Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Cherry-pick 259548.25@safari-7615-branch (1a20160). rdar://104692168
Locals should update max stack size rdar://104692168 Reviewed by Yusuke Suzuki. We can forget to update the max stack size, causing an OOB stack read in OSR entry. This only happens if you create a bunch of locals and never push anything to the stack, so it should be very rare and difficult to abuse. * JSTests/wasm/stress/many-locals-small-wasm-stack.js: Added. (async let): * JSTests/wasm/stress/many-locals-small-wasm-stack.wasm: Added. * JSTests/wasm/stress/many-locals-small-wasm-stack.wat: Added. * Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::LLIntGenerator::addLocal): Canonical link: https://commits.webkit.org/259548.25@safari-7615-branch
- Loading branch information
1 parent
5751d86
commit c159a14
Showing
4 changed files
with
19 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,8 @@ | ||
//@ skip | ||
// This is an infinite loop, so untill watchdog works we have to skip it. | ||
(async function () { | ||
let bytes = readFile('many-locals-small-wasm-stack.wasm', 'binary'); | ||
let importObject = { }; | ||
let i = await WebAssembly.instantiate(bytes, importObject); | ||
i.instance.exports.main(0n, 0); | ||
})(); |
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
(module | ||
(global $g (mut i32) (i32.const 0)) | ||
(func $fn16 (export "main") (param $p0 i64) (param $p1 f64) | ||
(local $l2 i32) (local $l3 i64) (local $l4 funcref) (local $l5 funcref) (local $l6 funcref) (local $l7 i32) (local $l8 i32) (local $l9 i32) (local $l10 i32) (local $l11 f64) (local $l12 f64) (local $l13 f64) (local $l14 f64) (local $l15 f64) (local $l16 f64) (local $l17 f64) (local $l18 i64) (local $l19 i64) (local $l20 i64) (local $l21 f32) (local $l22 i32) (local $l23 i32) (local $l24 f32) (local $l25 f32) (local $l26 f64) (local $l27 f64) (local $l28 f64) (local $l29 f64) (local $l30 i64) (local $l31 i64) (local $l32 i64) (local $l33 i64) (local $l34 i64) | ||
(loop $L0 | ||
br $L0 | ||
) | ||
) | ||
) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters