Changeset 245895 in webkit

Timestamp:

May 30, 2019, 11:06:09 AM (7 years ago)

Author:

Justin Michaud

Message:

oss-fuzz: jsc: Issue 15016: jsc: Abrt in JSC::Wasm::AirIRGenerator::addLocal (15016)
​https://bugs.webkit.org/show_bug.cgi?id=198355

Reviewed by Saam Barati.

JSTests:

• wasm/references/is_null.js:

Source/JavaScriptCore:

Fix missing anyref case in addLocal.

• wasm/WasmAirIRGenerator.cpp:

(JSC::Wasm::AirIRGenerator::addLocal):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/wasm/references/is_null.js (modified) (3 diffs)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp (modified) (1 diff)
• Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-05-30  Justin Michaud  <justin_michaud@apple.com>
+
+        oss-fuzz: jsc: Issue 15016: jsc: Abrt in JSC::Wasm::AirIRGenerator::addLocal (15016)
+        https://bugs.webkit.org/show_bug.cgi?id=198355
+
+        Reviewed by Saam Barati.
+
+        * wasm/references/is_null.js:
+
 2019-05-30  Stephan Szabo  <stephan.szabo@sony.com>
 

trunk/JSTests/wasm/references/is_null.js

@@ -10 +10 @@
           .Function("j")
           .Function("k")
+          .Function("local_read")
       .End()
       .Code()
-        .Function("h", { params: ["anyref"], ret: "anyref" })
+        .Function("h", { params: ["anyref"], ret: "anyref" }, ["anyref"])
           .GetLocal(0)
+          .SetLocal(1)
+          .GetLocal(1)
         .End()
 
@@ -28 +31 @@
         .Function("k", { params: [], ret: "i32" })
             .RefNull()
+            .RefIsNull()
+        .End()
+
+        .Function("local_read", { params: [], ret: "i32" }, ["anyref"])
+            .GetLocal(0)
             .RefIsNull()
         .End()
@@ -52 +60 @@
 
 assert.eq(instance.exports.k(), 1)
+assert.eq(instance.exports.local_read(), 1)
 
 assert.eq(obj.test, "hi")

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-05-30  Justin Michaud  <justin_michaud@apple.com>
+
+        oss-fuzz: jsc: Issue 15016: jsc: Abrt in JSC::Wasm::AirIRGenerator::addLocal (15016)
+        https://bugs.webkit.org/show_bug.cgi?id=198355
+
+        Reviewed by Saam Barati.
+
+        Fix missing anyref case in addLocal.
+
+        * wasm/WasmAirIRGenerator.cpp:
+        (JSC::Wasm::AirIRGenerator::addLocal):
+
 2019-05-29  Don Olmstead  <don.olmstead@sony.com>
 

trunk/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp

@@ -880 +880 @@
         m_locals.uncheckedAppend(local);
         switch (type) {
+        case Type::Anyref:
+            append(Move, Arg::imm(JSValue::encode(jsNull())), local);
+            break;
         case Type::I32:
         case Type::I64: {

trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp

@@ -535 +535 @@
         Variable* local = m_proc.addVariable(toB3Type(type));
         m_locals.uncheckedAppend(local);
-        m_currentBlock->appendNew<VariableValue>(m_proc, Set, Origin(), local, constant(toB3Type(type), 0, Origin()));
+        auto val = type == Anyref ? JSValue::encode(jsNull()) : 0;
+        m_currentBlock->appendNew<VariableValue>(m_proc, Set, Origin(), local, constant(toB3Type(type), val, Origin()));
     }
     return { };