Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(626)

Unified Diff: src/compiler/wasm-compiler.cc

Issue 2416543002: [wasm] Fix bounds check for zero initial memory. (Closed)
Patch Set: Created 4 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: src/compiler/wasm-compiler.cc
diff --git a/src/compiler/wasm-compiler.cc b/src/compiler/wasm-compiler.cc
index c52b45269229296c1b93a7fbb31e3f945aa64c13..fe12e3c3627ad8e9a23f81684d7c7a27442e0c54 100644
--- a/src/compiler/wasm-compiler.cc
+++ b/src/compiler/wasm-compiler.cc
@@ -2794,12 +2794,14 @@ Node* WasmGraphBuilder::MemSize(uint32_t offset) {
uint32_t size = static_cast<uint32_t>(module_->instance->mem_size);
if (offset == 0) {
if (!mem_size_)
+ // The memory size rmode in this case does not matter so using dword as
+ // default
mem_size_ = jsgraph()->RelocatableInt32Constant(
- size, RelocInfo::WASM_MEMORY_SIZE_REFERENCE);
+ size, RelocInfo::WASM_MEMORY_DWORD_SIZE_REFERENCE);
return mem_size_;
} else {
return jsgraph()->RelocatableInt32Constant(
- size + offset, RelocInfo::WASM_MEMORY_SIZE_REFERENCE);
+ size + offset, RelocInfo::WASM_MEMORY_DWORD_SIZE_REFERENCE);
}
}
@@ -2851,6 +2853,23 @@ void WasmGraphBuilder::BoundsCheckMem(MachineType memtype, Node* index,
DCHECK(module_ && module_->instance);
uint32_t size = module_->instance->mem_size;
byte memsize = wasm::WasmOpcodes::MemSize(memtype);
+ RelocInfo::Mode size_rmode;
+ switch (memsize) {
+ case 1:
+ size_rmode = RelocInfo::WASM_MEMORY_BYTE_SIZE_REFERENCE;
+ break;
+ case 2:
+ size_rmode = RelocInfo::WASM_MEMORY_WORD_SIZE_REFERENCE;
+ break;
+ case 4:
+ size_rmode = RelocInfo::WASM_MEMORY_DWORD_SIZE_REFERENCE;
+ break;
+ case 8:
+ size_rmode = RelocInfo::WASM_MEMORY_QWORD_SIZE_REFERENCE;
+ break;
+ default:
+ size_rmode = RelocInfo::NONE32;
+ }
// Check against the effective size.
size_t effective_size;
@@ -2863,11 +2882,11 @@ void WasmGraphBuilder::BoundsCheckMem(MachineType memtype, Node* index,
// the offset + index being out of bounds for code to be patched correctly
// on relocation.
effective_size = size - memsize + 1;
- Node* cond = graph()->NewNode(jsgraph()->machine()->Uint32LessThan(),
- jsgraph()->IntPtrConstant(offset),
- jsgraph()->RelocatableInt32Constant(
- static_cast<uint32_t>(effective_size),
- RelocInfo::WASM_MEMORY_SIZE_REFERENCE));
+ Node* cond = graph()->NewNode(
+ jsgraph()->machine()->Uint32LessThan(),
+ jsgraph()->IntPtrConstant(offset),
+ jsgraph()->RelocatableInt32Constant(
+ static_cast<uint32_t>(effective_size), size_rmode));
trap_->AddTrapIfFalse(wasm::kTrapMemOutOfBounds, cond, position);
DCHECK(offset >= effective_size);
effective_size = offset - effective_size;
@@ -2885,10 +2904,10 @@ void WasmGraphBuilder::BoundsCheckMem(MachineType memtype, Node* index,
}
}
- Node* cond = graph()->NewNode(jsgraph()->machine()->Uint32LessThan(), index,
- jsgraph()->RelocatableInt32Constant(
- static_cast<uint32_t>(effective_size),
- RelocInfo::WASM_MEMORY_SIZE_REFERENCE));
+ Node* cond =
+ graph()->NewNode(jsgraph()->machine()->Uint32LessThan(), index,
+ jsgraph()->RelocatableInt32Constant(
+ static_cast<uint32_t>(effective_size), size_rmode));
trap_->AddTrapIfFalse(wasm::kTrapMemOutOfBounds, cond, position);
}

Powered by Google App Engine
This is Rietveld 408576698