Changeset 265065 in webkit

Timestamp:

Jul 29, 2020 4:15:09 PM (4 years ago)

Author:

Tadeu Zagallo

Message:

WebAssembly validation for call_indirect is incorrect
​https://bugs.webkit.org/show_bug.cgi?id=214901
<rdar://problem/65189677>

Reviewed by Saam Barati.

JSTests:

• wasm/stress/validate-call_indirect.js: Added.

(try.main):
(catch):

Source/JavaScriptCore:

There was an incorrect condition when validating call_indirect's arguments, which often resulted in skipping this validation.

• wasm/WasmFunctionParser.h:

(JSC::Wasm::FunctionParser<Context>::parseExpression):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/wasm/stress/validate-call_indirect.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/wasm/WasmFunctionParser.h (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2020-07-29  Tadeu Zagallo  <tzagallo@apple.com>
+
+        WebAssembly validation for call_indirect is incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=214901
+        <rdar://problem/65189677>
+
+        Reviewed by Saam Barati.
+
+        * wasm/stress/validate-call_indirect.js: Added.
+        (try.main):
+        (catch):
+
 2020-07-29  Paulo Matos  <pmatos@igalia.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-07-29  Tadeu Zagallo  <tzagallo@apple.com>
+
+        WebAssembly validation for call_indirect is incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=214901
+        <rdar://problem/65189677>
+
+        Reviewed by Saam Barati.
+
+        There was an incorrect condition when validating call_indirect's arguments, which often resulted in skipping this validation.
+
+        * wasm/WasmFunctionParser.h:
+        (JSC::Wasm::FunctionParser<Context>::parseExpression):
+
 2020-07-29  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/wasm/WasmFunctionParser.h

@@ -637 +637 @@
         for (size_t i = firstArgumentIndex; i < m_expressionStack.size(); ++i) {
             TypedExpression arg = m_expressionStack.at(i);
-            if (i < calleeSignature.argumentCount())
+            if (i < m_expressionStack.size() - 1)
                 WASM_VALIDATOR_FAIL_IF(!isSubtype(arg.type(), calleeSignature.argument(i - firstArgumentIndex)), "argument type mismatch in call_indirect, got ", arg.type(), ", expected ", calleeSignature.argument(i - firstArgumentIndex));
             args.uncheckedAppend(arg);
@@ -643 +643 @@
         }
         m_expressionStack.shrink(firstArgumentIndex);
-
-
 
         ResultList results;