<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[208290] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/208290">208290</a></dd>
<dt>Author</dt> <dd>keith_miller@apple.com</dd>
<dt>Date</dt> <dd>2016-11-02 10:48:23 -0700 (Wed, 02 Nov 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>We should not pop from an empty stack in the Wasm function parser.
https://bugs.webkit.org/show_bug.cgi?id=164275
Reviewed by Filip Pizlo.
This patch prevents an issue in the wasm parser where we might
accidentially pop from the expression stack without if there
are no entries. It also fixes a similar issue with else
blocks where a user might try to put an else on the top level
of a function.
* wasm/WasmB3IRGenerator.cpp:
* wasm/WasmFunctionParser.h:
(JSC::Wasm::FunctionParser<Context>::parseExpression):
(JSC::Wasm::FunctionParser<Context>::popExpressionStack):
* wasm/WasmValidate.cpp:
(JSC::Wasm::Validate::setErrorMessage):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmB3IRGeneratorcpp">trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmFunctionParserh">trunk/Source/JavaScriptCore/wasm/WasmFunctionParser.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmValidatecpp">trunk/Source/JavaScriptCore/wasm/WasmValidate.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (208289 => 208290)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-11-02 17:43:32 UTC (rev 208289)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-11-02 17:48:23 UTC (rev 208290)
</span><span class="lines">@@ -1,3 +1,23 @@
</span><ins>+2016-11-02 Keith Miller <keith_miller@apple.com>
+
+ We should not pop from an empty stack in the Wasm function parser.
+ https://bugs.webkit.org/show_bug.cgi?id=164275
+
+ Reviewed by Filip Pizlo.
+
+ This patch prevents an issue in the wasm parser where we might
+ accidentially pop from the expression stack without if there
+ are no entries. It also fixes a similar issue with else
+ blocks where a user might try to put an else on the top level
+ of a function.
+
+ * wasm/WasmB3IRGenerator.cpp:
+ * wasm/WasmFunctionParser.h:
+ (JSC::Wasm::FunctionParser<Context>::parseExpression):
+ (JSC::Wasm::FunctionParser<Context>::popExpressionStack):
+ * wasm/WasmValidate.cpp:
+ (JSC::Wasm::Validate::setErrorMessage):
+
</ins><span class="cx"> 2016-11-02 Romain Bellessort <romain.bellessort@crf.canon.fr>
</span><span class="cx">
</span><span class="cx"> [Readable Streams API] Enable creation of ReadableByteStreamController
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmB3IRGeneratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp (208289 => 208290)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp 2016-11-02 17:43:32 UTC (rev 208289)
+++ trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp 2016-11-02 17:48:23 UTC (rev 208290)
</span><span class="lines">@@ -212,6 +212,8 @@
</span><span class="cx">
</span><span class="cx"> void dump(const Vector<ControlType>& controlStack, const ExpressionList& expressionStack);
</span><span class="cx">
</span><ins>+ void setErrorMessage(String&&) { UNREACHABLE_FOR_PLATFORM(); }
+
</ins><span class="cx"> private:
</span><span class="cx"> ExpressionType emitCheckAndPreparePointer(ExpressionType pointer, uint32_t offset, uint32_t sizeOfOp);
</span><span class="cx"> ExpressionType emitLoadOp(LoadOpType, Origin, ExpressionType pointer, uint32_t offset);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmFunctionParserh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmFunctionParser.h (208289 => 208290)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmFunctionParser.h 2016-11-02 17:43:32 UTC (rev 208289)
+++ trunk/Source/JavaScriptCore/wasm/WasmFunctionParser.h 2016-11-02 17:48:23 UTC (rev 208290)
</span><span class="lines">@@ -56,6 +56,8 @@
</span><span class="cx"> bool WARN_UNUSED_RETURN parseUnreachableExpression(OpType);
</span><span class="cx"> bool WARN_UNUSED_RETURN unifyControl(Vector<ExpressionType>&, unsigned level);
</span><span class="cx">
</span><ins>+ bool WARN_UNUSED_RETURN popExpressionStack(ExpressionType& result);
+
</ins><span class="cx"> Context& m_context;
</span><span class="cx"> Vector<ExpressionType, 1> m_expressionStack;
</span><span class="cx"> Vector<ControlType> m_controlStack;
</span><span class="lines">@@ -144,8 +146,14 @@
</span><span class="cx"> {
</span><span class="cx"> switch (op) {
</span><span class="cx"> FOR_EACH_WASM_BINARY_OP(CREATE_CASE) {
</span><del>- ExpressionType right = m_expressionStack.takeLast();
- ExpressionType left = m_expressionStack.takeLast();
</del><ins>+ ExpressionType right;
+ if (!popExpressionStack(right))
+ return false;
+
+ ExpressionType left;
+ if (!popExpressionStack(left))
+ return false;
+
</ins><span class="cx"> ExpressionType result;
</span><span class="cx"> if (!m_context.binaryOp(static_cast<BinaryOpType>(op), left, right, result))
</span><span class="cx"> return false;
</span><span class="lines">@@ -154,9 +162,12 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> FOR_EACH_WASM_UNARY_OP(CREATE_CASE) {
</span><del>- ExpressionType arg = m_expressionStack.takeLast();
</del><ins>+ ExpressionType value;
+ if (!popExpressionStack(value))
+ return false;
+
</ins><span class="cx"> ExpressionType result;
</span><del>- if (!m_context.unaryOp(static_cast<UnaryOpType>(op), arg, result))
</del><ins>+ if (!m_context.unaryOp(static_cast<UnaryOpType>(op), value, result))
</ins><span class="cx"> return false;
</span><span class="cx"> m_expressionStack.append(result);
</span><span class="cx"> return true;
</span><span class="lines">@@ -171,7 +182,10 @@
</span><span class="cx"> if (!parseVarUInt32(offset))
</span><span class="cx"> return false;
</span><span class="cx">
</span><del>- ExpressionType pointer = m_expressionStack.takeLast();
</del><ins>+ ExpressionType pointer;
+ if (!popExpressionStack(pointer))
+ return false;
+
</ins><span class="cx"> ExpressionType result;
</span><span class="cx"> if (!m_context.load(static_cast<LoadOpType>(op), pointer, result, offset))
</span><span class="cx"> return false;
</span><span class="lines">@@ -188,8 +202,14 @@
</span><span class="cx"> if (!parseVarUInt32(offset))
</span><span class="cx"> return false;
</span><span class="cx">
</span><del>- ExpressionType value = m_expressionStack.takeLast();
- ExpressionType pointer = m_expressionStack.takeLast();
</del><ins>+ ExpressionType value;
+ if (!popExpressionStack(value))
+ return false;
+
+ ExpressionType pointer;
+ if (!popExpressionStack(pointer))
+ return false;
+
</ins><span class="cx"> return m_context.store(static_cast<StoreOpType>(op), pointer, value, offset);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -227,7 +247,9 @@
</span><span class="cx"> uint32_t index;
</span><span class="cx"> if (!parseVarUInt32(index))
</span><span class="cx"> return false;
</span><del>- ExpressionType value = m_expressionStack.takeLast();
</del><ins>+ ExpressionType value;
+ if (!popExpressionStack(value))
+ return false;
</ins><span class="cx"> return m_context.setLocal(index, value);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -284,7 +306,10 @@
</span><span class="cx"> if (!parseValueType(inlineSignature))
</span><span class="cx"> return false;
</span><span class="cx">
</span><del>- ExpressionType condition = m_expressionStack.takeLast();
</del><ins>+ ExpressionType condition;
+ if (!popExpressionStack(condition))
+ return false;
+
</ins><span class="cx"> ControlType control;
</span><span class="cx"> if (!m_context.addIf(condition, inlineSignature, control))
</span><span class="cx"> return false;
</span><span class="lines">@@ -294,6 +319,10 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case OpType::Else: {
</span><ins>+ if (!m_controlStack.size()) {
+ m_context.setErrorMessage("Attempted to use else block at the top-level of a function");
+ return false;
+ }
</ins><span class="cx"> return m_context.addElse(m_controlStack.last(), m_expressionStack);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -304,9 +333,10 @@
</span><span class="cx"> return false;
</span><span class="cx">
</span><span class="cx"> ExpressionType condition = Context::emptyExpression;
</span><del>- if (op == OpType::BrIf)
- condition = m_expressionStack.takeLast();
- else
</del><ins>+ if (op == OpType::BrIf) {
+ if (!popExpressionStack(condition))
+ return false;
+ } else
</ins><span class="cx"> m_unreachableBlocks = 1;
</span><span class="cx">
</span><span class="cx"> ControlType& data = m_controlStack[m_controlStack.size() - 1 - target];
</span><span class="lines">@@ -316,8 +346,11 @@
</span><span class="cx">
</span><span class="cx"> case OpType::Return: {
</span><span class="cx"> Vector<ExpressionType, 1> returnValues;
</span><del>- if (m_signature->returnType != Void)
- returnValues.append(m_expressionStack.takeLast());
</del><ins>+ if (m_signature->returnType != Void) {
+ ExpressionType returnValue;
+ if (!popExpressionStack(returnValue))
+ returnValues.append(returnValue);
+ }
</ins><span class="cx">
</span><span class="cx"> m_unreachableBlocks = 1;
</span><span class="cx"> return m_context.addReturn(returnValues);
</span><span class="lines">@@ -403,6 +436,18 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+template<typename Context>
+bool FunctionParser<Context>::popExpressionStack(ExpressionType& result)
+{
+ if (!m_expressionStack.size()) {
+ result = m_expressionStack.takeLast();
+ return true;
+ }
+
+ m_context.setErrorMessage("Attempted to use an stack value when none existed");
+ return false;
+}
+
</ins><span class="cx"> #undef CREATE_CASE
</span><span class="cx">
</span><span class="cx"> } } // namespace JSC::Wasm
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmValidatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmValidate.cpp (208289 => 208290)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmValidate.cpp 2016-11-02 17:43:32 UTC (rev 208289)
+++ trunk/Source/JavaScriptCore/wasm/WasmValidate.cpp 2016-11-02 17:48:23 UTC (rev 208290)
</span><span class="lines">@@ -104,6 +104,7 @@
</span><span class="cx">
</span><span class="cx"> void dump(const Vector<ControlType>& controlStack, const ExpressionList& expressionStack);
</span><span class="cx">
</span><ins>+ void setErrorMessage(String&& message) { ASSERT(m_errorMessage.isNull()); m_errorMessage = WTFMove(message); }
</ins><span class="cx"> String errorMessage() const { return m_errorMessage; }
</span><span class="cx"> Validate(ExpressionType returnType)
</span><span class="cx"> : m_returnType(returnType)
</span></span></pre>
</div>
</div>
</body>
</html>