Title: [246487] trunk
- Revision
- 246487
- Author
- [email protected]
- Date
- 2019-06-16 15:06:29 -0700 (Sun, 16 Jun 2019)
Log Message
[JSC] Grown region of WasmTable should be initialized with null
https://bugs.webkit.org/show_bug.cgi?id=198903
Reviewed by Saam Barati.
JSTests:
* wasm/stress/wasm-table-grow-initialize.js: Added.
(shouldBe):
Source/_javascript_Core:
Grown region of Wasmtable is now empty. We should initialize it with null.
We also rename Wasm::Table::visitChildren to Wasm::Table::visitAggregate to
align to the naming convention.
* wasm/WasmTable.cpp:
(JSC::Wasm::Table::grow):
(JSC::Wasm::Table::visitAggregate):
(JSC::Wasm::Table::visitChildren): Deleted.
* wasm/WasmTable.h:
* wasm/js/JSWebAssemblyTable.cpp:
(JSC::JSWebAssemblyTable::visitChildren):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (246486 => 246487)
--- trunk/JSTests/ChangeLog 2019-06-16 21:04:41 UTC (rev 246486)
+++ trunk/JSTests/ChangeLog 2019-06-16 22:06:29 UTC (rev 246487)
@@ -1,3 +1,13 @@
+2019-06-16 Yusuke Suzuki <[email protected]>
+
+ [JSC] Grown region of WasmTable should be initialized with null
+ https://bugs.webkit.org/show_bug.cgi?id=198903
+
+ Reviewed by Saam Barati.
+
+ * wasm/stress/wasm-table-grow-initialize.js: Added.
+ (shouldBe):
+
2019-06-13 Yusuke Suzuki <[email protected]>
Yarr bytecode compilation failure should be gracefully handled
Added: trunk/JSTests/wasm/stress/wasm-table-grow-initialize.js (0 => 246487)
--- trunk/JSTests/wasm/stress/wasm-table-grow-initialize.js (rev 0)
+++ trunk/JSTests/wasm/stress/wasm-table-grow-initialize.js 2019-06-16 22:06:29 UTC (rev 246487)
@@ -0,0 +1,13 @@
+function shouldBe(actual, expected) {
+ if (actual !== expected)
+ throw new Error('bad value: ' + actual);
+}
+
+var table = new WebAssembly.Table({
+ element: "anyfunc",
+ initial: 20
+});
+
+table.grow(5)
+for (var i = 0; i < 25; ++i)
+ shouldBe(table.get(i), null);
Modified: trunk/Source/_javascript_Core/ChangeLog (246486 => 246487)
--- trunk/Source/_javascript_Core/ChangeLog 2019-06-16 21:04:41 UTC (rev 246486)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-06-16 22:06:29 UTC (rev 246487)
@@ -1,3 +1,22 @@
+2019-06-16 Yusuke Suzuki <[email protected]>
+
+ [JSC] Grown region of WasmTable should be initialized with null
+ https://bugs.webkit.org/show_bug.cgi?id=198903
+
+ Reviewed by Saam Barati.
+
+ Grown region of Wasmtable is now empty. We should initialize it with null.
+ We also rename Wasm::Table::visitChildren to Wasm::Table::visitAggregate to
+ align to the naming convention.
+
+ * wasm/WasmTable.cpp:
+ (JSC::Wasm::Table::grow):
+ (JSC::Wasm::Table::visitAggregate):
+ (JSC::Wasm::Table::visitChildren): Deleted.
+ * wasm/WasmTable.h:
+ * wasm/js/JSWebAssemblyTable.cpp:
+ (JSC::JSWebAssemblyTable::visitChildren):
+
2019-06-14 Keith Miller <[email protected]>
Restore PAC based cage.
Modified: trunk/Source/_javascript_Core/wasm/WasmTable.cpp (246486 => 246487)
--- trunk/Source/_javascript_Core/wasm/WasmTable.cpp 2019-06-16 21:04:41 UTC (rev 246486)
+++ trunk/Source/_javascript_Core/wasm/WasmTable.cpp 2019-06-16 22:06:29 UTC (rev 246487)
@@ -100,7 +100,7 @@
if (!isValidLength(newLength))
return WTF::nullopt;
- auto checkedGrow = [&] (auto& container) {
+ auto checkedGrow = [&] (auto& container, auto initializer) {
if (newLengthChecked.unsafeGet() > allocatedLength(m_length)) {
Checked reallocSizeChecked = allocatedLength(newLengthChecked.unsafeGet());
reallocSizeChecked *= sizeof(*container.get());
@@ -110,19 +110,21 @@
// FIXME this over-allocates and could be smarter about not committing all of that memory https://bugs.webkit.org/show_bug.cgi?id=181425
container.realloc(reallocSize);
}
- for (uint32_t i = m_length; i < allocatedLength(newLength); ++i)
+ for (uint32_t i = m_length; i < allocatedLength(newLength); ++i) {
new (&container.get()[i]) std::remove_reference_t<decltype(*container.get())>();
+ initializer(container.get()[i]);
+ }
return true;
};
if (auto* funcRefTable = asFuncrefTable()) {
- if (!checkedGrow(funcRefTable->m_importableFunctions))
+ if (!checkedGrow(funcRefTable->m_importableFunctions, [] (auto&) { }))
return WTF::nullopt;
- if (!checkedGrow(funcRefTable->m_instances))
+ if (!checkedGrow(funcRefTable->m_instances, [] (auto&) { }))
return WTF::nullopt;
}
- if (!checkedGrow(m_jsValues))
+ if (!checkedGrow(m_jsValues, [] (WriteBarrier<Unknown>& slot) { slot.setStartingValue(jsNull()); }))
return WTF::nullopt;
setLength(newLength);
@@ -157,7 +159,7 @@
return m_jsValues.get()[index & m_mask].get();
}
-void Table::visitChildren(SlotVisitor& visitor)
+void Table::visitAggregate(SlotVisitor& visitor)
{
RELEASE_ASSERT(m_owner);
auto locker = holdLock(m_owner->cellLock());
Modified: trunk/Source/_javascript_Core/wasm/WasmTable.h (246486 => 246487)
--- trunk/Source/_javascript_Core/wasm/WasmTable.h 2019-06-16 21:04:41 UTC (rev 246486)
+++ trunk/Source/_javascript_Core/wasm/WasmTable.h 2019-06-16 22:06:29 UTC (rev 246487)
@@ -76,7 +76,7 @@
Optional<uint32_t> grow(uint32_t delta);
- void visitChildren(SlotVisitor&);
+ void visitAggregate(SlotVisitor&);
protected:
Table(uint32_t initial, Optional<uint32_t> maximum, TableElementType = TableElementType::Anyref);
Modified: trunk/Source/_javascript_Core/wasm/js/JSWebAssemblyTable.cpp (246486 => 246487)
--- trunk/Source/_javascript_Core/wasm/js/JSWebAssemblyTable.cpp 2019-06-16 21:04:41 UTC (rev 246486)
+++ trunk/Source/_javascript_Core/wasm/js/JSWebAssemblyTable.cpp 2019-06-16 22:06:29 UTC (rev 246487)
@@ -80,7 +80,7 @@
ASSERT_GC_OBJECT_INHERITS(thisObject, info());
Base::visitChildren(thisObject, visitor);
- thisObject->table()->visitChildren(visitor);
+ thisObject->table()->visitAggregate(visitor);
}
bool JSWebAssemblyTable::grow(uint32_t delta)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
