Bug 1502037 - Better error messages when accessing dropped data/elem segments. r=jseward
authorLars T Hansen <lhansen@mozilla.com>
Thu, 24 Jan 2019 14:23:35 +0100
changeset 515446 83097742e871e019732638bcdc8eeb36fc0c0c89
parent 515445 426bafe23415b19d83dc3e084f66f71f156d53c7
child 515447 3a520fdd3a245f6efd3b9f9b3d60a82b4a895810
push id1953
push userffxbld-merge
push dateMon, 11 Mar 2019 12:10:20 +0000
treeherdermozilla-release@9c35dcbaa899 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjseward
bugs1502037
milestone66.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1502037 - Better error messages when accessing dropped data/elem segments. r=jseward
js/src/jit-test/tests/wasm/passive-segs-boundary.js
js/src/js.msg
js/src/wasm/WasmInstance.cpp
--- a/js/src/jit-test/tests/wasm/passive-segs-boundary.js
+++ b/js/src/jit-test/tests/wasm/passive-segs-boundary.js
@@ -117,36 +117,36 @@ mem_test("data.drop 4", "",
          WebAssembly.CompileError, /data.drop segment index out of range/);
 
 // init with data seg ix out of range
 mem_test("(memory.init 4 (i32.const 1234) (i32.const 1) (i32.const 1))", "",
          WebAssembly.CompileError, /memory.init segment index out of range/);
 
 // drop with data seg ix indicating an active segment
 mem_test("data.drop 2", "",
-         WebAssembly.RuntimeError, /use of invalid passive data segment/);
+         WebAssembly.RuntimeError, /use of dropped data segment/);
 
 // init with data seg ix indicating an active segment
 mem_test("(memory.init 2 (i32.const 1234) (i32.const 1) (i32.const 1))", "",
-         WebAssembly.RuntimeError, /use of invalid passive data segment/);
+         WebAssembly.RuntimeError, /use of dropped data segment/);
 
 // init, using a data seg ix more than once is OK
 mem_test_nofail(
     "(memory.init 1 (i32.const 1234) (i32.const 1) (i32.const 1))",
     "(memory.init 1 (i32.const 4321) (i32.const 1) (i32.const 1))");
 
 // drop, then drop
 mem_test("data.drop 1",
          "data.drop 1",
-         WebAssembly.RuntimeError, /use of invalid passive data segment/);
+         WebAssembly.RuntimeError, /use of dropped data segment/);
 
 // drop, then init
 mem_test("data.drop 1",
          "(memory.init 1 (i32.const 1234) (i32.const 1) (i32.const 1))",
-         WebAssembly.RuntimeError, /use of invalid passive data segment/);
+         WebAssembly.RuntimeError, /use of dropped data segment/);
 
 // init: seg ix is valid passive, but length to copy > len of seg
 mem_test("",
          "(memory.init 1 (i32.const 1234) (i32.const 0) (i32.const 5))",
          WebAssembly.RuntimeError, /index out of bounds/);
 
 // init: seg ix is valid passive, but implies copying beyond end of seg
 mem_test("",
@@ -215,36 +215,36 @@ tab_test("elem.drop 4", "",
          WebAssembly.CompileError, /element segment index out of range for elem.drop/);
 
 // init with elem seg ix out of range
 tab_test("(table.init 4 (i32.const 12) (i32.const 1) (i32.const 1))", "",
          WebAssembly.CompileError, /table.init segment index out of range/);
 
 // drop with elem seg ix indicating an active segment
 tab_test("elem.drop 2", "",
-         WebAssembly.RuntimeError, /use of invalid passive element segment/);
+         WebAssembly.RuntimeError, /use of dropped element segment/);
 
 // init with elem seg ix indicating an active segment
 tab_test("(table.init 2 (i32.const 12) (i32.const 1) (i32.const 1))", "",
-         WebAssembly.RuntimeError, /use of invalid passive element segment/);
+         WebAssembly.RuntimeError, /use of dropped element segment/);
 
 // init, using an elem seg ix more than once is OK
 tab_test_nofail(
     "(table.init 1 (i32.const 12) (i32.const 1) (i32.const 1))",
     "(table.init 1 (i32.const 21) (i32.const 1) (i32.const 1))");
 
 // drop, then drop
 tab_test("elem.drop 1",
          "elem.drop 1",
-         WebAssembly.RuntimeError, /use of invalid passive element segment/);
+         WebAssembly.RuntimeError, /use of dropped element segment/);
 
 // drop, then init
 tab_test("elem.drop 1",
          "(table.init 1 (i32.const 12) (i32.const 1) (i32.const 1))",
-         WebAssembly.RuntimeError, /use of invalid passive element segment/);
+         WebAssembly.RuntimeError, /use of dropped element segment/);
 
 // init: seg ix is valid passive, but length to copy > len of seg
 tab_test("",
          "(table.init 1 (i32.const 12) (i32.const 0) (i32.const 5))",
          WebAssembly.RuntimeError, /index out of bounds/);
 
 // init: seg ix is valid passive, but implies copying beyond end of seg
 tab_test("",
--- a/js/src/js.msg
+++ b/js/src/js.msg
@@ -391,18 +391,18 @@ MSG_DEF(JSMSG_WASM_IND_CALL_TO_NULL,   0
 MSG_DEF(JSMSG_WASM_IND_CALL_BAD_SIG,   0, JSEXN_WASMRUNTIMEERROR, "indirect call signature mismatch")
 MSG_DEF(JSMSG_WASM_UNREACHABLE,        0, JSEXN_WASMRUNTIMEERROR, "unreachable executed")
 MSG_DEF(JSMSG_WASM_INTEGER_OVERFLOW,   0, JSEXN_WASMRUNTIMEERROR, "integer overflow")
 MSG_DEF(JSMSG_WASM_INVALID_CONVERSION, 0, JSEXN_WASMRUNTIMEERROR, "invalid conversion to integer")
 MSG_DEF(JSMSG_WASM_INT_DIVIDE_BY_ZERO, 0, JSEXN_WASMRUNTIMEERROR, "integer divide by zero")
 MSG_DEF(JSMSG_WASM_OUT_OF_BOUNDS,      0, JSEXN_WASMRUNTIMEERROR, "index out of bounds")
 MSG_DEF(JSMSG_WASM_UNALIGNED_ACCESS,   0, JSEXN_WASMRUNTIMEERROR, "unaligned memory access")
 MSG_DEF(JSMSG_WASM_WAKE_OVERFLOW,      0, JSEXN_WASMRUNTIMEERROR, "too many woken agents")
-MSG_DEF(JSMSG_WASM_INVALID_PASSIVE_DATA_SEG, 0, JSEXN_WASMRUNTIMEERROR, "use of invalid passive data segment")
-MSG_DEF(JSMSG_WASM_INVALID_PASSIVE_ELEM_SEG, 0, JSEXN_WASMRUNTIMEERROR, "use of invalid passive element segment")
+MSG_DEF(JSMSG_WASM_DROPPED_DATA_SEG,   0, JSEXN_WASMRUNTIMEERROR, "use of dropped data segment")
+MSG_DEF(JSMSG_WASM_DROPPED_ELEM_SEG,   0, JSEXN_WASMRUNTIMEERROR, "use of dropped element segment")
 MSG_DEF(JSMSG_WASM_DEREF_NULL,         0, JSEXN_WASMRUNTIMEERROR, "dereferencing null pointer")
 MSG_DEF(JSMSG_WASM_BAD_RANGE ,         2, JSEXN_RANGEERR,    "bad {0} {1}")
 MSG_DEF(JSMSG_WASM_BAD_GROW,           1, JSEXN_RANGEERR,    "failed to grow {0}")
 MSG_DEF(JSMSG_WASM_TABLE_OUT_OF_BOUNDS, 0, JSEXN_RANGEERR,   "table index out of bounds")
 MSG_DEF(JSMSG_WASM_BAD_UINT32,         2, JSEXN_TYPEERR,     "bad {0} {1}")
 MSG_DEF(JSMSG_WASM_BAD_BUF_ARG,        0, JSEXN_TYPEERR,     "first argument must be an ArrayBuffer or typed array object")
 MSG_DEF(JSMSG_WASM_BAD_MOD_ARG,        0, JSEXN_TYPEERR,     "first argument must be a WebAssembly.Module")
 MSG_DEF(JSMSG_WASM_BAD_BUF_MOD_ARG,    0, JSEXN_TYPEERR,     "first argument must be a WebAssembly.Module, ArrayBuffer or typed array object")
--- a/js/src/wasm/WasmInstance.cpp
+++ b/js/src/wasm/WasmInstance.cpp
@@ -448,17 +448,17 @@ Instance::memCopy(Instance* instance, ui
 
 /* static */ int32_t /* -1 to signal trap; 0 for ok */
 Instance::dataDrop(Instance* instance, uint32_t segIndex) {
   MOZ_RELEASE_ASSERT(size_t(segIndex) < instance->passiveDataSegments_.length(),
                      "ensured by validation");
 
   if (!instance->passiveDataSegments_[segIndex]) {
     JS_ReportErrorNumberASCII(TlsContext.get(), GetErrorMessage, nullptr,
-                              JSMSG_WASM_INVALID_PASSIVE_DATA_SEG);
+                              JSMSG_WASM_DROPPED_DATA_SEG);
     return -1;
   }
 
   SharedDataSegment& segRefPtr = instance->passiveDataSegments_[segIndex];
   MOZ_RELEASE_ASSERT(!segRefPtr->active());
 
   // Drop this instance's reference to the DataSegment so it can be released.
   segRefPtr = nullptr;
@@ -496,17 +496,17 @@ Instance::memFill(Instance* instance, ui
 /* static */ int32_t /* -1 to signal trap; 0 for ok */
 Instance::memInit(Instance* instance, uint32_t dstOffset, uint32_t srcOffset,
                   uint32_t len, uint32_t segIndex) {
   MOZ_RELEASE_ASSERT(size_t(segIndex) < instance->passiveDataSegments_.length(),
                      "ensured by validation");
 
   if (!instance->passiveDataSegments_[segIndex]) {
     JS_ReportErrorNumberASCII(TlsContext.get(), GetErrorMessage, nullptr,
-                              JSMSG_WASM_INVALID_PASSIVE_DATA_SEG);
+                              JSMSG_WASM_DROPPED_DATA_SEG);
     return -1;
   }
 
   const DataSegment& seg = *instance->passiveDataSegments_[segIndex];
   MOZ_RELEASE_ASSERT(!seg.active());
 
   const uint32_t segLen = seg.bytes.length();
 
@@ -594,17 +594,17 @@ Instance::tableCopy(Instance* instance, 
 
 /* static */ int32_t /* -1 to signal trap; 0 for ok */
 Instance::elemDrop(Instance* instance, uint32_t segIndex) {
   MOZ_RELEASE_ASSERT(size_t(segIndex) < instance->passiveElemSegments_.length(),
                      "ensured by validation");
 
   if (!instance->passiveElemSegments_[segIndex]) {
     JS_ReportErrorNumberASCII(TlsContext.get(), GetErrorMessage, nullptr,
-                              JSMSG_WASM_INVALID_PASSIVE_ELEM_SEG);
+                              JSMSG_WASM_DROPPED_ELEM_SEG);
     return -1;
   }
 
   SharedElemSegment& segRefPtr = instance->passiveElemSegments_[segIndex];
   MOZ_RELEASE_ASSERT(!segRefPtr->active());
 
   // Drop this instance's reference to the ElemSegment so it can be released.
   segRefPtr = nullptr;
@@ -660,17 +660,17 @@ void Instance::initElems(uint32_t tableI
 /* static */ int32_t /* -1 to signal trap; 0 for ok */
 Instance::tableInit(Instance* instance, uint32_t dstOffset, uint32_t srcOffset,
                     uint32_t len, uint32_t segIndex, uint32_t tableIndex) {
   MOZ_RELEASE_ASSERT(size_t(segIndex) < instance->passiveElemSegments_.length(),
                      "ensured by validation");
 
   if (!instance->passiveElemSegments_[segIndex]) {
     JS_ReportErrorNumberASCII(TlsContext.get(), GetErrorMessage, nullptr,
-                              JSMSG_WASM_INVALID_PASSIVE_ELEM_SEG);
+                              JSMSG_WASM_DROPPED_ELEM_SEG);
     return -1;
   }
 
   const ElemSegment& seg = *instance->passiveElemSegments_[segIndex];
   MOZ_RELEASE_ASSERT(!seg.active());
   const Table& table = *instance->tables()[tableIndex];
 
   // Element segments cannot currently contain arbitrary values, and anyref