Changeset 271114 in webkit

Timestamp:

Dec 30, 2020 7:20:30 PM (less than one hour ago)

Author:

ysuzuki@apple.com

Message:

Unreviewed, fix iteration count check
​https://bugs.webkit.org/show_bug.cgi?id=220206

JSTests:

• wasm/stress/multivalue-iteration-count.js: Added.

(async let):

Source/JavaScriptCore:

We should have iterationCount variable to track iteration count since it can be larger than MarkedArgumentBuffer's size.

• wasm/WasmOperations.cpp:

(JSC::Wasm::JSC_DEFINE_JIT_OPERATION):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/wasm/stress/multivalue-iteration-count.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/wasm/WasmOperations.cpp (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-12-30  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        Unreviewed, fix iteration count check
+        https://bugs.webkit.org/show_bug.cgi?id=220206
+
+        * wasm/stress/multivalue-iteration-count.js: Added.
+        (async let):
+
 2020-12-29  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-12-30  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        Unreviewed, fix iteration count check
+        https://bugs.webkit.org/show_bug.cgi?id=220206
+
+        We should have iterationCount variable to track iteration count since it can be larger than MarkedArgumentBuffer's size.
+
+        * wasm/WasmOperations.cpp:
+        (JSC::Wasm::JSC_DEFINE_JIT_OPERATION):
+
 2020-12-30  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/wasm/WasmOperations.cpp

@@ -523 +523 @@
     RegisterAtOffsetList registerResultOffsets = wasmCallInfo.computeResultsOffsetList();
 
+    unsigned iterationCount = 0;
     MarkedArgumentBuffer buffer;
     forEachInIterable(globalObject, result, [&] (VM&, JSGlobalObject*, JSValue value) -> void {
         if (buffer.size() < signature->returnCount())
             buffer.append(value);
+        ++iterationCount;
     });
     RETURN_IF_EXCEPTION(scope, void());
@@ -535 +537 @@
     }
 
-    if (buffer.size() != signature->returnCount()) {
+    if (iterationCount != signature->returnCount()) {
         throwVMTypeError(globalObject, scope, "Incorrect number of values returned to Wasm from JS");
         return;