• Andreas Haas's avatar
    [wasm] Type check brtable if it's not unreachable · 8ff14f5b
    Andreas Haas authored
    There was a bug in the function body decoder where
    type checking of brtable only happened if the brtable
    instruction is reachable. However, type checking is
    required in all cases where brtable "not unreachable".
    The difference between reachable and "not unreachable"
    is a state called spec-reachable where a clever
    compiler can already infer that the code will be
    unreachable (e.g. a memory access is out of bounds
    just by the offset and therefore unconditionally
    traps), but the spec can not. If an instruction is
    only spec-reachable, it still has to be type checked.
    
    R=clemensb@chromium.org
    FIX=chromium:1046472
    
    Change-Id: I7e9f1108597871615c0d443a0e94de35a0207b5e
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2027990
    Commit-Queue: Andreas Haas <ahaas@chromium.org>
    Reviewed-by: 's avatarClemens Backes <clemensb@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#66049}
    8ff14f5b
regress-1046472.js 1.06 KB