Attachment 290640 Details for Bug 162884 – patch

[patch] patch

0001-random-wasm.patch (text/plain), 7.25 KB, created by JF Bastien on 2016-10-04 14:03:20 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: JF Bastien

Created: 2016-10-04 14:03:20 PDT

Size: 7.25 KB

patch

obsolete

>From 513ea9769f0a56c89b7663cd3d7f6b474631f149 Mon Sep 17 00:00:00 2001
>From: JF Bastien <jfbastien@apple.com>
>Date: Mon, 3 Oct 2016 17:21:33 -0700
>Subject: [PATCH] random-wasm
>
>---
> JSTests/ChangeLog                               | 10 ++++++++
> JSTests/stress/wasm/generate-wasmops-header.js  | 31 ++++++++++++++++++++++---
> Source/JavaScriptCore/ChangeLog                 | 17 ++++++++++++++
> Source/JavaScriptCore/wasm/JSWASMModule.cpp     |  1 +
> Source/JavaScriptCore/wasm/WASMFunctionParser.h |  5 ++--
> Source/JavaScriptCore/wasm/WASMOps.h            | 10 ++++++++
> Source/JavaScriptCore/wasm/WASMParser.h         |  4 +++-
> 7 files changed, 71 insertions(+), 7 deletions(-)
>
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 5136118..4638ee2 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,5 +1,15 @@
> 2016-10-03  JF Bastien  <jfbastien@apple.com>
> 
>+        WebAssembly: handle a few corner cases
>+        https://bugs.webkit.org/show_bug.cgi?id=162884
>+
>+        Reviewed by Keith Miller.
>+
>+        * stress/wasm/generate-wasmops-header.js:
>+        (const.opcodeIterator): max opcode value
>+
>+2016-10-03  JF Bastien  <jfbastien@apple.com>
>+
>         Auto-generate WASMOps.h, share with testing JSON file
>         https://bugs.webkit.org/show_bug.cgi?id=162870
> 
>diff --git a/JSTests/stress/wasm/generate-wasmops-header.js b/JSTests/stress/wasm/generate-wasmops-header.js
>index 2399f56..ce52897 100644
>--- a/JSTests/stress/wasm/generate-wasmops-header.js
>+++ b/JSTests/stress/wasm/generate-wasmops-header.js
>@@ -4,12 +4,12 @@ const jsonFile = 'wasm.json';
> const wasm = JSON.parse(read(jsonFile));
> const opcodes = wasm.opcode;
> 
>-// Iterate through opcodes which match filter.
>-const opcodeIterator = (filter) => {
>+// Iterate through opcodes which match filter, and on each iteration yield ret.
>+const opcodeIterator = (filter, ret = op => { return {name: op, opcode: opcodes[op]}; }) => {
>     return function*() {
>         for (let op in opcodes)
>             if (filter(opcodes[op]))
>-                yield {name: op, opcode: opcodes[op]};
>+                yield ret(op);
>     };
> };
> 
>@@ -38,6 +38,21 @@ const defines = [
>     ...opcodeMacroizer(op => (op.category === "arithmetic" || op.category === "comparison") && op.parameter.length === 2),
>     "\n\n"].join("");
> 
>+const opValueSet = new Set(opcodeIterator(op => true, op => opcodes[op].value)());
>+const maxOpValue = Math.max(...opValueSet);
>+const validOps = (() => {
>+    // Create a bitset of valid ops.
>+    let v = "";
>+    for (let i = 0; i < maxOpValue / 8; ++i) {
>+        let entry = 0;
>+        for (let j = 0; j < 8; ++j)
>+            if (opValueSet.has(i * 8 + j))
>+                entry |= 1 << j;
>+        v += (i ? ", " : "") + "0x" + entry.toString(16);
>+    }
>+    return v;
>+})();
>+
> const template = `/*
>  * Copyright (C) 2016 Apple Inc. All rights reserved.
>  *
>@@ -69,6 +84,8 @@ const template = `/*
> 
> #if ENABLE(WEBASSEMBLY)
> 
>+#include <cstdint>
>+
> namespace JSC { namespace WASM {
> 
> ${defines}
>@@ -85,6 +102,14 @@ enum OpType : uint8_t {
>     FOR_EACH_WASM_OP(CREATE_ENUM_VALUE)
> };
> 
>+template<typename Int>
>+inline bool isValidOpType(Int i)
>+{
>+    // Bitset of valid ops.
>+    static const uint8_t valid[] = { ${validOps} };
>+    return 0 <= i && i <= ${maxOpValue} && (valid[i / 8] & (1 << (i % 8)));
>+}
>+
> enum class BinaryOpType : uint8_t {
>     FOR_EACH_WASM_BINARY_OP(CREATE_ENUM_VALUE)
> };
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index c6e0134..2bae36f 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,5 +1,22 @@
> 2016-10-03  JF Bastien  <jfbastien@apple.com>
> 
>+        WebAssembly: handle a few corner cases
>+        https://bugs.webkit.org/show_bug.cgi?id=162884
>+
>+        Reviewed by Keith Miller.
>+
>+        * wasm/JSWASMModule.cpp: missing include broke cmake build
>+        * wasm/WASMFunctionParser.h:
>+        (JSC::WASM::FunctionParser<Context>::parseBlock): check op is valid
>+        (JSC::WASM::FunctionParser<Context>::parseExpression): switch covers all cases
>+        * wasm/WASMOps.h:
>+        (JSC::WASM::isValidOpType): op is valid
>+        * wasm/WASMParser.h:
>+        (JSC::WASM::Parser::consumeString): avoid str[i] being one-past-the-end
>+        (JSC::WASM::Parser::parseUInt32): shift math around to avoid overflow
>+
>+2016-10-03  JF Bastien  <jfbastien@apple.com>
>+
>         Auto-generate WASMOps.h, share with testing JSON file
>         https://bugs.webkit.org/show_bug.cgi?id=162870
> 
>diff --git a/Source/JavaScriptCore/wasm/JSWASMModule.cpp b/Source/JavaScriptCore/wasm/JSWASMModule.cpp
>index deb7161..cd996ac 100644
>--- a/Source/JavaScriptCore/wasm/JSWASMModule.cpp
>+++ b/Source/JavaScriptCore/wasm/JSWASMModule.cpp
>@@ -35,6 +35,7 @@
> #include "JSCellInlines.h"
> #include "JSFunction.h"
> #include "SlotVisitorInlines.h"
>+#include "StructureInlines.h"
> 
> namespace JSC {
> 
>diff --git a/Source/JavaScriptCore/wasm/WASMFunctionParser.h b/Source/JavaScriptCore/wasm/WASMFunctionParser.h
>index 11b8a8e..ae87424 100644
>--- a/Source/JavaScriptCore/wasm/WASMFunctionParser.h
>+++ b/Source/JavaScriptCore/wasm/WASMFunctionParser.h
>@@ -101,7 +101,7 @@ bool FunctionParser<Context>::parseBlock()
> {
>     while (true) {
>         uint8_t op;
>-        if (!parseUInt7(op))
>+        if (!parseUInt7(op) || !isValidOpType(op))
>             return false;
> 
>         if (verbose) {
>@@ -260,8 +260,7 @@ bool FunctionParser<Context>::parseExpression(OpType op)
>         return false;
>     }
> 
>-    // Unknown opcode.
>-    return false;
>+    ASSERT_NOT_REACHED();
> }
> 
> template<typename Context>
>diff --git a/Source/JavaScriptCore/wasm/WASMOps.h b/Source/JavaScriptCore/wasm/WASMOps.h
>index 05ac95d..6ef5bd4 100644
>--- a/Source/JavaScriptCore/wasm/WASMOps.h
>+++ b/Source/JavaScriptCore/wasm/WASMOps.h
>@@ -29,6 +29,8 @@
> 
> #if ENABLE(WEBASSEMBLY)
> 
>+#include <cstdint>
>+
> namespace JSC { namespace WASM {
> 
> #define FOR_EACH_WASM_SPECIAL_OP(macro) \
>@@ -171,6 +173,14 @@ enum OpType : uint8_t {
>     FOR_EACH_WASM_OP(CREATE_ENUM_VALUE)
> };
> 
>+template<typename Int>
>+inline bool isValidOpType(Int i)
>+{
>+    // Bitset of valid ops.
>+    static const uint8_t valid[] = { 0xff, 0x8f, 0xff, 0x2, 0xff, 0xff, 0x7f, 0xa, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x1f };
>+    return 0 <= i && i <= 188 && (valid[i / 8] & (1 << (i % 8)));
>+}
>+
> enum class BinaryOpType : uint8_t {
>     FOR_EACH_WASM_BINARY_OP(CREATE_ENUM_VALUE)
> };
>diff --git a/Source/JavaScriptCore/wasm/WASMParser.h b/Source/JavaScriptCore/wasm/WASMParser.h
>index a8520cd..5369b6f 100644
>--- a/Source/JavaScriptCore/wasm/WASMParser.h
>+++ b/Source/JavaScriptCore/wasm/WASMParser.h
>@@ -79,6 +79,8 @@ ALWAYS_INLINE bool Parser::consumeCharacter(char c)
> ALWAYS_INLINE bool Parser::consumeString(const char* str)
> {
>     unsigned start = m_offset;
>+    if (m_offset >= m_sourceLength)
>+        return false;
>     for (unsigned i = 0; str[i]; i++) {
>         if (!consumeCharacter(str[i])) {
>             m_offset = start;
>@@ -90,7 +92,7 @@ ALWAYS_INLINE bool Parser::consumeString(const char* str)
> 
> ALWAYS_INLINE bool Parser::parseUInt32(uint32_t& result)
> {
>-    if (m_offset + 4 >= m_sourceLength)
>+    if (m_sourceLength < 4 || m_offset >= m_sourceLength - 4)
>         return false;
>     result = *reinterpret_cast<const uint32_t*>(m_source.data() + m_offset);
>     m_offset += 4;
>-- 
>2.9.3
>

Actions: View | Formatted Diff | Diff

Attachments on bug 162884: 290540 | 290617 | 290619 | 290640