AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[wasm][eh] Add missing type check in W.Exception.getArg()

Browse Source 
Check that the tag argument matches the exception's own tag, and throw a
type error if not.

R=jkummerow@chromium.org

Bug: chromium:1237751, v8:11992
Change-Id: Ia404b83c202a247791583f0252833c36801e9ac4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3081523
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76175}
This commit is contained in:
Thibaud Michaud 2021-08-09 13:43:54 +02:00 committed by V8 LUCI CQ
parent d38ea7d979
commit e7053d4673
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/wasm/wasm-js.cc
View File

@ -2046,10 +2046,20 @@ void WebAssemblyExceptionGetArg(
}
auto maybe_values =
i::WasmExceptionPackage::GetExceptionValues(i_isolate, exception);
if (maybe_values->IsUndefined()) {
auto this_tag =
i::WasmExceptionPackage::GetExceptionTag(i_isolate, exception);
if (this_tag->IsUndefined()) {
thrower.TypeError("Expected a WebAssembly.Exception object");
return;
}
DCHECK(this_tag->IsWasmExceptionTag());
if (tag->tag() != *this_tag) {
thrower.TypeError("First argument does not match the exception tag");
return;
}
DCHECK(!maybe_values->IsUndefined());
auto values = i::Handle<i::FixedArray>::cast(maybe_values);
auto signature = tag->serialized_signature();
if (index >= static_cast<uint32_t>(signature.length())) {

3
test/mjsunit/wasm/exceptions-api.js
View File

@ -211,6 +211,9 @@ function TestGetArgHelper(types_str, types, values) {
/Index must be convertible to a valid number/);
assertThrows(() => exception.getArg(tag, 0xFFFFFFFF), RangeError,
/Index out of range/);
let wrong_tag = new WebAssembly.Tag({parameters: ['i32']});
assertThrows(() => exception.getArg(wrong_tag, 0), TypeError,
/First argument does not match the exception tag/);
// Check decoding.
TestGetArgHelper(['i32'], [kWasmI32], [1]);