Branch: refs/heads/main Home: https://github.com/WebKit/WebKit Commit: 370d7ae576389f08b9d9e4ae477c35dff89e4d08 https://github.com/WebKit/WebKit/commit/370d7ae576389f08b9d9e4ae477c35dff89e4d08 Author: Keith Miller <keith_mil...@apple.com> Date: 2023-09-21 (Thu, 21 Sep 2023)
Changed paths: A JSTests/wasm/stress/non-canonical-extended-ops.js M Source/JavaScriptCore/llint/InPlaceInterpreter.asm M Source/JavaScriptCore/wasm/WasmFunctionParser.h M Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp Log Message: ----------- IPInt should decode LEB for extended opcodes https://bugs.webkit.org/show_bug.cgi?id=261894 Reviewed by Yusuke Suzuki. Right now it assumes they are 1 byte, which 99.9% of the time they will be. It's technically correct, however, to non-canonically encode them as more than one byte. This patch adds a simple LEB UInt32 decoder to IPInt and uses it to decode the extended opcode. * JSTests/wasm/stress/non-canonical-extended-ops.js: Added. (instance): * Source/JavaScriptCore/llint/InPlaceInterpreter.asm: * Source/JavaScriptCore/wasm/WasmFunctionParser.h: (JSC::Wasm::FunctionParser<Context>::truncSaturated): * Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp: (JSC::Wasm::IPIntGenerator::addMemoryFill): (JSC::Wasm::IPIntGenerator::addMemoryCopy): (JSC::Wasm::IPIntGenerator::truncSaturated): Canonical link: https://commits.webkit.org/268300@main _______________________________________________ webkit-changes mailing list webkit-changes@lists.webkit.org https://lists.webkit.org/mailman/listinfo/webkit-changes