Changeset 246487 in webkit

Timestamp:

Jun 16, 2019, 3:06:29 PM (7 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] Grown region of WasmTable should be initialized with null
​https://bugs.webkit.org/show_bug.cgi?id=198903

Reviewed by Saam Barati.

JSTests:

• wasm/stress/wasm-table-grow-initialize.js: Added.

(shouldBe):

Source/JavaScriptCore:

Grown region of Wasmtable is now empty. We should initialize it with null.
We also rename Wasm::Table::visitChildren to Wasm::Table::visitAggregate to
align to the naming convention.

• wasm/WasmTable.cpp:

(JSC::Wasm::Table::grow):
(JSC::Wasm::Table::visitAggregate):
(JSC::Wasm::Table::visitChildren): Deleted.

• wasm/WasmTable.h:
• wasm/js/JSWebAssemblyTable.cpp:

(JSC::JSWebAssemblyTable::visitChildren):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/wasm/stress/wasm-table-grow-initialize.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/wasm/WasmTable.cpp (modified) (3 diffs)
• Source/JavaScriptCore/wasm/WasmTable.h (modified) (1 diff)
• Source/JavaScriptCore/wasm/js/JSWebAssemblyTable.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-06-16  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Grown region of WasmTable should be initialized with null
+        https://bugs.webkit.org/show_bug.cgi?id=198903
+
+        Reviewed by Saam Barati.
+
+        * wasm/stress/wasm-table-grow-initialize.js: Added.
+        (shouldBe):
+
 2019-06-13  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-06-16  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Grown region of WasmTable should be initialized with null
+        https://bugs.webkit.org/show_bug.cgi?id=198903
+
+        Reviewed by Saam Barati.
+
+        Grown region of Wasmtable is now empty. We should initialize it with null.
+        We also rename Wasm::Table::visitChildren to Wasm::Table::visitAggregate to
+        align to the naming convention.
+
+        * wasm/WasmTable.cpp:
+        (JSC::Wasm::Table::grow):
+        (JSC::Wasm::Table::visitAggregate):
+        (JSC::Wasm::Table::visitChildren): Deleted.
+        * wasm/WasmTable.h:
+        * wasm/js/JSWebAssemblyTable.cpp:
+        (JSC::JSWebAssemblyTable::visitChildren):
+
 2019-06-14  Keith Miller  <keith_miller@apple.com>
 

trunk/Source/JavaScriptCore/wasm/WasmTable.cpp

@@ -101 +101 @@
         return WTF::nullopt;
 
-    auto checkedGrow = [&] (auto& container) {
+    auto checkedGrow = [&] (auto& container, auto initializer) {
         if (newLengthChecked.unsafeGet() > allocatedLength(m_length)) {
             Checked reallocSizeChecked = allocatedLength(newLengthChecked.unsafeGet());
@@ -111 +111 @@
             container.realloc(reallocSize);
         }
-        for (uint32_t i = m_length; i < allocatedLength(newLength); ++i)
+        for (uint32_t i = m_length; i < allocatedLength(newLength); ++i) {
             new (&container.get()[i]) std::remove_reference_t<decltype(*container.get())>();
+            initializer(container.get()[i]);
+        }
         return true;
     };
 
     if (auto* funcRefTable = asFuncrefTable()) {
-        if (!checkedGrow(funcRefTable->m_importableFunctions))
+        if (!checkedGrow(funcRefTable->m_importableFunctions, [] (auto&) { }))
             return WTF::nullopt;
-        if (!checkedGrow(funcRefTable->m_instances))
+        if (!checkedGrow(funcRefTable->m_instances, [] (auto&) { }))
             return WTF::nullopt;
     }
 
-    if (!checkedGrow(m_jsValues))
+    if (!checkedGrow(m_jsValues, [] (WriteBarrier<Unknown>& slot) { slot.setStartingValue(jsNull()); }))
         return WTF::nullopt;
 
@@ -158 +160 @@
 }
 
-void Table::visitChildren(SlotVisitor& visitor)
+void Table::visitAggregate(SlotVisitor& visitor)
 {
     RELEASE_ASSERT(m_owner);

trunk/Source/JavaScriptCore/wasm/WasmTable.h

@@ -77 +77 @@
     Optional<uint32_t> grow(uint32_t delta);
 
-    void visitChildren(SlotVisitor&);
+    void visitAggregate(SlotVisitor&);
 
 protected:

trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyTable.cpp

@@ -81 +81 @@
 
     Base::visitChildren(thisObject, visitor);
-    thisObject->table()->visitChildren(visitor);
+    thisObject->table()->visitAggregate(visitor);
 }