Diff
Modified: trunk/JSTests/ChangeLog (286091 => 286092)
--- trunk/JSTests/ChangeLog 2021-11-20 06:40:27 UTC (rev 286091)
+++ trunk/JSTests/ChangeLog 2021-11-20 06:57:51 UTC (rev 286092)
@@ -1,3 +1,13 @@
+2021-11-19 Asumu Takikawa <[email protected]>
+
+ Fix WebAssembly memory.fill out of bounds error message
+ https://bugs.webkit.org/show_bug.cgi?id=233392
+
+ Reviewed by Yusuke Suzuki.
+
+ * wasm/references/memory_fill_out_of_bounds.js: Added.
+ (async test):
+
2021-11-19 Saam Barati <[email protected]>
Fix assertion added in r285592
Added: trunk/JSTests/wasm/references/memory_fill_out_of_bounds.js (0 => 286092)
--- trunk/JSTests/wasm/references/memory_fill_out_of_bounds.js (rev 0)
+++ trunk/JSTests/wasm/references/memory_fill_out_of_bounds.js 2021-11-20 06:57:51 UTC (rev 286092)
@@ -0,0 +1,20 @@
+import * as assert from '../assert.js';
+import { instantiate } from "../wabt-wrapper.js";
+
+async function test() {
+ let wat = `
+ (module
+ (import "env" "memory" (memory $mem0 1 1))
+ (func (export "fill_oob")
+ (memory.fill (i32.const 0) (i32.const 42) (i32.const 65537))
+ )
+ )
+ `;
+
+ let memory = new WebAssembly.Memory({initial: 1, maximum: 1});
+ const instance = await instantiate(wat, {env: {"memory": memory}}, {reference_types: true});
+
+ assert.throws(() => { instance.exports.fill_oob() }, WebAssembly.RuntimeError, "Out of bounds memory access");
+}
+
+assert.asyncTest(test());
Modified: trunk/Source/_javascript_Core/ChangeLog (286091 => 286092)
--- trunk/Source/_javascript_Core/ChangeLog 2021-11-20 06:40:27 UTC (rev 286091)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-11-20 06:57:51 UTC (rev 286092)
@@ -1,3 +1,17 @@
+2021-11-19 Asumu Takikawa <[email protected]>
+
+ Fix WebAssembly memory.fill out of bounds error message
+ https://bugs.webkit.org/show_bug.cgi?id=233392
+
+ Reviewed by Yusuke Suzuki.
+
+ * wasm/WasmAirIRGenerator.cpp:
+ (JSC::Wasm::AirIRGenerator::addMemoryFill):
+ * wasm/WasmB3IRGenerator.cpp:
+ (JSC::Wasm::B3IRGenerator::addMemoryFill):
+ * wasm/WasmSlowPaths.cpp:
+ (JSC::LLInt::WASM_SLOW_PATH_DECL):
+
2021-11-19 Commit Queue <[email protected]>
Unreviewed, reverting r286030.
Modified: trunk/Source/_javascript_Core/wasm/WasmAirIRGenerator.cpp (286091 => 286092)
--- trunk/Source/_javascript_Core/wasm/WasmAirIRGenerator.cpp 2021-11-20 06:40:27 UTC (rev 286091)
+++ trunk/Source/_javascript_Core/wasm/WasmAirIRGenerator.cpp 2021-11-20 06:57:51 UTC (rev 286092)
@@ -1343,7 +1343,7 @@
emitCheck([&] {
return Inst(BranchTest32, nullptr, Arg::resCond(MacroAssembler::Zero), result, result);
}, [=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) {
- this->emitThrowException(jit, ExceptionType::OutOfBoundsTableAccess);
+ this->emitThrowException(jit, ExceptionType::OutOfBoundsMemoryAccess);
});
return { };
Modified: trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp (286091 => 286092)
--- trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp 2021-11-20 06:40:27 UTC (rev 286091)
+++ trunk/Source/_javascript_Core/wasm/WasmB3IRGenerator.cpp 2021-11-20 06:57:51 UTC (rev 286092)
@@ -1291,7 +1291,7 @@
m_currentBlock->appendNew<Value>(m_proc, Equal, origin(), resultValue, m_currentBlock->appendNew<Const32Value>(m_proc, origin(), 0)));
check->setGenerator([=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) {
- this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsTableAccess);
+ this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsMemoryAccess);
});
}
Modified: trunk/Source/_javascript_Core/wasm/WasmSlowPaths.cpp (286091 => 286092)
--- trunk/Source/_javascript_Core/wasm/WasmSlowPaths.cpp 2021-11-20 06:40:27 UTC (rev 286091)
+++ trunk/Source/_javascript_Core/wasm/WasmSlowPaths.cpp 2021-11-20 06:57:51 UTC (rev 286092)
@@ -390,7 +390,7 @@
uint32_t targetValue = READ(instruction.m_targetValue).unboxedUInt32();
uint32_t count = READ(instruction.m_count).unboxedUInt32();
if (!Wasm::operationWasmMemoryFill(instance, dstAddress, targetValue, count))
- WASM_THROW(Wasm::ExceptionType::OutOfBoundsTableAccess);
+ WASM_THROW(Wasm::ExceptionType::OutOfBoundsMemoryAccess);
WASM_END();
}
