Changeset 209652 in webkit for trunk/Source/JavaScriptCore/wasm/WasmValidate.cpp

Timestamp:

Dec 9, 2016, 11:12:53 PM (9 years ago)

Author:

[email protected]

Message:

Wasm should support call_indirect
​https://bugs.webkit.org/show_bug.cgi?id=165718

Reviewed by Filip Pizlo.

JSTests:

• wasm/Builder.js:
• wasm/function-tests/call-indirect-params.js: Added.
• wasm/function-tests/call-indirect.js: Added.
• wasm/js-api/call-indirect.js: Added.

(const.wasmModuleWhichImportJS):
(MonomorphicImport):
(Polyphic2Import):
(VirtualImport):

• wasm/wasm.json:

Source/JavaScriptCore:

This patch adds support for call_indirect. The basic framework for
an indirect call is that the module holds a buffer containing a
stub for each function in the index space. Whenever a function
needs to do an indirect call it gets a index into that table. In
order to ensure call_indirect is calling a valid function the
functionIndexSpace also needs a pointer to a canonicalized
signature. When making an indirect call, we first check the index
is in range, then check the signature matches the value we were given.

This patch also differentiates between FunctionIndexSpaces and
ImmutableFunctionIndexSpaces. Since we don't know the size of the
FunctionIndexSpace when we start parsing we need to be able to
resize the IndexSpace. However, once we have finished parsing all
the sections we want to prevent an relocation of the function
index space pointer.

• wasm/WasmB3IRGenerator.cpp:

(JSC::Wasm::B3IRGenerator::B3IRGenerator):
(JSC::Wasm::B3IRGenerator::addCall):
(JSC::Wasm::B3IRGenerator::addCallIndirect):
(JSC::Wasm::createJSToWasmWrapper):
(JSC::Wasm::parseAndCompile):

• wasm/WasmB3IRGenerator.h:
• wasm/WasmCallingConvention.h:

(JSC::Wasm::CallingConvention::setupCall):

• wasm/WasmFormat.h:
• wasm/WasmFunctionParser.h:

(JSC::Wasm::FunctionParser::setErrorMessage):
(JSC::Wasm::FunctionParser<Context>::FunctionParser):
(JSC::Wasm::FunctionParser<Context>::parseExpression):

• wasm/WasmPlan.cpp:

(JSC::Wasm::Plan::run):

• wasm/WasmPlan.h:

(JSC::Wasm::Plan::takeFunctionIndexSpace):

• wasm/WasmValidate.cpp:

(JSC::Wasm::Validate::addCallIndirect):
(JSC::Wasm::validateFunction):

• wasm/WasmValidate.h:
• wasm/js/JSWebAssemblyModule.cpp:

(JSC::JSWebAssemblyModule::create):
(JSC::JSWebAssemblyModule::JSWebAssemblyModule):

• wasm/js/JSWebAssemblyModule.h:

(JSC::JSWebAssemblyModule::signatureForFunctionIndexSpace):
(JSC::JSWebAssemblyModule::offsetOfFunctionIndexSpace):

File:

• trunk/Source/JavaScriptCore/wasm/WasmValidate.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/wasm/WasmValidate.cpp

@@ -111 +111 @@
     bool WARN_UNUSED_RETURN addEndToUnreachable(ControlEntry&);
 
-
+    // Calls
     bool WARN_UNUSED_RETURN addCall(unsigned calleeIndex, const Signature*, const Vector<ExpressionType>& args, ExpressionType& result);
+    bool WARN_UNUSED_RETURN addCallIndirect(const Signature*, const Vector<ExpressionType>& args, ExpressionType& result);
 
     void dump(const Vector<ControlEntry>& controlStack, const ExpressionList& expressionStack);
@@ -348 +349 @@
 }
 
+bool Validate::addCallIndirect(const Signature* signature, const Vector<ExpressionType>& args, ExpressionType& result)
+{
+    const auto argumentCount = signature->arguments.size();
+    if (argumentCount != args.size() - 1) {
+        StringBuilder builder;
+        builder.append("Arity mismatch in call_indirect, expected: ");
+        builder.appendNumber(signature->arguments.size());
+        builder.append(" but got: ");
+        builder.appendNumber(args.size());
+        m_errorMessage = builder.toString();
+        return false;
+    }
+
+    for (unsigned i = 0; i < argumentCount; ++i) {
+        if (args[i] != signature->arguments[i]) {
+            m_errorMessage = makeString("Expected argument type: ", toString(signature->arguments[i]), " does not match passed argument type: ", toString(args[i]));
+            return false;
+        }
+    }
+
+    if (args.last() != I32) {
+        m_errorMessage = makeString("Expected call_indirect target index to have type: i32 but got type: ", toString(args.last()));
+        return false;
+    }
+    
+    result = signature->returnType;
+    return true;
+}
+
 bool Validate::unify(const ExpressionList& values, const ControlType& block)
 {
@@ -372 +402 @@
 }
 
-String validateFunction(const uint8_t* source, size_t length, const Signature* signature, const FunctionIndexSpace& functionIndexSpace, const MemoryInformation& memory)
-{
-    Validate context(signature->returnType, memory);
-    FunctionParser<Validate> validator(context, source, length, signature, functionIndexSpace);
+String validateFunction(const uint8_t* source, size_t length, const Signature* signature, const ImmutableFunctionIndexSpace& functionIndexSpace, const ModuleInformation& info)
+{
+    Validate context(signature->returnType, info.memory);
+    FunctionParser<Validate> validator(context, source, length, signature, functionIndexSpace, info);
+
     if (!validator.parse()) {
         // FIXME: add better location information here. see: https://bugs.webkit.org/show_bug.cgi?id=164288