Title: [215141] trunk/Source/_javascript_Core
- Revision
- 215141
- Author
- [email protected]
- Date
- 2017-04-07 22:30:47 -0700 (Fri, 07 Apr 2017)
Log Message
WebAssembly: Fix issue with BrTable targeting a Loop
https://bugs.webkit.org/show_bug.cgi?id=170638
Reviewed by Saam Barati.
This fixes the same issue V8 had in: https://github.com/WebAssembly/spec/pull/456#event-1033547537
* wasm/WasmValidate.cpp:
(JSC::Wasm::Validate::ControlData::branchTargetSignature):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (215140 => 215141)
--- trunk/Source/_javascript_Core/ChangeLog 2017-04-08 03:53:46 UTC (rev 215140)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-04-08 05:30:47 UTC (rev 215141)
@@ -1,5 +1,17 @@
2017-04-07 Keith Miller <[email protected]>
+ WebAssembly: Fix issue with BrTable targeting a Loop
+ https://bugs.webkit.org/show_bug.cgi?id=170638
+
+ Reviewed by Saam Barati.
+
+ This fixes the same issue V8 had in: https://github.com/WebAssembly/spec/pull/456#event-1033547537
+
+ * wasm/WasmValidate.cpp:
+ (JSC::Wasm::Validate::ControlData::branchTargetSignature):
+
+2017-04-07 Keith Miller <[email protected]>
+
Add a PriorityQueue class
https://bugs.webkit.org/show_bug.cgi?id=170579
Modified: trunk/Source/_javascript_Core/wasm/WasmValidate.cpp (215140 => 215141)
--- trunk/Source/_javascript_Core/wasm/WasmValidate.cpp 2017-04-08 03:53:46 UTC (rev 215140)
+++ trunk/Source/_javascript_Core/wasm/WasmValidate.cpp 2017-04-08 05:30:47 UTC (rev 215141)
@@ -71,6 +71,7 @@
BlockType type() const { return m_blockType; }
Type signature() const { return m_signature; }
+ Type branchTargetSignature() const { return type() == BlockType::Loop ? Void : signature(); }
private:
BlockType m_blockType;
Type m_signature;
@@ -265,19 +266,16 @@
}
auto Validate::checkBranchTarget(ControlType& target, const ExpressionList& expressionStack) -> Result
- {
- if (target.type() == BlockType::Loop)
- return { };
+{
+ if (target.branchTargetSignature() == Void)
+ return { };
- if (target.signature() == Void)
- return { };
+ WASM_VALIDATOR_FAIL_IF(expressionStack.isEmpty(), target.type() == BlockType::TopLevel ? "branch out of function" : "branch to block", " on empty _expression_ stack, but expected ", target.signature());
+ WASM_VALIDATOR_FAIL_IF(target.branchTargetSignature() != expressionStack.last(), "branch's stack type doesn't match block's type");
- WASM_VALIDATOR_FAIL_IF(expressionStack.isEmpty(), target.type() == BlockType::TopLevel ? "branch out of function" : "branch to block", " on empty _expression_ stack, but expected ", target.signature());
- WASM_VALIDATOR_FAIL_IF(target.signature() != expressionStack.last(), "branch's stack type doesn't match block's type");
+ return { };
+}
- return { };
- }
-
auto Validate::addBranch(ControlType& target, ExpressionType condition, const ExpressionList& stack) -> Result
{
// Void means this is an unconditional branch.
@@ -290,7 +288,7 @@
WASM_VALIDATOR_FAIL_IF(condition != I32, "br_table with non-i32 condition ", condition);
for (auto target : targets)
- WASM_VALIDATOR_FAIL_IF(defaultTarget.signature() != target->signature(), "br_table target type mismatch");
+ WASM_VALIDATOR_FAIL_IF(defaultTarget.branchTargetSignature() != target->branchTargetSignature(), "br_table target type mismatch");
return checkBranchTarget(defaultTarget, expressionStack);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
