<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[209642] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/209642">209642</a></dd>
<dt>Author</dt> <dd>jfbastien@apple.com</dd>
<dt>Date</dt> <dd>2016-12-09 18:34:02 -0800 (Fri, 09 Dec 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>WebAssembly JS API: implement start function
https://bugs.webkit.org/show_bug.cgi?id=165150

Reviewed by Saam Barati.

JSTests:

* wasm/Builder.js: allow building a .Start()
* wasm/Builder_WebAssemblyBinary.js:
* wasm/js-api/test_Start.js: Added.
(const.emitters.Start): serialize a start section
* wasm/self-test/test_BuilderJSON.js: validate the start section's content

Source/JavaScriptCore:

* wasm/WasmFormat.h: pass the start function around
* wasm/WasmModuleParser.cpp:
(JSC::Wasm::ModuleParser::parseTable): mark unreachable code
(JSC::Wasm::ModuleParser::parseGlobal): mark unreachable code
(JSC::Wasm::ModuleParser::parseStart): mark unreachable code
(JSC::Wasm::ModuleParser::parseElement): mark unreachable code
(JSC::Wasm::ModuleParser::parseData): mark unreachable code
* wasm/js/WebAssemblyFunction.cpp:
(JSC::callWebAssemblyFunction): NFC: call the new function below
(JSC::WebAssemblyFunction::call): separate this out so that the start function can use it
* wasm/js/WebAssemblyFunction.h:
* wasm/js/WebAssemblyModuleRecord.cpp:
(JSC::WebAssemblyModuleRecord::visitChildren): visit the start function
(JSC::WebAssemblyModuleRecord::link): handle start function
(JSC::WebAssemblyModuleRecord::evaluate): call the start function, if present
* wasm/js/WebAssemblyModuleRecord.h:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkJSTestsChangeLog">trunk/JSTests/ChangeLog</a></li>
<li><a href="#trunkJSTestswasmBuilderjs">trunk/JSTests/wasm/Builder.js</a></li>
<li><a href="#trunkJSTestswasmBuilder_WebAssemblyBinaryjs">trunk/JSTests/wasm/Builder_WebAssemblyBinary.js</a></li>
<li><a href="#trunkJSTestswasmselftesttest_BuilderJSONjs">trunk/JSTests/wasm/self-test/test_BuilderJSON.js</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmFormatcpp">trunk/Source/JavaScriptCore/wasm/WasmFormat.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmFormath">trunk/Source/JavaScriptCore/wasm/WasmFormat.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmWasmModuleParsercpp">trunk/Source/JavaScriptCore/wasm/WasmModuleParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyFunctioncpp">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyFunctionh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyModuleRecordcpp">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyModuleRecordh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkJSTestswasmjsapitest_Startjs">trunk/JSTests/wasm/js-api/test_Start.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkJSTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/JSTests/ChangeLog (209641 => 209642)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/ChangeLog        2016-12-10 02:03:45 UTC (rev 209641)
+++ trunk/JSTests/ChangeLog        2016-12-10 02:34:02 UTC (rev 209642)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2016-12-09  JF Bastien  &lt;jfbastien@apple.com&gt;
+
+        WebAssembly JS API: implement start function
+        https://bugs.webkit.org/show_bug.cgi?id=165150
+
+        Reviewed by Saam Barati.
+
+        * wasm/Builder.js: allow building a .Start()
+        * wasm/Builder_WebAssemblyBinary.js:
+        * wasm/js-api/test_Start.js: Added.
+        (const.emitters.Start): serialize a start section
+        * wasm/self-test/test_BuilderJSON.js: validate the start section's content
+
</ins><span class="cx"> 2016-12-09  Saam Barati  &lt;sbarati@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         WebAssembly JS API: implement importing and defining Memory
</span></span></pre></div>
<a id="trunkJSTestswasmBuilderjs"></a>
<div class="modfile"><h4>Modified: trunk/JSTests/wasm/Builder.js (209641 => 209642)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/wasm/Builder.js        2016-12-10 02:03:45 UTC (rev 209641)
+++ trunk/JSTests/wasm/Builder.js        2016-12-10 02:34:02 UTC (rev 209642)
</span><span class="lines">@@ -437,8 +437,16 @@
</span><span class="cx">                 break;
</span><span class="cx"> 
</span><span class="cx">             case &quot;Start&quot;:
</span><del>-                // FIXME implement start https://bugs.webkit.org/show_bug.cgi?id=161709
-                this[section] = () =&gt; { throw new Error(`Unimplemented: section type &quot;${section}&quot;`); };
</del><ins>+                this[section] = function(functionIndexOrName) {
+                    const s = this._addSection(section);
+                    const startBuilder = {
+                        End: () =&gt; this,
+                    };
+                    if (typeof(functionIndexOrName) !== &quot;number&quot; &amp;&amp; typeof(functionIndexOrName) !== &quot;string&quot;)
+                        throw new Error(`Start section's function index  must either be a number or a string`);
+                    s.data.push(functionIndexOrName);
+                    return startBuilder;
+                };
</ins><span class="cx">                 break;
</span><span class="cx"> 
</span><span class="cx">             case &quot;Element&quot;:
</span><span class="lines">@@ -456,6 +464,7 @@
</span><span class="cx">                             const typeSection = builder._getSection(&quot;Type&quot;);
</span><span class="cx">                             const importSection = builder._getSection(&quot;Import&quot;);
</span><span class="cx">                             const exportSection = builder._getSection(&quot;Export&quot;);
</span><ins>+                            const startSection = builder._getSection(&quot;Start&quot;);
</ins><span class="cx">                             const codeSection = s;
</span><span class="cx">                             if (exportSection) {
</span><span class="cx">                                 for (const e of exportSection.data) {
</span><span class="lines">@@ -488,6 +497,22 @@
</span><span class="cx">                                     }
</span><span class="cx">                                 }
</span><span class="cx">                             }
</span><ins>+                            if (startSection) {
+                                const start = startSection.data[0];
+                                let mapped = builder._getFunctionFromIndexSpace(start);
+                                if (!builder._checked) {
+                                    if (typeof(mapped) === &quot;undefined&quot;)
+                                        mapped = start; // In unchecked mode, simply use what was provided if it's nonsensical.
+                                    assert.isA(start, &quot;number&quot;); // It can't be too nonsensical, otherwise we can't create a binary.
+                                    startSection.data[0] = start;
+                                } else {
+                                    if (typeof(mapped) === &quot;undefined&quot;)
+                                        throw new Error(`Start section refers to non-existant function '${start}'`);
+                                    if (typeof(start) === &quot;string&quot; || typeof(start) === &quot;object&quot;)
+                                        startSection.data[0] = mapped;
+                                    // FIXME in checked mode, test that the type is acceptable for start function. We probably want _registerFunctionToIndexSpace to also register types per index. https://bugs.webkit.org/show_bug.cgi?id=165658
+                                }
+                            }
</ins><span class="cx">                             return builder;
</span><span class="cx">                         },
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkJSTestswasmBuilder_WebAssemblyBinaryjs"></a>
<div class="modfile"><h4>Modified: trunk/JSTests/wasm/Builder_WebAssemblyBinary.js (209641 => 209642)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/wasm/Builder_WebAssemblyBinary.js        2016-12-10 02:03:45 UTC (rev 209641)
+++ trunk/JSTests/wasm/Builder_WebAssemblyBinary.js        2016-12-10 02:34:02 UTC (rev 209642)
</span><span class="lines">@@ -115,7 +115,9 @@
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx">     },
</span><del>-    Start: (section, bin) =&gt; { throw new Error(`Not yet implemented`); },
</del><ins>+    Start: (section, bin) =&gt; {
+        put(bin, &quot;varuint32&quot;, section.data[0]);
+    },
</ins><span class="cx">     Element: (section, bin) =&gt; { throw new Error(`Not yet implemented`); },
</span><span class="cx"> 
</span><span class="cx">     Code: (section, bin) =&gt; {
</span></span></pre></div>
<a id="trunkJSTestswasmjsapitest_Startjs"></a>
<div class="addfile"><h4>Added: trunk/JSTests/wasm/js-api/test_Start.js (0 => 209642)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/wasm/js-api/test_Start.js                                (rev 0)
+++ trunk/JSTests/wasm/js-api/test_Start.js        2016-12-10 02:34:02 UTC (rev 209642)
</span><span class="lines">@@ -0,0 +1,35 @@
</span><ins>+import * as assert from '../assert.js';
+import Builder from '../Builder.js';
+
+(function StartNamedFunction() {
+    const b = (new Builder())
+        .Type().End()
+        .Import()
+            .Function(&quot;imp&quot;, &quot;func&quot;, { params: [&quot;i32&quot;] })
+        .End()
+        .Function().End()
+        .Start(&quot;foo&quot;).End()
+        .Code()
+            .Function(&quot;foo&quot;, { params: [] })
+                .I32Const(42)
+                .Call(0) // Calls func(42).
+            .End()
+        .End();
+    const bin = b.WebAssembly().get();
+    const module = new WebAssembly.Module(bin);
+    let value = 0;
+    const setter = v =&gt; value = v;
+    const instance = new WebAssembly.Instance(module, { imp: { func: setter } });
+    assert.eq(value, 42);
+})();
+
+(function InvalidStartFunctionIndex() {
+    const b = (new Builder())
+        .setChecked(false)
+        .Type().End()
+        .Function().End()
+        .Start(0).End() // Invalid index.
+        .Code().End();
+    const bin = b.WebAssembly().get();
+    assert.throws(() =&gt; new WebAssembly.Module(bin), Error, `couldn't parse section Start: Start function declaration (evaluating 'new WebAssembly.Module(bin)')`);
+})();
</ins></span></pre></div>
<a id="trunkJSTestswasmselftesttest_BuilderJSONjs"></a>
<div class="modfile"><h4>Modified: trunk/JSTests/wasm/self-test/test_BuilderJSON.js (209641 => 209642)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/wasm/self-test/test_BuilderJSON.js        2016-12-10 02:03:45 UTC (rev 209641)
+++ trunk/JSTests/wasm/self-test/test_BuilderJSON.js        2016-12-10 02:34:02 UTC (rev 209642)
</span><span class="lines">@@ -241,6 +241,57 @@
</span><span class="cx">     assert.throws(() =&gt; e.Function(&quot;foo&quot;, 0, { params: [&quot;i32&quot;] }), Error, `Not the same: &quot;1&quot; and &quot;0&quot;: Re-exporting import &quot;bar&quot; as &quot;foo&quot; has mismatching type`);
</span><span class="cx"> })();
</span><span class="cx"> 
</span><ins>+(function StartInvalidNumberedFunction() {
+    const b = (new Builder())
+        .Type().End()
+        .Function().End()
+        .Start(0).End()
+    assert.throws(() =&gt; b.Code().End(), Error, `Start section refers to non-existant function '0'`);
+})();
+
+(function StartInvalidNamedFunction() {
+    const b = (new Builder())
+        .Type().End()
+        .Function().End()
+        .Start(&quot;foo&quot;).End();
+    assert.throws(() =&gt; b.Code().End(), Error, `Start section refers to non-existant function 'foo'`);
+})();
+
+(function StartNamedFunction() {
+    const b = (new Builder())
+        .Type().End()
+        .Function().End()
+        .Start(&quot;foo&quot;).End()
+        .Code()
+            .Function(&quot;foo&quot;, { params: [] }).End()
+        .End();
+    const j = JSON.parse(b.json());
+    assert.eq(j.section.length, 4);
+    assert.eq(j.section[2].name, &quot;Start&quot;);
+    assert.eq(j.section[2].data.length, 1);
+    assert.eq(j.section[2].data[0], 0);
+})();
+
+/* FIXME implement checking of signature https://bugs.webkit.org/show_bug.cgi?id=165658
+(function StartInvalidTypeArg() {
+    const b = (new Builder())
+        .Type().End()
+        .Function().End()
+        .Start(&quot;foo&quot;).End()
+    assert.throws(() =&gt; b.Code().Function(&quot;foo&quot;, { params: [&quot;i32&quot;] }).End(), Error, `???`);
+})();
+
+(function StartInvalidTypeReturn() {
+    const b = (new Builder())
+        .Type().End()
+        .Function().End()
+        .Start(&quot;foo&quot;).End()
+    assert.throws(() =&gt; b.Code().Function(&quot;foo&quot;, { params: [], ret: &quot;i32&quot; }).I32Const(42).Ret().End(), Error, `???`);
+})();
+*/
+
+// FIXME test start of import or table. https://bugs.webkit.org/show_bug.cgi?id=165658
+
</ins><span class="cx"> (function EmptyCodeSection() {
</span><span class="cx">     const b = new Builder();
</span><span class="cx">     b.Code();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (209641 => 209642)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-12-10 02:03:45 UTC (rev 209641)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-12-10 02:34:02 UTC (rev 209642)
</span><span class="lines">@@ -1,3 +1,27 @@
</span><ins>+2016-12-09  JF Bastien  &lt;jfbastien@apple.com&gt;
+
+        WebAssembly JS API: implement start function
+        https://bugs.webkit.org/show_bug.cgi?id=165150
+
+        Reviewed by Saam Barati.
+
+        * wasm/WasmFormat.h: pass the start function around
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parseTable): mark unreachable code
+        (JSC::Wasm::ModuleParser::parseGlobal): mark unreachable code
+        (JSC::Wasm::ModuleParser::parseStart): mark unreachable code
+        (JSC::Wasm::ModuleParser::parseElement): mark unreachable code
+        (JSC::Wasm::ModuleParser::parseData): mark unreachable code
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::callWebAssemblyFunction): NFC: call the new function below
+        (JSC::WebAssemblyFunction::call): separate this out so that the start function can use it
+        * wasm/js/WebAssemblyFunction.h:
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::visitChildren): visit the start function
+        (JSC::WebAssemblyModuleRecord::link): handle start function
+        (JSC::WebAssemblyModuleRecord::evaluate): call the start function, if present
+        * wasm/js/WebAssemblyModuleRecord.h:
+
</ins><span class="cx"> 2016-12-09  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         GC might be forced to look at a nuked object due to ordering of AllocatePropertyStorage, MaterializeNewObject, and PutStructure
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmFormatcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmFormat.cpp (209641 => 209642)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmFormat.cpp        2016-12-10 02:03:45 UTC (rev 209641)
+++ trunk/Source/JavaScriptCore/wasm/WasmFormat.cpp        2016-12-10 02:34:02 UTC (rev 209642)
</span><span class="lines">@@ -33,6 +33,8 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC { namespace Wasm {
</span><span class="cx"> 
</span><ins>+JS_EXPORT_PRIVATE ModuleInformation::~ModuleInformation() { }
+
</ins><span class="cx"> } } // namespace JSC::Wasm
</span><span class="cx"> 
</span><span class="cx"> #endif // ENABLE(WEBASSEMBLY)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmFormath"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmFormat.h (209641 => 209642)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmFormat.h        2016-12-10 02:03:45 UTC (rev 209641)
+++ trunk/Source/JavaScriptCore/wasm/WasmFormat.h        2016-12-10 02:34:02 UTC (rev 209642)
</span><span class="lines">@@ -35,6 +35,7 @@
</span><span class="cx"> #include &quot;WasmMemoryInformation.h&quot;
</span><span class="cx"> #include &quot;WasmOps.h&quot;
</span><span class="cx"> #include &quot;WasmPageCount.h&quot;
</span><ins>+#include &lt;wtf/Optional.h&gt;
</ins><span class="cx"> #include &lt;wtf/Vector.h&gt;
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -123,6 +124,9 @@
</span><span class="cx">     Vector&lt;Signature*&gt; internalFunctionSignatures;
</span><span class="cx">     MemoryInformation memory;
</span><span class="cx">     Vector&lt;Export&gt; exports;
</span><ins>+    std::optional&lt;uint32_t&gt; startFunctionIndexSpace;
+
+    ~ModuleInformation();
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> struct UnlinkedWasmToWasmCall {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmWasmModuleParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/WasmModuleParser.cpp (209641 => 209642)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/WasmModuleParser.cpp        2016-12-10 02:03:45 UTC (rev 209641)
+++ trunk/Source/JavaScriptCore/wasm/WasmModuleParser.cpp        2016-12-10 02:34:02 UTC (rev 209642)
</span><span class="lines">@@ -303,7 +303,8 @@
</span><span class="cx"> 
</span><span class="cx"> bool ModuleParser::parseTable()
</span><span class="cx"> {
</span><del>-    // FIXME
</del><ins>+    // FIXME implement table https://bugs.webkit.org/show_bug.cgi?id=164135
+    RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -365,6 +366,7 @@
</span><span class="cx"> bool ModuleParser::parseGlobal()
</span><span class="cx"> {
</span><span class="cx">     // FIXME https://bugs.webkit.org/show_bug.cgi?id=164133
</span><ins>+    RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -415,7 +417,15 @@
</span><span class="cx"> 
</span><span class="cx"> bool ModuleParser::parseStart()
</span><span class="cx"> {
</span><del>-    // FIXME https://bugs.webkit.org/show_bug.cgi?id=161709
</del><ins>+    uint32_t startFunctionIndex;
+    if (!parseVarUInt32(startFunctionIndex)
+        || startFunctionIndex &gt;= m_functionIndexSpace.size())
+        return false;
+    Signature* signature = m_functionIndexSpace[startFunctionIndex].signature;
+    if (signature-&gt;arguments.size() != 0
+        || signature-&gt;returnType != Void)
+        return false;
+    m_module-&gt;startFunctionIndexSpace = startFunctionIndex;
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -422,6 +432,7 @@
</span><span class="cx"> bool ModuleParser::parseElement()
</span><span class="cx"> {
</span><span class="cx">     // FIXME https://bugs.webkit.org/show_bug.cgi?id=161709
</span><ins>+    RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -450,6 +461,7 @@
</span><span class="cx"> bool ModuleParser::parseData()
</span><span class="cx"> {
</span><span class="cx">     // FIXME https://bugs.webkit.org/show_bug.cgi?id=161709
</span><ins>+    RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyFunctioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp (209641 => 209642)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp        2016-12-10 02:03:45 UTC (rev 209641)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp        2016-12-10 02:34:02 UTC (rev 209642)
</span><span class="lines">@@ -92,8 +92,20 @@
</span><span class="cx">         argCount = boxedArgs.size();
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    // Note: we specifically use the WebAssemblyFunction as the callee to begin with in the ProtoCallFrame.
+    // The reason for this is that calling into the llint may stack overflow, and the stack overflow
+    // handler might read the global object from the callee. The JSWebAssemblyCallee doesn't have a
+    // global object, but the WebAssemblyFunction does.
+    ProtoCallFrame protoCallFrame;
+    protoCallFrame.init(nullptr, wasmFunction, firstArgument, argCount, remainingArgs);
+
+    return wasmFunction-&gt;call(vm, &amp;protoCallFrame);
+}
+
+EncodedJSValue WebAssemblyFunction::call(VM&amp; vm, ProtoCallFrame* protoCallFrame)
+{
</ins><span class="cx">     // Setup the memory that the entrance loads.
</span><del>-    if (JSWebAssemblyMemory* memory = wasmFunction-&gt;instance()-&gt;memory()) {
</del><ins>+    if (JSWebAssemblyMemory* memory = instance()-&gt;memory()) {
</ins><span class="cx">         Wasm::Memory* wasmMemory = memory-&gt;memory();
</span><span class="cx">         vm.topWasmMemoryPointer = wasmMemory-&gt;memory();
</span><span class="cx">         vm.topWasmMemorySize = wasmMemory-&gt;size();
</span><span class="lines">@@ -102,20 +114,13 @@
</span><span class="cx">         vm.topWasmMemorySize = 0;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    // Note: we specifically use the WebAsseblyFunction as the callee to begin with in the ProtoCallFrame.
-    // The reason for this is that calling into the llint may stack overflow, and the stack overflow
-    // handler might read the global object from the callee. The JSWebAssemblyCallee doesn't have a
-    // global object, but the WebAssemblyFunction does.
-    ProtoCallFrame protoCallFrame;
-    protoCallFrame.init(nullptr, wasmFunction, firstArgument, argCount, remainingArgs);
-    
</del><span class="cx">     JSWebAssemblyInstance* prevJSWebAssemblyInstance = vm.topJSWebAssemblyInstance;
</span><del>-    vm.topJSWebAssemblyInstance = wasmFunction-&gt;instance();
-    EncodedJSValue rawResult = vmEntryToWasm(wasmFunction-&gt;webAssemblyCallee()-&gt;jsToWasmEntryPoint(), &amp;vm, &amp;protoCallFrame);
</del><ins>+    vm.topJSWebAssemblyInstance = instance();
+    EncodedJSValue rawResult = vmEntryToWasm(webAssemblyCallee()-&gt;jsToWasmEntryPoint(), &amp;vm, protoCallFrame);
</ins><span class="cx">     vm.topJSWebAssemblyInstance = prevJSWebAssemblyInstance;
</span><span class="cx"> 
</span><span class="cx">     // FIXME is this correct? https://bugs.webkit.org/show_bug.cgi?id=164876
</span><del>-    switch (signature-&gt;returnType) {
</del><ins>+    switch (signature()-&gt;returnType) {
</ins><span class="cx">     case Wasm::Void:
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     case Wasm::I32:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyFunctionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h (209641 => 209642)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h        2016-12-10 02:03:45 UTC (rev 209641)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h        2016-12-10 02:34:02 UTC (rev 209642)
</span><span class="lines">@@ -34,6 +34,7 @@
</span><span class="cx"> 
</span><span class="cx"> class JSGlobalObject;
</span><span class="cx"> class JSWebAssemblyCallee;
</span><ins>+struct ProtoCallFrame;
</ins><span class="cx"> class WebAssemblyInstance;
</span><span class="cx"> 
</span><span class="cx"> namespace B3 {
</span><span class="lines">@@ -62,6 +63,7 @@
</span><span class="cx">         ASSERT(m_signature);
</span><span class="cx">         return m_signature;
</span><span class="cx">     }
</span><ins>+    EncodedJSValue call(VM&amp;, ProtoCallFrame*);
</ins><span class="cx"> 
</span><span class="cx"> protected:
</span><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyModuleRecordcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp (209641 => 209642)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp        2016-12-10 02:03:45 UTC (rev 209641)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp        2016-12-10 02:34:02 UTC (rev 209642)
</span><span class="lines">@@ -34,8 +34,10 @@
</span><span class="cx"> #include &quot;JSModuleEnvironment.h&quot;
</span><span class="cx"> #include &quot;JSWebAssemblyInstance.h&quot;
</span><span class="cx"> #include &quot;JSWebAssemblyModule.h&quot;
</span><ins>+#include &quot;ProtoCallFrame.h&quot;
</ins><span class="cx"> #include &quot;WasmFormat.h&quot;
</span><span class="cx"> #include &quot;WebAssemblyFunction.h&quot;
</span><ins>+#include &lt;limits&gt;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="lines">@@ -96,6 +98,7 @@
</span><span class="cx">     WebAssemblyModuleRecord* thisObject = jsCast&lt;WebAssemblyModuleRecord*&gt;(cell);
</span><span class="cx">     Base::visitChildren(thisObject, visitor);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_instance);
</span><ins>+    visitor.append(&amp;thisObject-&gt;m_startFunction);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void WebAssemblyModuleRecord::link(ExecState* state, JSWebAssemblyInstance* instance)
</span><span class="lines">@@ -107,6 +110,10 @@
</span><span class="cx"> 
</span><span class="cx">     JSWebAssemblyModule* module = instance-&gt;module();
</span><span class="cx">     const Wasm::ModuleInformation&amp; moduleInformation = module-&gt;moduleInformation();
</span><ins>+
+    bool hasStart = !!moduleInformation.startFunctionIndexSpace;
+    auto startFunctionIndexSpace = moduleInformation.startFunctionIndexSpace.value_or(0);
+
</ins><span class="cx">     SymbolTable* exportSymbolTable = module-&gt;exportSymbolTable();
</span><span class="cx">     unsigned importCount = module-&gt;importCount();
</span><span class="cx"> 
</span><span class="lines">@@ -133,6 +140,8 @@
</span><span class="cx">             Wasm::Signature* signature = module-&gt;signatureForFunctionIndexSpace(exp.functionIndex);
</span><span class="cx">             WebAssemblyFunction* function = WebAssemblyFunction::create(vm, globalObject, signature-&gt;arguments.size(), exp.field.string(), instance, wasmCallee, signature);
</span><span class="cx">             exportedValue = function;
</span><ins>+            if (hasStart &amp;&amp; startFunctionIndexSpace == exp.functionIndex)
+                m_startFunction.set(vm, this, function);
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case Wasm::External::Table: {
</span><span class="lines">@@ -157,6 +166,20 @@
</span><span class="cx">         RELEASE_ASSERT(putResult);
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    if (hasStart) {
+        Wasm::Signature* signature = module-&gt;signatureForFunctionIndexSpace(startFunctionIndexSpace);
+        // The start function must not take any arguments or return anything. This is enforced by the parser.
+        ASSERT(!signature-&gt;arguments.size());
+        ASSERT(signature-&gt;returnType == Wasm::Void);
+        // FIXME can start call imports / tables? This assumes not. https://github.com/WebAssembly/design/issues/896
+        if (!m_startFunction.get()) {
+            // The start function wasn't added above. It must be a purely internal function.
+            JSWebAssemblyCallee* wasmCallee = module-&gt;calleeFromFunctionIndexSpace(startFunctionIndexSpace);
+            WebAssemblyFunction* function = WebAssemblyFunction::create(vm, globalObject, signature-&gt;arguments.size(), &quot;start&quot;, instance, wasmCallee, signature);
+            m_startFunction.set(vm, this, function);
+        }
+    }
+
</ins><span class="cx">     RELEASE_ASSERT(!m_instance);
</span><span class="cx">     m_instance.set(vm, this, instance);
</span><span class="cx">     m_moduleEnvironment.set(vm, this, moduleEnvironment);
</span><span class="lines">@@ -164,10 +187,14 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue WebAssemblyModuleRecord::evaluate(ExecState* state)
</span><span class="cx"> {
</span><del>-    // FIXME this should call the module's `start` function, if any. https://bugs.webkit.org/show_bug.cgi?id=165150
-    // https://github.com/WebAssembly/design/blob/master/Modules.md#module-start-function
-    // The start function must not take any arguments or return anything
-    UNUSED_PARAM(state);
</del><ins>+    if (WebAssemblyFunction* startFunction = m_startFunction.get()) {
+        VM&amp; vm = state-&gt;vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        ProtoCallFrame protoCallFrame;
+        protoCallFrame.init(nullptr, startFunction, JSValue(), 1, nullptr);
+        startFunction-&gt;call(vm, &amp;protoCallFrame);
+        RETURN_IF_EXCEPTION(scope, { });
+    }
</ins><span class="cx">     return jsUndefined();
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyModuleRecordh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.h (209641 => 209642)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.h        2016-12-10 02:03:45 UTC (rev 209641)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.h        2016-12-10 02:34:02 UTC (rev 209642)
</span><span class="lines">@@ -33,6 +33,7 @@
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="cx"> class JSWebAssemblyInstance;
</span><ins>+class WebAssemblyFunction;
</ins><span class="cx"> 
</span><span class="cx"> // Based on the WebAssembly.Instance specification
</span><span class="cx"> // https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-constructor
</span><span class="lines">@@ -58,6 +59,7 @@
</span><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><span class="cx"> 
</span><span class="cx">     WriteBarrier&lt;JSWebAssemblyInstance&gt; m_instance;
</span><ins>+    WriteBarrier&lt;WebAssemblyFunction&gt; m_startFunction;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre>
</div>
</div>

</body>
</html>