder->position());
result->node = obj.node;
Forward(decoder, obj, result);
}
void NopForTestingUnsupportedInLiftoff(FullDecoder* decoder) {}

35
test/mjsunit/regress/wasm/wasm-typer-incompatible-ref-cast.js Normal file
View File

@ -0,0 +1,35 @@
// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --no-liftoff --experimental-wasm-gc
d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
let builder = new WasmModuleBuilder();
let supertype = builder.addStruct([]);
let sub1 = builder.addStruct([makeField(kWasmI32, true)], supertype);
let sub2 = builder.addStruct([makeField(kWasmF64, true)], supertype);
let crash = builder.addFunction("crash", kSig_v_i).exportFunc()
.addLocals(wasmOptRefType(sub1), 1)
.addBody([
kGCPrefix, kExprStructNewDefault, sub1,
kExprLocalSet, 1,
kExprLocalGet, 0,
kExprI32Eqz,
kExprIf, kWasmVoid,
kExprLocalGet, 1,
kGCPrefix, kExprStructGet, sub1, 0,
kExprDrop,
kExprElse,
kExprLocalGet, 1,
kGCPrefix, kExprRefCastStatic, sub2,
kGCPrefix, kExprStructGet, sub2, 0,
kExprDrop,
kExprEnd]);
let instance = builder.instantiate();
instance.exports.crash(0);
assertThrows(() => instance.exports.crash(1),
WebAssembly.RuntimeError, 'illegal cast');