Log Message
NaNs read from Wasm code needs to be be purified. https://bugs.webkit.org/show_bug.cgi?id=191056 <rdar://problem/45660341>
Reviewed by Filip Pizlo. JSTests: * wasm/regress/regress-191056.js: Added. Source/_javascript_Core: * wasm/js/WebAssemblyModuleRecord.cpp: (JSC::WebAssemblyModuleRecord::link):
Modified Paths
- trunk/JSTests/ChangeLog
- trunk/Source/_javascript_Core/ChangeLog
- trunk/Source/_javascript_Core/wasm/js/WebAssemblyModuleRecord.cpp
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (238508 => 238509)
--- trunk/JSTests/ChangeLog 2018-11-26 19:59:41 UTC (rev 238508)
+++ trunk/JSTests/ChangeLog 2018-11-26 20:06:30 UTC (rev 238509)
@@ -1,3 +1,13 @@
+2018-11-26 Mark Lam <[email protected]>
+
+ NaNs read from Wasm code needs to be be purified.
+ https://bugs.webkit.org/show_bug.cgi?id=191056
+ <rdar://problem/45660341>
+
+ Reviewed by Filip Pizlo.
+
+ * wasm/regress/regress-191056.js: Added.
+
2018-11-26 Michael Saboff <[email protected]>
32-bit JSC test failure: stress/regexp-compile-oom.js
Added: trunk/JSTests/wasm/regress/regress-191056.js (0 => 238509)
--- trunk/JSTests/wasm/regress/regress-191056.js (rev 0)
+++ trunk/JSTests/wasm/regress/regress-191056.js 2018-11-26 20:06:30 UTC (rev 238509)
@@ -0,0 +1,15 @@
+var importObject = {
+ env: {
+ print_number: function (number) {
+ print('[+] importObject callback.');
+ print(number);
+ }
+ }
+};
+var wasmCode = new Uint8Array([0x0,0x61,0x73,0x6d,0x1,0x0,0x0,0x0,0x1,0x7,0x1,0x60,0x2,0x7e,0x7f,0x1,0x7f,0x3,0x2,0x1,0x0,0x4,0x4,0x1,0x70,0x0,0x4,0x6,0x2e,0x5,0x7f,0x0,0x41,0x2a,0xb,0x7d,0x0,0x43,0x74,0x0,0x0,0x4d,0xb,0x7c,0x0 ,0x44,0x83,0x88,0x88,0x00,0x0,0x0,0xff,0xff,0xb,0x7d,0x0,0x43,0x0,0x0,0x9,0x7f,0xb,0x7c,0x0,0x44,0x0,0x3c,0x0,0x0,0x0,0x0,0xf8,0x7f,0xb,0x7,0x40,0x7,0x5,0x74,0x61,0x62,0x3f,0x45,0x1,0x0,0x3,0x7d,0x75,0x6d,0x0,0x0,0x6,0x61,0x3d, 0x22,0x0,0xd,0x72,0x3,0x0,0x7,0x4f,0x7c,0x68,0x77,0x65,0x20,0x31,0x3,0x1,0x7,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x3,0x2,0x7,0x61,0x6e,0x73,0x77,0x65,0x72,0x3c,0x3,0x3,0x7,0x61,0x6e,0x73,0x77,0x65,0x72,0x34,0x3,0x4,0x9,0x7,0x1,0x0,0x41,0x0,0xb,0x1,0x0,0xa,0x9,0x1,0x7,0x0,0x20,0x1,0x0,0x1,0x0,0xb,]);
+var wasmModule = new WebAssembly.Module(wasmCode);
+var wasmInstance = new WebAssembly.Instance(wasmModule, importObject);
+
+var res = wasmInstance.exports.AAAAAAA;
+res = res + 'string';
+
Modified: trunk/Source/_javascript_Core/ChangeLog (238508 => 238509)
--- trunk/Source/_javascript_Core/ChangeLog 2018-11-26 19:59:41 UTC (rev 238508)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-11-26 20:06:30 UTC (rev 238509)
@@ -1,3 +1,14 @@
+2018-11-26 Mark Lam <[email protected]>
+
+ NaNs read from Wasm code needs to be be purified.
+ https://bugs.webkit.org/show_bug.cgi?id=191056
+ <rdar://problem/45660341>
+
+ Reviewed by Filip Pizlo.
+
+ * wasm/js/WebAssemblyModuleRecord.cpp:
+ (JSC::WebAssemblyModuleRecord::link):
+
2018-11-26 Tadeu Zagallo <[email protected]>
ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyModuleRecord.cpp (238508 => 238509)
--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyModuleRecord.cpp 2018-11-26 19:59:41 UTC (rev 238508)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyModuleRecord.cpp 2018-11-26 20:06:30 UTC (rev 238509)
@@ -388,11 +388,11 @@
return;
case Wasm::F32:
- exportedValue = JSValue(m_instance->instance().loadF32Global(exp.kindIndex));
+ exportedValue = jsNumber(purifyNaN(m_instance->instance().loadF32Global(exp.kindIndex)));
break;
case Wasm::F64:
- exportedValue = JSValue(m_instance->instance().loadF64Global(exp.kindIndex));
+ exportedValue = jsNumber(purifyNaN(m_instance->instance().loadF64Global(exp.kindIndex)));
break;
default:
_______________________________________________ webkit-changes mailing list [email protected] https://lists.webkit.org/mailman/listinfo/webkit-changes
