Skip to content

Commit e20e347

Browse files
ofrobotsBethGriggs
ofrobots
authored and
BethGriggs
committed
deps: V8: backport 442977e
Original commit message: Merged: [wasm] Fix dispatch table instance update This CL fixes a bug where the receiving instance was updated improperly in the dispatch table(s) of an imported table. BUG=chromium:875322 R=​[email protected] [email protected] Change-Id: Iff24953a1fb6a8ab794e12a7a976d544b56fc3c2 Originally-reviewed-on: https://chromium-review.googlesource.com/1196886 No-Try: true No-Presubmit: true No-Treechecks: true Reviewed-on: https://chromium-review.googlesource.com/1212922 Reviewed-by: Michael Starzinger <[email protected]> Commit-Queue: Clemens Hammacher <[email protected]> Cr-Commit-Position: refs/branch-heads/6.9@{#45} Cr-Branched-From: d7b61abe7b48928aed739f02bf7695732d359e7e-refs/heads/6.9.427@{#1} Cr-Branched-From: b7e108d6016bf6b7de3a34e6d61cb522f5193460-refs/heads/master@{#54504} Refs: v8/v8@442977e PR-URL: #25242 Reviewed-By: Michaël Zasso <[email protected]>
1 parent 450bcde commit e20e347

File tree

3 files changed

+252
-9
lines changed

3 files changed

+252
-9
lines changed

‎common.gypi

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333

3434
# Reset this number to 0 on major V8 upgrades.
3535
# Increment by one for each non-official patch applied to deps/v8.
36-
'v8_embedder_string': '-node.12',
36+
'v8_embedder_string': '-node.48',
3737

3838
# Enable disassembler for `--print-code` v8 options
3939
'v8_enable_disassembler': 1,

‎deps/v8/src/wasm/module-compiler.cc

+7-8
Original file line numberDiff line numberDiff line change
@@ -2653,20 +2653,20 @@ void InstanceBuilder::LoadTableSegments(Handle<WasmInstanceObject> instance) {
26532653

26542654
// Update the local dispatch table first.
26552655
uint32_t sig_id = module_->signature_ids[function->sig_index];
2656-
WasmInstanceObject* target_instance = *instance;
2656+
Handle<WasmInstanceObject> target_instance = instance;
26572657
Address call_target;
26582658
const bool is_import = func_index < module_->num_imported_functions;
26592659
if (is_import) {
26602660
// For imported calls, take target instance and address from the
26612661
// import table.
26622662
ImportedFunctionEntry entry(instance, func_index);
2663-
target_instance = entry.instance();
2663+
target_instance = handle(entry.instance(), isolate_);
26642664
call_target = entry.target();
26652665
} else {
26662666
call_target = native_module->GetCallTargetForFunction(func_index);
26672667
}
26682668
IndirectFunctionTableEntry(instance, table_index)
2669-
.set(sig_id, target_instance, call_target);
2669+
.set(sig_id, *target_instance, call_target);
26702670

26712671
if (!table_instance.table_object.is_null()) {
26722672
// Update the table object's other dispatch tables.
@@ -2700,17 +2700,16 @@ void InstanceBuilder::LoadTableSegments(Handle<WasmInstanceObject> instance) {
27002700
}
27012701
table_instance.js_wrappers->set(table_index,
27022702
*js_wrappers_[func_index]);
2703-
// UpdateDispatchTables() should update this instance as well.
2703+
// UpdateDispatchTables() updates all other dispatch tables, since
2704+
// we have not yet added the dispatch table we are currently building.
27042705
WasmTableObject::UpdateDispatchTables(
27052706
isolate_, table_instance.table_object, table_index, function->sig,
2706-
instance, call_target);
2707+
target_instance, call_target);
27072708
}
27082709
}
27092710
}
27102711

2711-
// TODO(titzer): we add the new dispatch table at the end to avoid
2712-
// redundant work and also because the new instance is not yet fully
2713-
// initialized.
2712+
// Add the new dispatch table at the end to avoid redundant lookups.
27142713
if (!table_instance.table_object.is_null()) {
27152714
// Add the new dispatch table to the WebAssembly.Table object.
27162715
WasmTableObject::AddDispatchTable(isolate_, table_instance.table_object,

‎deps/v8/test/mjsunit/wasm/import-table.js

+244
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,244 @@
1+
// Copyright 2018 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --expose-wasm
6+
7+
load("test/mjsunit/wasm/wasm-constants.js");
8+
load("test/mjsunit/wasm/wasm-module-builder.js");
9+
10+
function addConstFunc(builder, val) {
11+
return builder.addFunction("const" + val, kSig_i_v)
12+
.addBody(wasmI32Const(val)).index;
13+
}
14+
15+
function addSigs(builder, pad) {
16+
for (let i = 0; i < pad; i++) {
17+
let params = [];
18+
for (let j = 0; j < i; j++) params.push(kWasmF32);
19+
builder.addType(makeSig(params, []));
20+
}
21+
22+
return { i_v: builder.addType(kSig_i_v) };
23+
}
24+
25+
let kTableSize = 50;
26+
27+
(function TestAliasedImportedTable() {
28+
print(arguments.callee.name);
29+
30+
{
31+
let builder = new WasmModuleBuilder();
32+
let signums = addSigs(builder, 1);
33+
34+
builder.addImportedTable("m", "table", kTableSize, kTableSize);
35+
let f15 = addConstFunc(builder, 15);
36+
let call = builder.addFunction("call", kSig_i_i)
37+
.addBody([
38+
kExprGetLocal, 0,
39+
kExprCallIndirect, signums.i_v, kTableZero
40+
])
41+
.exportAs("call");
42+
let f17 = addConstFunc(builder, 17);
43+
builder.addExport("f15", f15);
44+
builder.addExport("f17", f17);
45+
builder.addFunctionTableInit(15, false, [f15], true);
46+
builder.addFunctionTableInit(1, false, [call.index], true);
47+
48+
var mod1 = builder.toModule();
49+
}
50+
51+
{
52+
let builder = new WasmModuleBuilder();
53+
let signums = addSigs(builder, 5); // ensure different sigids
54+
55+
builder.addImportedTable("m", "table", kTableSize, kTableSize);
56+
let f15 = builder.addImport("m", "f15", kSig_i_v);
57+
let f17 = builder.addImport("m", "f17", kSig_i_v);
58+
let f21 = addConstFunc(builder, 21);
59+
let call = builder.addFunction("call", kSig_i_i)
60+
.addBody([
61+
kExprGetLocal, 0,
62+
kExprCallIndirect, signums.i_v, kTableZero
63+
])
64+
.exportAs("call");
65+
let f26 = addConstFunc(builder, 26);
66+
builder.addFunctionTableInit(17, false, [f17], true);
67+
builder.addFunctionTableInit(21, false, [f21], true);
68+
builder.addFunctionTableInit(26, false, [f26], true);
69+
builder.addFunctionTableInit(5, false, [call.index], true);
70+
71+
var mod2 = builder.toModule();
72+
}
73+
74+
var table = new WebAssembly.Table({initial: kTableSize,
75+
maximum: kTableSize, element: "anyfunc"});
76+
var i1 = new WebAssembly.Instance(mod1, {m: {table: table}});
77+
78+
var i2 = new WebAssembly.Instance(mod2,
79+
{m: {table: table, f15: i1.exports.f15, f17: i1.exports.f17}});
80+
81+
for (i of [15, 17, 21, 26]) {
82+
print(i);
83+
assertEquals(i, i1.exports.call(i));
84+
assertEquals(i, i2.exports.call(i));
85+
}
86+
for (i of [0, 1, 5, 16]) {
87+
assertThrows(() => i1.exports.call(i));
88+
assertThrows(() => i2.exports.call(i));
89+
}
90+
})();
91+
92+
function addConstFuncUsingGlobal(builder, val) {
93+
let g = builder.addGlobal(kWasmI32, false);
94+
g.init = val;
95+
return builder.addFunction("global" + val, kSig_i_v)
96+
.addBody([kExprGetGlobal, g.index]).index;
97+
}
98+
99+
(function TestAliasedImportedTableInstanceGlobals() {
100+
print(arguments.callee.name);
101+
102+
{
103+
let builder = new WasmModuleBuilder();
104+
let signums = addSigs(builder, 1);
105+
106+
builder.addImportedTable("m", "table", kTableSize, kTableSize);
107+
let f14 = addConstFuncUsingGlobal(builder, 14);
108+
let call = builder.addFunction("call", kSig_i_i)
109+
.addBody([
110+
kExprGetLocal, 0,
111+
kExprCallIndirect, signums.i_v, kTableZero
112+
])
113+
.exportAs("call");
114+
let f18 = addConstFuncUsingGlobal(builder, 18);
115+
builder.addExport("f14", f14);
116+
builder.addExport("f18", f18);
117+
builder.addFunctionTableInit(14, false, [f14], true);
118+
builder.addFunctionTableInit(1, false, [call.index], true);
119+
120+
var mod1 = builder.toModule();
121+
}
122+
123+
{
124+
let builder = new WasmModuleBuilder();
125+
let signums = addSigs(builder, 3); // ensure different sigids
126+
127+
builder.addImportedTable("m", "table", kTableSize, kTableSize);
128+
let f14 = builder.addImport("m", "f14", kSig_i_v);
129+
let f18 = builder.addImport("m", "f18", kSig_i_v);
130+
let f22 = addConstFuncUsingGlobal(builder, 22);
131+
let call = builder.addFunction("call", kSig_i_i)
132+
.addBody([
133+
kExprGetLocal, 0,
134+
kExprCallIndirect, signums.i_v, kTableZero
135+
])
136+
.exportAs("call");
137+
let f28 = addConstFuncUsingGlobal(builder, 28);
138+
builder.addFunctionTableInit(18, false, [f18], true);
139+
builder.addFunctionTableInit(22, false, [f22], true);
140+
builder.addFunctionTableInit(28, false, [f28], true);
141+
builder.addFunctionTableInit(5, false, [call.index], true);
142+
143+
var mod2 = builder.toModule();
144+
}
145+
146+
var table = new WebAssembly.Table({initial: kTableSize,
147+
maximum: kTableSize, element: "anyfunc"});
148+
var i1 = new WebAssembly.Instance(mod1, {m: {table: table}});
149+
150+
var i2 = new WebAssembly.Instance(mod2,
151+
{m: {table: table, f14: i1.exports.f14, f18: i1.exports.f18}});
152+
153+
for (i of [14, 18, 22, 28]) {
154+
print(i);
155+
assertEquals(i, i1.exports.call(i));
156+
assertEquals(i, i2.exports.call(i));
157+
}
158+
for (i of [0, 1, 5, 16]) {
159+
assertThrows(() => i1.exports.call(i));
160+
assertThrows(() => i2.exports.call(i));
161+
}
162+
})();
163+
164+
165+
function addConstFuncUsingMemory(builder, val) {
166+
var addr = builder.address;
167+
builder.address += 8;
168+
var bytes = [val & 0xff, (val>>8) & 0xff, (val>>16) & 0xff, (val>>24) & 0xff];
169+
builder.addDataSegment(addr, bytes);
170+
return builder.addFunction("mem" + val, kSig_i_v)
171+
.addBody([
172+
...wasmI32Const(addr),
173+
kExprI32LoadMem, 0, 0
174+
]).index;
175+
}
176+
177+
(function TestAliasedImportedTableInstanceMemories() {
178+
print(arguments.callee.name);
179+
180+
{
181+
let builder = new WasmModuleBuilder();
182+
builder.address = 8;
183+
let signums = addSigs(builder, 1);
184+
185+
builder.addMemory(1, 1, false);
186+
builder.addImportedTable("m", "table", kTableSize, kTableSize);
187+
let f13 = addConstFuncUsingMemory(builder, 13);
188+
let call = builder.addFunction("call", kSig_i_i)
189+
.addBody([
190+
kExprGetLocal, 0,
191+
kExprCallIndirect, signums.i_v, kTableZero
192+
])
193+
.exportAs("call");
194+
let f19 = addConstFuncUsingMemory(builder, 19);
195+
builder.addExport("f13", f13);
196+
builder.addExport("f19", f19);
197+
builder.addFunctionTableInit(13, false, [f13], true);
198+
builder.addFunctionTableInit(1, false, [call.index], true);
199+
200+
var mod1 = builder.toModule();
201+
}
202+
203+
{
204+
let builder = new WasmModuleBuilder();
205+
builder.address = 8;
206+
let signums = addSigs(builder, 4); // ensure different sigids
207+
208+
builder.addMemory(1, 1, false);
209+
builder.addImportedTable("m", "table", kTableSize, kTableSize);
210+
let f13 = builder.addImport("m", "f13", kSig_i_v);
211+
let f19 = builder.addImport("m", "f19", kSig_i_v);
212+
let f23 = addConstFuncUsingMemory(builder, 23);
213+
let call = builder.addFunction("call", kSig_i_i)
214+
.addBody([
215+
kExprGetLocal, 0,
216+
kExprCallIndirect, signums.i_v, kTableZero
217+
])
218+
.exportAs("call");
219+
let f29 = addConstFuncUsingMemory(builder, 29);
220+
builder.addFunctionTableInit(19, false, [f19], true);
221+
builder.addFunctionTableInit(23, false, [f23], true);
222+
builder.addFunctionTableInit(29, false, [f29], true);
223+
builder.addFunctionTableInit(5, false, [call.index], true);
224+
225+
var mod2 = builder.toModule();
226+
}
227+
228+
var table = new WebAssembly.Table({initial: kTableSize,
229+
maximum: kTableSize, element: "anyfunc"});
230+
var i1 = new WebAssembly.Instance(mod1, {m: {table: table}});
231+
232+
var i2 = new WebAssembly.Instance(mod2,
233+
{m: {table: table, f13: i1.exports.f13, f19: i1.exports.f19}});
234+
235+
for (i of [13, 19, 23, 29]) {
236+
print(i);
237+
assertEquals(i, i1.exports.call(i));
238+
assertEquals(i, i2.exports.call(i));
239+
}
240+
for (i of [0, 1, 5, 16]) {
241+
assertThrows(() => i1.exports.call(i));
242+
assertThrows(() => i2.exports.call(i));
243+
}
244+
})();

0 commit comments

Comments
 (0)