Changeset 286092 in webkit

Timestamp:

Nov 19, 2021 10:57:51 PM (8 months ago)

Author:

commit-queue@webkit.org

Message:

Fix WebAssembly memory.fill out of bounds error message
​https://bugs.webkit.org/show_bug.cgi?id=233392

Patch by Asumu Takikawa <​asumu@igalia.com> on 2021-11-19
Reviewed by Yusuke Suzuki.

JSTests:

• wasm/references/memory_fill_out_of_bounds.js: Added.

(async test):

Source/JavaScriptCore:

• wasm/WasmAirIRGenerator.cpp:

(JSC::Wasm::AirIRGenerator::addMemoryFill):

• wasm/WasmB3IRGenerator.cpp:

(JSC::Wasm::B3IRGenerator::addMemoryFill):

• wasm/WasmSlowPaths.cpp:

(JSC::LLInt::WASM_SLOW_PATH_DECL):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/wasm/references/memory_fill_out_of_bounds.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp (modified) (1 diff)
• Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp (modified) (1 diff)
• Source/JavaScriptCore/wasm/WasmSlowPaths.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-11-19  Asumu Takikawa  <asumu@igalia.com>
+
+        Fix WebAssembly memory.fill out of bounds error message
+        https://bugs.webkit.org/show_bug.cgi?id=233392
+
+        Reviewed by Yusuke Suzuki.
+
+        * wasm/references/memory_fill_out_of_bounds.js: Added.
+        (async test):
+
 2021-11-19  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-11-19  Asumu Takikawa  <asumu@igalia.com>
+
+        Fix WebAssembly memory.fill out of bounds error message
+        https://bugs.webkit.org/show_bug.cgi?id=233392
+
+        Reviewed by Yusuke Suzuki.
+
+        * wasm/WasmAirIRGenerator.cpp:
+        (JSC::Wasm::AirIRGenerator::addMemoryFill):
+        * wasm/WasmB3IRGenerator.cpp:
+        (JSC::Wasm::B3IRGenerator::addMemoryFill):
+        * wasm/WasmSlowPaths.cpp:
+        (JSC::LLInt::WASM_SLOW_PATH_DECL):
+
 2021-11-19  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp

@@ -1344 +1344 @@
         return Inst(BranchTest32, nullptr, Arg::resCond(MacroAssembler::Zero), result, result);
     }, [=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) {
-        this->emitThrowException(jit, ExceptionType::OutOfBoundsTableAccess);
+        this->emitThrowException(jit, ExceptionType::OutOfBoundsMemoryAccess);
     });
 

trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp

@@ -1292 +1292 @@
 
         check->setGenerator([=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) {
-            this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsTableAccess);
+            this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsMemoryAccess);
         });
     }

trunk/Source/JavaScriptCore/wasm/WasmSlowPaths.cpp

@@ -391 +391 @@
     uint32_t count = READ(instruction.m_count).unboxedUInt32();
     if (!Wasm::operationWasmMemoryFill(instance, dstAddress, targetValue, count))
-        WASM_THROW(Wasm::ExceptionType::OutOfBoundsTableAccess);
+        WASM_THROW(Wasm::ExceptionType::OutOfBoundsMemoryAccess);
     WASM_END();
 }