ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module...

https://bugs.webkit.org/show_bug.cgi?id=164597

Reviewed by Keith Miller.

JSTests:

Trim the array buffer before returning it: it's optimistically
over-allocated to avoid growing all the time, but when parsed it
can't have extra content.

* wasm/Builder_WebAssemblyBinary.js:
(export.const.Binary):
* wasm/LowLevelBinary.js:
(export.default.LowLevelBinary.prototype.get return):

Source/JavaScriptCore:

* wasm/WasmParser.h:
(JSC::Wasm::Parser::parseVarUInt32): move closer to other parsers
(JSC::Wasm::Parser::parseVarUInt64): move closer to other parsers

Source/WTF:

Decoding at end of file should fail, not assert.

* wtf/LEBDecoder.h:
(WTF::LEBDecoder::decodeUInt):
(WTF::LEBDecoder::decodeInt32):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@208567 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index cb49d15..0ad9a41 100644 (file)
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,3 +1,19 @@
+2016-11-10  JF Bastien  <jfbastien@apple.com>
+
+        ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
+        https://bugs.webkit.org/show_bug.cgi?id=164597
+
+        Reviewed by Keith Miller.
+
+        Trim the array buffer before returning it: it's optimistically
+        over-allocated to avoid growing all the time, but when parsed it
+        can't have extra content.
+
+        * wasm/Builder_WebAssemblyBinary.js:
+        (export.const.Binary):
+        * wasm/LowLevelBinary.js:
+        (export.default.LowLevelBinary.prototype.get return):
+
 2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
 
         test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)

diff --git a/JSTests/wasm/Builder_WebAssemblyBinary.js b/JSTests/wasm/Builder_WebAssemblyBinary.js
index f2b0a52..8d77c78 100644 (file)
--- a/JSTests/wasm/Builder_WebAssemblyBinary.js
+++ b/JSTests/wasm/Builder_WebAssemblyBinary.js
@@ -103,5 +103,6 @@ export const Binary = (preamble, sections) => {
         }
         sectionBin.apply();
     }
+    wasmBin.trim();
     return wasmBin;
 };

diff --git a/JSTests/wasm/LowLevelBinary.js b/JSTests/wasm/LowLevelBinary.js
index 7200976..7592f71 100644 (file)
--- a/JSTests/wasm/LowLevelBinary.js
+++ b/JSTests/wasm/LowLevelBinary.js
@@ -76,6 +76,7 @@ export default class LowLevelBinary {
     // Utilities.
     get() { return this._buf; }
     hexdump() { return _hexdump(this._buf, this._used); }
+    trim() { this._buf = this._buf.slice(0, this._used); }
     _maybeGrow(bytes) {
         const allocated = this._buf.length;
         if (allocated - this._used < bytes) {

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index b78c27c..c33adc0 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,14 @@
+2016-11-10  JF Bastien  <jfbastien@apple.com>
+
+        ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
+        https://bugs.webkit.org/show_bug.cgi?id=164597
+
+        Reviewed by Keith Miller.
+
+        * wasm/WasmParser.h:
+        (JSC::Wasm::Parser::parseVarUInt32): move closer to other parsers
+        (JSC::Wasm::Parser::parseVarUInt64): move closer to other parsers
+
 2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
 
         test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)

diff --git a/Source/JavaScriptCore/wasm/WasmParser.h b/Source/JavaScriptCore/wasm/WasmParser.h
index 5908777..e2c3fe1 100644 (file)
--- a/Source/JavaScriptCore/wasm/WasmParser.h
+++ b/Source/JavaScriptCore/wasm/WasmParser.h
@@ -46,15 +46,15 @@ protected:
     bool WARN_UNUSED_RETURN consumeString(const char*);
     bool WARN_UNUSED_RETURN consumeUTF8String(String&, size_t);
 
-    bool WARN_UNUSED_RETURN parseVarUInt1(uint8_t& result);
-    bool WARN_UNUSED_RETURN parseInt7(int8_t& result);
-    bool WARN_UNUSED_RETURN parseUInt7(uint8_t& result);
-    bool WARN_UNUSED_RETURN parseUInt32(uint32_t& result);
-    bool WARN_UNUSED_RETURN parseVarUInt32(uint32_t& result) { return WTF::LEBDecoder::decodeUInt32(m_source, m_sourceLength, m_offset, result); }
-    bool WARN_UNUSED_RETURN parseVarUInt64(uint64_t& result) { return WTF::LEBDecoder::decodeUInt64(m_source, m_sourceLength, m_offset, result); }
+    bool WARN_UNUSED_RETURN parseVarUInt1(uint8_t&);
+    bool WARN_UNUSED_RETURN parseInt7(int8_t&);
+    bool WARN_UNUSED_RETURN parseUInt7(uint8_t&);
+    bool WARN_UNUSED_RETURN parseUInt32(uint32_t&);
+    bool WARN_UNUSED_RETURN parseVarUInt32(uint32_t&);
+    bool WARN_UNUSED_RETURN parseVarUInt64(uint64_t&);
 
-    bool WARN_UNUSED_RETURN parseValueType(Type& result);
-    bool WARN_UNUSED_RETURN parseExternalKind(External::Kind& result);
+    bool WARN_UNUSED_RETURN parseValueType(Type&);
+    bool WARN_UNUSED_RETURN parseExternalKind(External::Kind&);
 
     const uint8_t* source() const { return m_source; }
     size_t length() const { return m_sourceLength; }
@@ -112,6 +112,16 @@ ALWAYS_INLINE bool Parser::consumeUTF8String(String& result, size_t stringLength
     return true;
 }
 
+ALWAYS_INLINE bool Parser::parseVarUInt32(uint32_t& result)
+{
+    return WTF::LEBDecoder::decodeUInt32(m_source, m_sourceLength, m_offset, result);
+}
+
+ALWAYS_INLINE bool Parser::parseVarUInt64(uint64_t& result)
+{
+    return WTF::LEBDecoder::decodeUInt64(m_source, m_sourceLength, m_offset, result);
+}
+
 ALWAYS_INLINE bool Parser::parseUInt32(uint32_t& result)
 {
     if (length() < 4 || m_offset > length() - 4)

diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog
index 32c5379..aa479c9 100644 (file)
--- a/Source/WTF/ChangeLog
+++ b/Source/WTF/ChangeLog
@@ -1,3 +1,16 @@
+2016-11-10  JF Bastien  <jfbastien@apple.com>
+
+        ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
+        https://bugs.webkit.org/show_bug.cgi?id=164597
+
+        Reviewed by Keith Miller.
+
+        Decoding at end of file should fail, not assert.
+
+        * wtf/LEBDecoder.h:
+        (WTF::LEBDecoder::decodeUInt):
+        (WTF::LEBDecoder::decodeInt32):
+
 2016-11-10  Alex Christensen  <achristensen@webkit.org>
 
         Remove unused CFURLCACHE code

diff --git a/Source/WTF/wtf/LEBDecoder.h b/Source/WTF/wtf/LEBDecoder.h
index 1650a23..e62d6f1 100644 (file)
--- a/Source/WTF/wtf/LEBDecoder.h
+++ b/Source/WTF/wtf/LEBDecoder.h
@@ -37,7 +37,8 @@ namespace WTF { namespace LEBDecoder {
 template<size_t maxByteLength, typename T>
 inline bool WARN_UNUSED_RETURN decodeUInt(const uint8_t* bytes, size_t length, size_t& offset, T& result)
 {
-    ASSERT(length > offset);
+    if (length <= offset)
+        return false;
     result = 0;
     unsigned shift = 0;
     size_t last = std::min(maxByteLength, length - offset - 1);
@@ -69,7 +70,8 @@ inline bool WARN_UNUSED_RETURN decodeUInt64(const uint8_t* bytes, size_t length,
 
 inline bool WARN_UNUSED_RETURN decodeInt32(const uint8_t* bytes, size_t length, size_t& offset, int32_t& result)
 {
-    ASSERT(length > offset);
+    if (length <= offset)
+        return false;
     result = 0;
     unsigned shift = 0;
     size_t last = std::min(max32BitLEBByteLength, length - offset - 1);