• Clemens Hammacher's avatar
    [wasm] Check for illegal br table count · 74519c43
    Clemens Hammacher authored
    The underlying issue is that TF Nodes cannot handle input counts
    outside the integer range. On an illegal br_table instruction, we
    generated a switch node with a control output count >kMaxInt.
    Operator::ControlOutputCount turned this into a negative integer later,
    leading to a failing DCHECK.
    Since such large numbers cannot occur in any valid wasm function anyway,
    we just add an additional check to the br table count. There is already
    a TODO in the code to change Operator::ControlOutputCount to size_t.
    
    R=ahaas@chromium.org
    BUG=chromium:722445
    
    Change-Id: I1975072226e073dee6c8da3b9fa9a050a4695917
    Reviewed-on: https://chromium-review.googlesource.com/505496Reviewed-by: 's avatarAndreas Haas <ahaas@chromium.org>
    Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
    Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#45365}
    74519c43
Name
Last commit
Last update
..
loop-stack-check.js Loading commit data...
regress-5860.js Loading commit data...
regress-709684.js Loading commit data...
regress-712569.js Loading commit data...
regression-02256.js Loading commit data...
regression-02256b.js Loading commit data...
regression-02862.js Loading commit data...
regression-5531.js Loading commit data...
regression-5800.js Loading commit data...
regression-5884.js Loading commit data...
regression-6054.js Loading commit data...
regression-6164.js Loading commit data...
regression-643595.js Loading commit data...
regression-644682.js Loading commit data...
regression-647649.js Loading commit data...
regression-648079.js Loading commit data...
regression-651961.js Loading commit data...
regression-654377.js Loading commit data...
regression-663994.js Loading commit data...
regression-666741.js Loading commit data...
regression-667745.js Loading commit data...
regression-670683.js Loading commit data...
regression-674447.js Loading commit data...
regression-680938.js Loading commit data...
regression-684858.js Loading commit data...
regression-688876.js Loading commit data...
regression-689450.js Loading commit data...
regression-694433.js Loading commit data...
regression-698587.js Loading commit data...
regression-699485.js Loading commit data...
regression-702460.js Loading commit data...
regression-702839.js Loading commit data...
regression-703568.js Loading commit data...
regression-708714.js Loading commit data...
regression-710844.js Loading commit data...
regression-711203.js Loading commit data...
regression-715216-a.js Loading commit data...
regression-715216-b.js Loading commit data...
regression-717056.js Loading commit data...
regression-717194.js Loading commit data...
regression-719175.js Loading commit data...
regression-722445.js Loading commit data...