[wasm] Support table.fill in the interpreter

R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: I9db3d2e4b2e2a685f81b516da8e6737db01c1238
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695470
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62648}

src/wasm/wasm-interpreter.cc

@@ -1910,6 +1910,35 @@ class ThreadImpl {
         *len += imm.length;
         return true;
       }
+      case kExprTableFill: {
+        TableIndexImmediate<Decoder::kNoValidate> imm(decoder,
+                                                      code->at(pc + 1));
+        HandleScope handle_scope(isolate_);
+        auto count = Pop().to<uint32_t>();
+        auto value = Pop().to_anyref();
+        auto start = Pop().to<uint32_t>();
+
+        auto table = handle(
+            WasmTableObject::cast(instance_object_->tables().get(imm.index)),
+            isolate_);
+        uint32_t table_size = table->current_length();
+        if (start > table_size) {
+          DoTrap(kTrapTableOutOfBounds, pc);
+          return false;
+        }
+
+        // Even when table.fill goes out-of-bounds, as many entries as possible
+        // are put into the table. Only afterwards we trap.
+        uint32_t fill_count = std::min(count, table_size - start);
+        WasmTableObject::Fill(isolate_, table, start, value, fill_count);
+
+        if (fill_count < count) {
+          DoTrap(kTrapTableOutOfBounds, pc);
+          return false;
+        }
+        *len += imm.length;
+        return true;
+      }
       default:
         FATAL("Unknown or unimplemented opcode #%d:%s", code->start[pc],
               OpcodeName(code->start[pc]));

test/mjsunit/wasm/table-fill-interpreter.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for an existing reference types test case that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/table-fill.js");