Wasm: Any function argument of type Void should be a validation error

https://bugs.webkit.org/show_bug.cgi?id=186794
<rdar://problem/41140257>

Reviewed by Keith Miller.

JSTests:

* wasm/Builder.js:
(const._normalizeFunctionSignature):
* wasm/function-tests/void-argument-type-should-be-a-validation-error.js: Added.
(getBinary):
* wasm/self-test/test_BuilderJSON.js:

Source/JavaScriptCore:

* wasm/WasmModuleParser.cpp:
(JSC::Wasm::ModuleParser::parseType):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@232970 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index 3672b57..2891d19 100644 (file)
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,3 +1,17 @@
+2018-06-19  Saam Barati  <sbarati@apple.com>
+
+        Wasm: Any function argument of type Void should be a validation error
+        https://bugs.webkit.org/show_bug.cgi?id=186794
+        <rdar://problem/41140257>
+
+        Reviewed by Keith Miller.
+
+        * wasm/Builder.js:
+        (const._normalizeFunctionSignature):
+        * wasm/function-tests/void-argument-type-should-be-a-validation-error.js: Added.
+        (getBinary):
+        * wasm/self-test/test_BuilderJSON.js:
+
 2018-06-18  Keith Miller  <keith_miller@apple.com>
 
         Properly zero unused property storage offsets

diff --git a/JSTests/wasm/Builder.js b/JSTests/wasm/Builder.js
index 72e788e..e94f0a3 100644 (file)
--- a/JSTests/wasm/Builder.js
+++ b/JSTests/wasm/Builder.js
@@ -44,7 +44,7 @@ const _unknownSectionId = 0;
 const _normalizeFunctionSignature = (params, ret) => {
     assert.isArray(params);
     for (const p of params)
-        assert.truthy(WASM.isValidValueType(p), `Type parameter ${p} needs a valid value type`);
+        assert.truthy(WASM.isValidValueType(p) || p === "void", `Type parameter ${p} needs a valid value type`);
     if (typeof(ret) === "undefined")
         ret = "void";
     assert.isNotArray(ret, `Multiple return values not supported by WebAssembly yet`);

diff --git a/JSTests/wasm/function-tests/void-argument-type-should-be-a-validation-error.js b/JSTests/wasm/function-tests/void-argument-type-should-be-a-validation-error.js
new file mode 100644 (file)
index 0000000..47149b1
--- /dev/null
+++ b/JSTests/wasm/function-tests/void-argument-type-should-be-a-validation-error.js
@@ -0,0 +1,22 @@
+import * as assert from '../assert.js';
+import Builder from '../Builder.js';
+
+function getBinary(params) {
+    const builder = (new Builder())
+    builder.Type().End()
+        .Function().End()
+        .Memory().InitialMaxPages(1, 1).End()
+        .Export()
+            .Function("callFunc")
+        .End()
+        .Code()
+            .Function("callFunc", { params, ret: "void" })
+                .Return()
+            .End()
+        .End();
+    return builder.WebAssembly().get();
+}
+
+assert.throws(() => new WebAssembly.Module(getBinary(["i32", "void"])), WebAssembly.CompileError, "WebAssembly.Module doesn't parse at byte 15 / 47: can't get 1th argument Type");
+assert.throws(() => new WebAssembly.Module(getBinary(["void"])), WebAssembly.CompileError, "WebAssembly.Module doesn't parse at byte 14 / 46: can't get 0th argument Type");
+assert.throws(() => new WebAssembly.Module(getBinary(["i32", "void", "i32"])), WebAssembly.CompileError, "WebAssembly.Module doesn't parse at byte 15 / 48: can't get 1th argument Type");

diff --git a/JSTests/wasm/self-test/test_BuilderJSON.js b/JSTests/wasm/self-test/test_BuilderJSON.js
index 2132039..bb1b97b 100644 (file)
--- a/JSTests/wasm/self-test/test_BuilderJSON.js
+++ b/JSTests/wasm/self-test/test_BuilderJSON.js
@@ -349,7 +349,7 @@ const assertOpThrows = (opFn, message) => {
 })();
 
 (function InvalidFunctionParameters() {
-    for (let invalid of ["", "void", "bool", "any", "struct", 0, 3.14, undefined, [], {}]) {
+    for (let invalid of ["", "bool", "any", "struct", 0, 3.14, undefined, [], {}]) {
         const c = (new Builder()).Code();
         assert.throws(() => c.Function({ params: [invalid] }), Error, `Expected truthy: Type parameter ${invalid} needs a valid value type`);
     }

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 68a6806..07d46ba 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,14 @@
+2018-06-19  Saam Barati  <sbarati@apple.com>
+
+        Wasm: Any function argument of type Void should be a validation error
+        https://bugs.webkit.org/show_bug.cgi?id=186794
+        <rdar://problem/41140257>
+
+        Reviewed by Keith Miller.
+
+        * wasm/WasmModuleParser.cpp:
+        (JSC::Wasm::ModuleParser::parseType):
+
 2018-06-18  Keith Miller  <keith_miller@apple.com>
 
         JSImmutableButterfly should assert m_header is adjacent to the data

diff --git a/Source/JavaScriptCore/wasm/WasmModuleParser.cpp b/Source/JavaScriptCore/wasm/WasmModuleParser.cpp
index 649128a..f03e698 100644 (file)
--- a/Source/JavaScriptCore/wasm/WasmModuleParser.cpp
+++ b/Source/JavaScriptCore/wasm/WasmModuleParser.cpp
@@ -126,7 +126,7 @@ auto ModuleParser::parseType() -> PartialResult
 
         for (unsigned i = 0; i < argumentCount; ++i) {
             Type argumentType;
-            WASM_PARSER_FAIL_IF(!parseResultType(argumentType), "can't get ", i, "th argument Type");
+            WASM_PARSER_FAIL_IF(!parseValueType(argumentType), "can't get ", i, "th argument Type");
             signature->argument(i) = argumentType;
         }