WebKit Bugzilla
Attachment 372080 Details for
Bug 198760
: [WASM-References] Add support for multiple tables
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch
bug-198760-20190613160010.patch (text/plain), 83.42 KB, created by
Justin Michaud
on 2019-06-13 16:00:11 PDT
(
hide
)
Description:
Patch
Filename:
MIME Type:
Creator:
Justin Michaud
Created:
2019-06-13 16:00:11 PDT
Size:
83.42 KB
patch
obsolete
>Subversion Revision: 246324 >diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog >index 420e2e84a640646ddb99e1c510496d252d6f7ef6..32c587faeb038c6e083e572b3c33390dc6b787db 100644 >--- a/Source/JavaScriptCore/ChangeLog >+++ b/Source/JavaScriptCore/ChangeLog >@@ -1,3 +1,65 @@ >+2019-06-13 Justin Michaud <justin_michaud@apple.com> >+ >+ [WASM-References] Add support for multiple tables >+ https://bugs.webkit.org/show_bug.cgi?id=198760 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ Support multiple wasm tables. We turn tableInformation into a tables array, and update all of the >+ existing users to give a table index. We also add some extra checks for table.get/set. >+ >+ * wasm/WasmAirIRGenerator.cpp: >+ (JSC::Wasm::AirIRGenerator::AirIRGenerator): >+ (JSC::Wasm::AirIRGenerator::addTableGet): >+ (JSC::Wasm::AirIRGenerator::addTableSet): >+ (JSC::Wasm::AirIRGenerator::addCallIndirect): >+ * wasm/WasmB3IRGenerator.cpp: >+ (JSC::Wasm::B3IRGenerator::B3IRGenerator): >+ (JSC::Wasm::B3IRGenerator::addTableGet): >+ (JSC::Wasm::B3IRGenerator::addTableSet): >+ (JSC::Wasm::B3IRGenerator::addCallIndirect): >+ * wasm/WasmExceptionType.h: >+ * wasm/WasmFormat.h: >+ (JSC::Wasm::Element::Element): >+ * wasm/WasmFunctionParser.h: >+ (JSC::Wasm::FunctionParser<Context>::parseExpression): >+ (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression): >+ * wasm/WasmInstance.cpp: >+ (JSC::Wasm::Instance::Instance): >+ (JSC::Wasm::Instance::create): >+ (JSC::Wasm::Instance::extraMemoryAllocated const): >+ (JSC::Wasm::Instance::table): >+ (JSC::Wasm::Instance::setTable): >+ * wasm/WasmInstance.h: >+ (JSC::Wasm::Instance::updateCachedMemory): >+ (JSC::Wasm::Instance::offsetOfGlobals): >+ (JSC::Wasm::Instance::offsetOfTablePtr): >+ (JSC::Wasm::Instance::allocationSize): >+ (JSC::Wasm::Instance::table): Deleted. >+ (JSC::Wasm::Instance::setTable): Deleted. >+ (JSC::Wasm::Instance::offsetOfTable): Deleted. >+ * wasm/WasmModuleInformation.h: >+ (JSC::Wasm::ModuleInformation::tableCount const): >+ * wasm/WasmSectionParser.cpp: >+ (JSC::Wasm::SectionParser::parseImport): >+ (JSC::Wasm::SectionParser::parseTableHelper): >+ (JSC::Wasm::SectionParser::parseTable): >+ (JSC::Wasm::SectionParser::parseElement): >+ * wasm/WasmTable.h: >+ (JSC::Wasm::Table::owner const): >+ * wasm/WasmValidate.cpp: >+ (JSC::Wasm::Validate::addTableGet): >+ (JSC::Wasm::Validate::addTableSet): >+ (JSC::Wasm::Validate::addCallIndirect): >+ * wasm/js/JSWebAssemblyInstance.cpp: >+ (JSC::JSWebAssemblyInstance::JSWebAssemblyInstance): >+ (JSC::JSWebAssemblyInstance::visitChildren): >+ * wasm/js/JSWebAssemblyInstance.h: >+ * wasm/js/WebAssemblyModuleRecord.cpp: >+ (JSC::WebAssemblyModuleRecord::link): >+ (JSC::WebAssemblyModuleRecord::evaluate): >+ * wasm/wasm.json: >+ > 2019-06-11 Saam Barati <sbarati@apple.com> > > Roll out PAC cage >diff --git a/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp b/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp >index 9944f7523f4702f59ff609a433bd8a46b1dfa516..a52dce1a9cbd2e77609d45e3f74fa63c4a31054b 100644 >--- a/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp >+++ b/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp >@@ -236,8 +236,8 @@ public: > PartialResult WARN_UNUSED_RETURN addRefIsNull(ExpressionType& value, ExpressionType& result); > > // Tables >- PartialResult WARN_UNUSED_RETURN addTableGet(ExpressionType& idx, ExpressionType& result); >- PartialResult WARN_UNUSED_RETURN addTableSet(ExpressionType& idx, ExpressionType& value); >+ PartialResult WARN_UNUSED_RETURN addTableGet(uint32_t, ExpressionType& idx, ExpressionType& result); >+ PartialResult WARN_UNUSED_RETURN addTableSet(uint32_t, ExpressionType& idx, ExpressionType& value); > > // Locals > PartialResult WARN_UNUSED_RETURN getLocal(uint32_t index, ExpressionType& result); >@@ -276,7 +276,7 @@ public: > > // Calls > PartialResult WARN_UNUSED_RETURN addCall(uint32_t calleeIndex, const Signature&, Vector<ExpressionType>& args, ExpressionType& result); >- PartialResult WARN_UNUSED_RETURN addCallIndirect(const Signature&, Vector<ExpressionType>& args, ExpressionType& result); >+ PartialResult WARN_UNUSED_RETURN addCallIndirect(unsigned tableIndex, const Signature&, Vector<ExpressionType>& args, ExpressionType& result); > PartialResult WARN_UNUSED_RETURN addUnreachable(); > > PartialResult addShift(Type, B3::Air::Opcode, ExpressionType value, ExpressionType shift, ExpressionType& result); >@@ -623,6 +623,7 @@ private: > } > > uint32_t m_maxNumJSCallArguments { 0 }; >+ unsigned m_numImportFunctions; > > B3::PatchpointSpecial* m_patchpointSpecial { nullptr }; > }; >@@ -678,6 +679,7 @@ AirIRGenerator::AirIRGenerator(const ModuleInformation& info, B3::Procedure& pro > , m_proc(procedure) > , m_code(m_proc.code()) > , m_unlinkedWasmToWasmCalls(unlinkedWasmToWasmCalls) >+ , m_numImportFunctions(info.importFunctionCount()) > { > m_currentBlock = m_code.addBlock(); > m_rootBlock = m_currentBlock; >@@ -944,36 +946,52 @@ auto AirIRGenerator::addRefIsNull(ExpressionType& value, ExpressionType& result) > return { }; > } > >-auto AirIRGenerator::addTableGet(ExpressionType& idx, ExpressionType& result) -> PartialResult >+auto AirIRGenerator::addTableGet(uint32_t tableIndex, ExpressionType& idx, ExpressionType& result) -> PartialResult > { > // FIXME: Emit this inline <https://bugs.webkit.org/show_bug.cgi?id=198506>. > ASSERT(idx.tmp()); > ASSERT(idx.type() == Type::I32); > result = tmpForType(Type::Anyref); > >- uint64_t (*doGet)(Instance*, int32_t) = [] (Instance* instance, int32_t idx) -> uint64_t { >- return JSValue::encode(instance->table()->get(idx)); >+ uint64_t (*doGet)(Instance*, uint32_t, uint32_t) = [] (Instance* instance, uint32_t tableIndex, uint32_t idx) -> uint64_t { >+ if (idx >= instance->table(tableIndex)->length()) >+ return 0; >+ return JSValue::encode(instance->table(tableIndex)->get(idx)); > }; > >- emitCCall(doGet, result, instanceValue(), idx); >+ emitCCall(doGet, result, instanceValue(), addConstant(Type::I32, tableIndex), idx); >+ emitCheck([&] { >+ return Inst(BranchTest32, nullptr, Arg::resCond(MacroAssembler::Zero), result, result); >+ }, [=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) { >+ this->emitThrowException(jit, ExceptionType::OutOfBoundsTableAccess); >+ }); > > return { }; > } > >-auto AirIRGenerator::addTableSet(ExpressionType& idx, ExpressionType& value) -> PartialResult >+auto AirIRGenerator::addTableSet(uint32_t tableIndex, ExpressionType& idx, ExpressionType& value) -> PartialResult > { > // FIXME: Emit this inline <https://bugs.webkit.org/show_bug.cgi?id=198506>. > ASSERT(idx.tmp()); > ASSERT(idx.type() == Type::I32); > ASSERT(value.tmp()); > >- void (*doSet)(Instance*, int32_t, uint64_t value) = [] (Instance* instance, int32_t idx, uint64_t value) -> void { >+ bool (*doSet)(Instance*, uint32_t, uint32_t, uint64_t value) = [] (Instance* instance, uint32_t tableIndex, uint32_t idx, uint64_t value) -> bool { > // FIXME: We need to box wasm Funcrefs once they are supported here. > // <https://bugs.webkit.org/show_bug.cgi?id=198157> >- instance->table()->set(idx, JSValue::decode(value)); >+ if (idx >= instance->table(tableIndex)->length()) >+ return false; >+ instance->table(tableIndex)->set(idx, JSValue::decode(value)); >+ return true; > }; > >- emitCCall(doSet, TypedTmp(), instanceValue(), idx, value); >+ auto temp = g32(); >+ emitCCall(doSet, temp, instanceValue(), addConstant(Type::I32, tableIndex), idx, value); >+ emitCheck([&] { >+ return Inst(BranchTest32, nullptr, Arg::resCond(MacroAssembler::Zero), temp, temp); >+ }, [=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) { >+ this->emitThrowException(jit, ExceptionType::OutOfBoundsTableAccess); >+ }); > > return { }; > } >@@ -1866,11 +1884,12 @@ auto AirIRGenerator::addCall(uint32_t functionIndex, const Signature& signature, > return { }; > } > >-auto AirIRGenerator::addCallIndirect(const Signature& signature, Vector<ExpressionType>& args, ExpressionType& result) -> PartialResult >+auto AirIRGenerator::addCallIndirect(unsigned tableIndex, const Signature& signature, Vector<ExpressionType>& args, ExpressionType& result) -> PartialResult > { > ExpressionType calleeIndex = args.takeLast(); > ASSERT(signature.argumentCount() == args.size()); >- ASSERT(m_info.tableInformation.type() == TableElementType::Funcref); >+ ASSERT(m_info.tableCount() > tableIndex); >+ ASSERT(m_info.tables[tableIndex].type() == TableElementType::Funcref); > > m_makesCalls = true; > // Note: call indirect can call either WebAssemblyFunction or WebAssemblyWrapperFunction. Because >@@ -1885,12 +1904,12 @@ auto AirIRGenerator::addCallIndirect(const Signature& signature, Vector<Expressi > ExpressionType instancesBuffer = g64(); > ExpressionType callableFunctionBufferLength = g64(); > { >- RELEASE_ASSERT(Arg::isValidAddrForm(Instance::offsetOfTable(), B3::Width64)); >+ RELEASE_ASSERT(Arg::isValidAddrForm(Instance::offsetOfTablePtr(m_numImportFunctions, tableIndex), B3::Width64)); > RELEASE_ASSERT(Arg::isValidAddrForm(FuncRefTable::offsetOfFunctions(), B3::Width64)); > RELEASE_ASSERT(Arg::isValidAddrForm(FuncRefTable::offsetOfInstances(), B3::Width64)); > RELEASE_ASSERT(Arg::isValidAddrForm(FuncRefTable::offsetOfLength(), B3::Width64)); > >- append(Move, Arg::addr(instanceValue(), Instance::offsetOfTable()), callableFunctionBufferLength); >+ append(Move, Arg::addr(instanceValue(), Instance::offsetOfTablePtr(m_numImportFunctions, tableIndex)), callableFunctionBufferLength); > append(Move, Arg::addr(callableFunctionBufferLength, FuncRefTable::offsetOfFunctions()), callableFunctionBuffer); > append(Move, Arg::addr(callableFunctionBufferLength, FuncRefTable::offsetOfInstances()), instancesBuffer); > append(Move32, Arg::addr(callableFunctionBufferLength, Table::offsetOfLength()), callableFunctionBufferLength); >diff --git a/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp b/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp >index 940c888229ad946ee6741016758b5dc5448aca89..30e401d9d75277f43e926ca4e671285d532cac39 100644 >--- a/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp >+++ b/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp >@@ -188,8 +188,8 @@ public: > PartialResult WARN_UNUSED_RETURN addRefIsNull(ExpressionType& value, ExpressionType& result); > > // Tables >- PartialResult WARN_UNUSED_RETURN addTableGet(ExpressionType& idx, ExpressionType& result); >- PartialResult WARN_UNUSED_RETURN addTableSet(ExpressionType& idx, ExpressionType& value); >+ PartialResult WARN_UNUSED_RETURN addTableGet(uint32_t, ExpressionType& idx, ExpressionType& result); >+ PartialResult WARN_UNUSED_RETURN addTableSet(uint32_t, ExpressionType& idx, ExpressionType& value); > > // Locals > PartialResult WARN_UNUSED_RETURN getLocal(uint32_t index, ExpressionType& result); >@@ -228,7 +228,7 @@ public: > > // Calls > PartialResult WARN_UNUSED_RETURN addCall(uint32_t calleeIndex, const Signature&, Vector<ExpressionType>& args, ExpressionType& result); >- PartialResult WARN_UNUSED_RETURN addCallIndirect(const Signature&, Vector<ExpressionType>& args, ExpressionType& result); >+ PartialResult WARN_UNUSED_RETURN addCallIndirect(unsigned tableIndex, const Signature&, Vector<ExpressionType>& args, ExpressionType& result); > PartialResult WARN_UNUSED_RETURN addUnreachable(); > > void dump(const Vector<ControlEntry>& controlStack, const ExpressionList* expressionStack); >@@ -290,6 +290,7 @@ private: > } > > uint32_t m_maxNumJSCallArguments { 0 }; >+ unsigned m_numImportFunctions; > }; > > // Memory accesses in WebAssembly have unsigned 32-bit offsets, whereas they have signed 32-bit offsets in B3. >@@ -341,6 +342,7 @@ B3IRGenerator::B3IRGenerator(const ModuleInformation& info, Procedure& procedure > , m_proc(procedure) > , m_unlinkedWasmToWasmCalls(unlinkedWasmToWasmCalls) > , m_constantInsertionValues(m_proc) >+ , m_numImportFunctions(info.importFunctionCount()) > { > m_currentBlock = m_proc.addBlock(); > >@@ -557,32 +559,55 @@ auto B3IRGenerator::addRefIsNull(ExpressionType& value, ExpressionType& result) > return { }; > } > >-auto B3IRGenerator::addTableGet(ExpressionType& idx, ExpressionType& result) -> PartialResult >+auto B3IRGenerator::addTableGet(uint32_t tableIndex, ExpressionType& idx, ExpressionType& result) -> PartialResult > { > // FIXME: Emit this inline <https://bugs.webkit.org/show_bug.cgi?id=198506>. >- uint64_t (*doGet)(Instance*, int32_t) = [] (Instance* instance, int32_t idx) -> uint64_t { >- return JSValue::encode(instance->table()->get(idx)); >+ uint64_t (*doGet)(Instance*, uint32_t, uint32_t) = [] (Instance* instance, uint32_t tableIndex, uint32_t idx) -> uint64_t { >+ if (idx >= instance->table(tableIndex)->length()) >+ return 0; >+ return JSValue::encode(instance->table(tableIndex)->get(idx)); > }; > > result = m_currentBlock->appendNew<CCallValue>(m_proc, toB3Type(Anyref), origin(), > m_currentBlock->appendNew<ConstPtrValue>(m_proc, origin(), tagCFunctionPtr<void*>(doGet, B3CCallPtrTag)), >- instanceValue(), idx); >+ instanceValue(), m_currentBlock->appendNew<Const32Value>(m_proc, origin(), tableIndex), idx); >+ >+ { >+ CheckValue* check = m_currentBlock->appendNew<CheckValue>(m_proc, Check, origin(), >+ m_currentBlock->appendNew<Value>(m_proc, Equal, origin(), result, m_currentBlock->appendNew<Const64Value>(m_proc, origin(), 0))); >+ >+ check->setGenerator([=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) { >+ this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsTableAccess); >+ }); >+ } > > return { }; > } > >-auto B3IRGenerator::addTableSet(ExpressionType& idx, ExpressionType& value) -> PartialResult >+auto B3IRGenerator::addTableSet(uint32_t tableIndex, ExpressionType& idx, ExpressionType& value) -> PartialResult > { > // FIXME: Emit this inline <https://bugs.webkit.org/show_bug.cgi?id=198506>. >- void (*doSet)(Instance*, int32_t, uint64_t value) = [] (Instance* instance, int32_t idx, uint64_t value) -> void { >+ bool (*doSet)(Instance*, uint32_t, uint32_t, uint64_t value) = [] (Instance* instance, uint32_t tableIndex, uint32_t idx, uint64_t value) -> bool { > // FIXME: We need to box wasm Funcrefs once they are supported here. > // <https://bugs.webkit.org/show_bug.cgi?id=198157> >- instance->table()->set(idx, JSValue::decode(value)); >+ if (idx >= instance->table(tableIndex)->length()) >+ return false; >+ instance->table(tableIndex)->set(idx, JSValue::decode(value)); >+ return true; > }; > >- m_currentBlock->appendNew<CCallValue>(m_proc, B3::Void, origin(), >+ auto result = m_currentBlock->appendNew<CCallValue>(m_proc, B3::Int32, origin(), > m_currentBlock->appendNew<ConstPtrValue>(m_proc, origin(), tagCFunctionPtr<void*>(doSet, B3CCallPtrTag)), >- instanceValue(), idx, value); >+ instanceValue(), m_currentBlock->appendNew<Const32Value>(m_proc, origin(), tableIndex), idx, value); >+ >+ { >+ CheckValue* check = m_currentBlock->appendNew<CheckValue>(m_proc, Check, origin(), >+ m_currentBlock->appendNew<Value>(m_proc, Equal, origin(), result, m_currentBlock->appendNew<Const32Value>(m_proc, origin(), 0))); >+ >+ check->setGenerator([=] (CCallHelpers& jit, const B3::StackmapGenerationParams&) { >+ this->emitExceptionCheck(jit, ExceptionType::OutOfBoundsTableAccess); >+ }); >+ } > > return { }; > } >@@ -1270,7 +1295,7 @@ auto B3IRGenerator::addCall(uint32_t functionIndex, const Signature& signature, > return { }; > } > >-auto B3IRGenerator::addCallIndirect(const Signature& signature, Vector<ExpressionType>& args, ExpressionType& result) -> PartialResult >+auto B3IRGenerator::addCallIndirect(unsigned tableIndex, const Signature& signature, Vector<ExpressionType>& args, ExpressionType& result) -> PartialResult > { > ExpressionType calleeIndex = args.takeLast(); > ASSERT(signature.argumentCount() == args.size()); >@@ -1287,7 +1312,7 @@ auto B3IRGenerator::addCallIndirect(const Signature& signature, Vector<Expressio > ExpressionType mask; > { > ExpressionType table = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), origin(), >- instanceValue(), safeCast<int32_t>(Instance::offsetOfTable())); >+ instanceValue(), safeCast<int32_t>(Instance::offsetOfTablePtr(m_numImportFunctions, tableIndex))); > callableFunctionBuffer = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), origin(), > table, safeCast<int32_t>(FuncRefTable::offsetOfFunctions())); > instancesBuffer = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), origin(), >diff --git a/Source/JavaScriptCore/wasm/WasmExceptionType.h b/Source/JavaScriptCore/wasm/WasmExceptionType.h >index d446c0ed1b4dd9f66ff5938265a066e0dc92d611..46c53e862b2b7524cd2f83538d04f2aa4dca1cca 100644 >--- a/Source/JavaScriptCore/wasm/WasmExceptionType.h >+++ b/Source/JavaScriptCore/wasm/WasmExceptionType.h >@@ -33,6 +33,7 @@ namespace Wasm { > > #define FOR_EACH_EXCEPTION(macro) \ > macro(OutOfBoundsMemoryAccess, "Out of bounds memory access") \ >+ macro(OutOfBoundsTableAccess, "Out of bounds table access") \ > macro(OutOfBoundsCallIndirect, "Out of bounds call_indirect") \ > macro(NullTableEntry, "call_indirect to a null table entry") \ > macro(BadSignature, "call_indirect to a signature that does not match") \ >diff --git a/Source/JavaScriptCore/wasm/WasmFormat.h b/Source/JavaScriptCore/wasm/WasmFormat.h >index 6292250f25eea9490c43a4ebd46d2e25e0c36c95..7a6240285a83c3096ae77cd05942471339b9d9d3 100644 >--- a/Source/JavaScriptCore/wasm/WasmFormat.h >+++ b/Source/JavaScriptCore/wasm/WasmFormat.h >@@ -204,10 +204,12 @@ struct Segment { > }; > > struct Element { >- Element(I32InitExpr offset) >- : offset(offset) >+ Element(uint32_t tableIndex, I32InitExpr offset) >+ : tableIndex(tableIndex) >+ , offset(offset) > { } > >+ uint32_t tableIndex; > I32InitExpr offset; > Vector<uint32_t> functionIndices; > }; >diff --git a/Source/JavaScriptCore/wasm/WasmFunctionParser.h b/Source/JavaScriptCore/wasm/WasmFunctionParser.h >index dfae8f2cf3ad2da18aa88bb26bd558cc7d8476de..1674780623e70b0b1614eab223b86a5055125ca4 100644 >--- a/Source/JavaScriptCore/wasm/WasmFunctionParser.h >+++ b/Source/JavaScriptCore/wasm/WasmFunctionParser.h >@@ -283,19 +283,23 @@ auto FunctionParser<Context>::parseExpression() -> PartialResult > > case TableGet: { > WASM_PARSER_FAIL_IF(!Options::useWebAssemblyReferences(), "references are not enabled"); >+ unsigned tableIndex; >+ WASM_PARSER_FAIL_IF(!parseVarUInt32(tableIndex), "can't parse table index"); > ExpressionType result, idx; > WASM_TRY_POP_EXPRESSION_STACK_INTO(idx, "table.get"); >- WASM_TRY_ADD_TO_CONTEXT(addTableGet(idx, result)); >+ WASM_TRY_ADD_TO_CONTEXT(addTableGet(tableIndex, idx, result)); > m_expressionStack.append(result); > return { }; > } > > case TableSet: { > WASM_PARSER_FAIL_IF(!Options::useWebAssemblyReferences(), "references are not enabled"); >+ unsigned tableIndex; >+ WASM_PARSER_FAIL_IF(!parseVarUInt32(tableIndex), "can't parse table index"); > ExpressionType val, idx; > WASM_TRY_POP_EXPRESSION_STACK_INTO(val, "table.set"); > WASM_TRY_POP_EXPRESSION_STACK_INTO(idx, "table.set"); >- WASM_TRY_ADD_TO_CONTEXT(addTableSet(idx, val)); >+ WASM_TRY_ADD_TO_CONTEXT(addTableSet(tableIndex, idx, val)); > return { }; > } > >@@ -385,13 +389,13 @@ auto FunctionParser<Context>::parseExpression() -> PartialResult > > case CallIndirect: { > uint32_t signatureIndex; >- uint8_t reserved; >- WASM_PARSER_FAIL_IF(!m_info.tableInformation, "call_indirect is only valid when a table is defined or imported"); >+ uint8_t tableIndex; >+ WASM_PARSER_FAIL_IF(!m_info.tableCount(), "call_indirect is only valid when a table is defined or imported"); > WASM_PARSER_FAIL_IF(!parseVarUInt32(signatureIndex), "can't get call_indirect's signature index"); >- WASM_PARSER_FAIL_IF(!parseVarUInt1(reserved), "can't get call_indirect's reserved byte"); >- WASM_PARSER_FAIL_IF(reserved, "call_indirect's 'reserved' varuint1 must be 0x0"); >+ WASM_PARSER_FAIL_IF(!parseVarUInt1(tableIndex), "can't get call_indirect's table index"); >+ WASM_PARSER_FAIL_IF(tableIndex >= m_info.tableCount(), "call_indirect's table index ", tableIndex, " invalid, limit is ", m_info.tableCount()); > WASM_PARSER_FAIL_IF(m_info.usedSignatures.size() <= signatureIndex, "call_indirect's signature index ", signatureIndex, " exceeds known signatures ", m_info.usedSignatures.size()); >- WASM_PARSER_FAIL_IF(m_info.tableInformation.type() != TableElementType::Funcref, "call_indirect is only valid when a table has type anyfunc"); >+ WASM_PARSER_FAIL_IF(m_info.tables[tableIndex].type() != TableElementType::Funcref, "call_indirect is only valid when a table has type anyfunc"); > > const Signature& calleeSignature = m_info.usedSignatures[signatureIndex].get(); > size_t argumentCount = calleeSignature.argumentCount() + 1; // Add the callee's index. >@@ -405,7 +409,7 @@ auto FunctionParser<Context>::parseExpression() -> PartialResult > m_expressionStack.shrink(firstArgumentIndex); > > ExpressionType result = Context::emptyExpression(); >- WASM_TRY_ADD_TO_CONTEXT(addCallIndirect(calleeSignature, args, result)); >+ WASM_TRY_ADD_TO_CONTEXT(addCallIndirect(tableIndex, calleeSignature, args, result)); > > if (result != Context::emptyExpression()) > m_expressionStack.append(result); >@@ -674,7 +678,11 @@ auto FunctionParser<Context>::parseUnreachableExpression() -> PartialResult > } > > case TableGet: >- case TableSet: >+ case TableSet: { >+ unsigned tableIndex; >+ WASM_PARSER_FAIL_IF(!parseVarUInt32(tableIndex), "can't parse table index"); >+ FALLTHROUGH; >+ } > case RefIsNull: > case RefNull: { > WASM_PARSER_FAIL_IF(!Options::useWebAssemblyReferences(), "references are not enabled"); >diff --git a/Source/JavaScriptCore/wasm/WasmInstance.cpp b/Source/JavaScriptCore/wasm/WasmInstance.cpp >index 37059968e0b7854d27336f1937ec258a370b4966..99e7ed56a86c8587a65d6170a0cde1a2869a62a7 100644 >--- a/Source/JavaScriptCore/wasm/WasmInstance.cpp >+++ b/Source/JavaScriptCore/wasm/WasmInstance.cpp >@@ -60,18 +60,19 @@ Instance::Instance(Context* context, Ref<Module>&& module, EntryFrame** pointerT > if (m_module.get().moduleInformation().globals[i].type == Anyref) > m_globalsToMark.set(i); > } >+ memset(bitwise_cast<char*>(this) + offsetOfTablePtr(m_numImportFunctions, 0), 0, m_module->moduleInformation().tableCount() * sizeof(Table*)); > } > > Ref<Instance> Instance::create(Context* context, Ref<Module>&& module, EntryFrame** pointerToTopEntryFrame, void** pointerToActualStackLimit, StoreTopCallFrameCallback&& storeTopCallFrame) > { >- return adoptRef(*new (NotNull, fastMalloc(allocationSize(module->moduleInformation().importFunctionCount()))) Instance(context, WTFMove(module), pointerToTopEntryFrame, pointerToActualStackLimit, WTFMove(storeTopCallFrame))); >+ return adoptRef(*new (NotNull, fastMalloc(allocationSize(module->moduleInformation().importFunctionCount(), module->moduleInformation().tableCount()))) Instance(context, WTFMove(module), pointerToTopEntryFrame, pointerToActualStackLimit, WTFMove(storeTopCallFrame))); > } > > Instance::~Instance() { } > > size_t Instance::extraMemoryAllocated() const > { >- return globalMemoryByteSize(m_module.get()) + allocationSize(m_numImportFunctions); >+ return globalMemoryByteSize(m_module.get()) + allocationSize(m_numImportFunctions, m_module->moduleInformation().tableCount()); > } > > void Instance::setGlobal(unsigned i, JSValue value) >@@ -80,6 +81,21 @@ void Instance::setGlobal(unsigned i, JSValue value) > m_globals.get()[i].anyref.set(*owner<JSWebAssemblyInstance>()->vm(), owner<JSWebAssemblyInstance>(), value); > } > >+Table* Instance::table(unsigned i) >+{ >+ RELEASE_ASSERT(i < m_module->moduleInformation().tableCount()); >+ return *bitwise_cast<Table**>(bitwise_cast<char*>(this) + offsetOfTablePtr(m_numImportFunctions, i)); >+} >+ >+void Instance::setTable(unsigned i, Ref<Table>&& table) >+{ >+ RELEASE_ASSERT(i < m_module->moduleInformation().tableCount()); >+ if (auto* t = this->table(i)) >+ t->deref(); >+ *bitwise_cast<Table**>(bitwise_cast<char*>(this) + offsetOfTablePtr(m_numImportFunctions, i)) = &table.leakRef(); >+ this->table(i)->ref(); >+} >+ > } } // namespace JSC::Wasm > > #endif // ENABLE(WEBASSEMBLY) >diff --git a/Source/JavaScriptCore/wasm/WasmInstance.h b/Source/JavaScriptCore/wasm/WasmInstance.h >index bf11c1522b9a619f3c370466e4b78c32e850dcbd..22bafb952e2d9d7e07d6e6e8feba6aa278db3bdf 100644 >--- a/Source/JavaScriptCore/wasm/WasmInstance.h >+++ b/Source/JavaScriptCore/wasm/WasmInstance.h >@@ -64,7 +64,8 @@ public: > Module& module() { return m_module.get(); } > CodeBlock* codeBlock() { return m_codeBlock.get(); } > Memory* memory() { return m_memory.get(); } >- Table* table() { return m_table.get(); } >+ Table* table(unsigned); >+ void setTable(unsigned, Ref<Table>&&); > > void* cachedMemory() const { return m_cachedMemory; } > size_t cachedMemorySize() const { return m_cachedMemorySize; } >@@ -82,7 +83,6 @@ public: > m_cachedMemorySize = memory()->size(); > } > } >- void setTable(Ref<Table>&& table) { m_table = WTFMove(table); } > > int32_t loadI32Global(unsigned i) const { return m_globals.get()[i].primitive; } > int64_t loadI64Global(unsigned i) const { return m_globals.get()[i].primitive; } >@@ -94,7 +94,6 @@ public: > > static ptrdiff_t offsetOfMemory() { return OBJECT_OFFSETOF(Instance, m_memory); } > static ptrdiff_t offsetOfGlobals() { return OBJECT_OFFSETOF(Instance, m_globals); } >- static ptrdiff_t offsetOfTable() { return OBJECT_OFFSETOF(Instance, m_table); } > static ptrdiff_t offsetOfCachedMemory() { return OBJECT_OFFSETOF(Instance, m_cachedMemory); } > static ptrdiff_t offsetOfCachedMemorySize() { return OBJECT_OFFSETOF(Instance, m_cachedMemorySize); } > static ptrdiff_t offsetOfPointerToTopEntryFrame() { return OBJECT_OFFSETOF(Instance, m_pointerToTopEntryFrame); } >@@ -133,6 +132,8 @@ public: > static size_t offsetOfImportFunction(size_t importFunctionNum) { return offsetOfTail() + importFunctionNum * sizeof(ImportFunctionInfo) + OBJECT_OFFSETOF(ImportFunctionInfo, importFunction); } > template<typename T> T* importFunction(unsigned importFunctionNum) { return reinterpret_cast<T*>(&importFunctionInfo(importFunctionNum)->importFunction); } > >+ static size_t offsetOfTablePtr(unsigned numImportFunctions, unsigned i) { return offsetOfTail() + sizeof(ImportFunctionInfo) * numImportFunctions + sizeof(Table*) * i; } >+ > void storeTopCallFrame(void* callFrame) > { > m_storeTopCallFrame(callFrame); >@@ -141,9 +142,9 @@ public: > private: > Instance(Context*, Ref<Module>&&, EntryFrame**, void**, StoreTopCallFrameCallback&&); > >- static size_t allocationSize(Checked<size_t> numImportFunctions) >+ static size_t allocationSize(Checked<size_t> numImportFunctions, Checked<size_t> numTables) > { >- return (offsetOfTail() + sizeof(ImportFunctionInfo) * numImportFunctions).unsafeGet(); >+ return (offsetOfTail() + sizeof(ImportFunctionInfo) * numImportFunctions + sizeof(Table*) * numTables).unsafeGet(); > } > void* m_owner { nullptr }; // In a JS embedding, this is a JSWebAssemblyInstance*. > Context* m_context { nullptr }; >@@ -152,7 +153,6 @@ private: > Ref<Module> m_module; > RefPtr<CodeBlock> m_codeBlock; > RefPtr<Memory> m_memory; >- RefPtr<Table> m_table; > > union GlobalValue { > WriteBarrier<Unknown> anyref; >diff --git a/Source/JavaScriptCore/wasm/WasmModuleInformation.h b/Source/JavaScriptCore/wasm/WasmModuleInformation.h >index ad5eb9526ac7ac3be437fc623df0bd7dc20807d2..13f332b1b584b938195ac2f13ce7c9245f4d8304 100644 >--- a/Source/JavaScriptCore/wasm/WasmModuleInformation.h >+++ b/Source/JavaScriptCore/wasm/WasmModuleInformation.h >@@ -64,7 +64,7 @@ struct ModuleInformation : public ThreadSafeRefCounted<ModuleInformation> { > // Currently, our wasm implementation allows only one memory and table. > // If we need to remove this limitation, we would have MemoryInformation and TableInformation in the Vectors. > uint32_t memoryCount() const { return memory ? 1 : 0; } >- uint32_t tableCount() const { return tableInformation ? 1 : 0; } >+ uint32_t tableCount() const { return tables.size(); } > > Vector<Import> imports; > Vector<SignatureIndex> importFunctionSignatureIndices; >@@ -79,7 +79,7 @@ struct ModuleInformation : public ThreadSafeRefCounted<ModuleInformation> { > Optional<uint32_t> startFunctionIndexSpace; > Vector<Segment::Ptr> data; > Vector<Element> elements; >- TableInformation tableInformation; >+ Vector<TableInformation> tables; > Vector<Global> globals; > unsigned firstInternalGlobal { 0 }; > Vector<CustomSection> customSections; >diff --git a/Source/JavaScriptCore/wasm/WasmSectionParser.cpp b/Source/JavaScriptCore/wasm/WasmSectionParser.cpp >index 30b6f3ced9df5626222627253c24684a3c8b4943..9c42c117c5dd26ec749632cd117f669618b1219d 100644 >--- a/Source/JavaScriptCore/wasm/WasmSectionParser.cpp >+++ b/Source/JavaScriptCore/wasm/WasmSectionParser.cpp >@@ -119,6 +119,7 @@ auto SectionParser::parseImport() -> PartialResult > } > case ExternalKind::Table: { > bool isImport = true; >+ kindIndex = m_info->tables.size(); > PartialResult result = parseTableHelper(isImport); > if (UNLIKELY(!result)) > return makeUnexpected(WTFMove(result.error())); >@@ -193,8 +194,6 @@ auto SectionParser::parseResizableLimits(uint32_t& initial, Optional<uint32_t>& > > auto SectionParser::parseTableHelper(bool isImport) -> PartialResult > { >- WASM_PARSER_FAIL_IF(m_info->tableCount() > 0, "Cannot have more than one Table for now"); >- > int8_t type; > WASM_PARSER_FAIL_IF(!parseInt7(type), "can't parse Table type"); > WASM_PARSER_FAIL_IF(type != Wasm::Anyfunc && type != Wasm::Anyref, "Table type should be anyfunc or anyref, got ", type); >@@ -209,7 +208,7 @@ auto SectionParser::parseTableHelper(bool isImport) -> PartialResult > ASSERT(!maximum || *maximum >= initial); > > TableElementType tableType = type == Wasm::Anyfunc ? TableElementType::Funcref : TableElementType::Anyref; >- m_info->tableInformation = TableInformation(initial, maximum, isImport, tableType); >+ m_info->tables.append(TableInformation(initial, maximum, isImport, tableType)); > > return { }; > } >@@ -218,15 +217,13 @@ auto SectionParser::parseTable() -> PartialResult > { > uint32_t count; > WASM_PARSER_FAIL_IF(!parseVarUInt32(count), "can't get Table's count"); >- WASM_PARSER_FAIL_IF(count > 1, "Table count of ", count, " is invalid, at most 1 is allowed for now"); >- >- if (!count) >- return { }; > >- bool isImport = false; >- PartialResult result = parseTableHelper(isImport); >- if (UNLIKELY(!result)) >- return makeUnexpected(WTFMove(result.error())); >+ for (unsigned i = 0; i < count; ++i) { >+ bool isImport = false; >+ PartialResult result = parseTableHelper(isImport); >+ if (UNLIKELY(!result)) >+ return makeUnexpected(WTFMove(result.error())); >+ } > > return { }; > } >@@ -383,9 +380,9 @@ auto SectionParser::parseElement() -> PartialResult > WASM_PARSER_FAIL_IF(!parseVarUInt32(indexCount), "can't get ", elementNum, "th index count for Element section"); > WASM_PARSER_FAIL_IF(indexCount == std::numeric_limits<uint32_t>::max(), "Element section's ", elementNum, "th index count is too big ", indexCount); > >- ASSERT(!!m_info->tableInformation); >+ ASSERT(!!m_info->tables[tableIndex]); > >- Element element(makeI32InitExpr(initOpcode, initExprBits)); >+ Element element(tableIndex, makeI32InitExpr(initOpcode, initExprBits)); > WASM_PARSER_FAIL_IF(!element.functionIndices.tryReserveCapacity(indexCount), "can't allocate memory for ", indexCount, " Element indices"); > > for (unsigned index = 0; index < indexCount; ++index) { >diff --git a/Source/JavaScriptCore/wasm/WasmTable.h b/Source/JavaScriptCore/wasm/WasmTable.h >index 4d57d4152cfa7b15ec3f15c616e7fc3b437ec6af..5392c839a672e6a3fb825cf41f5d5744046edba6 100644 >--- a/Source/JavaScriptCore/wasm/WasmTable.h >+++ b/Source/JavaScriptCore/wasm/WasmTable.h >@@ -57,6 +57,7 @@ public: > static uint32_t allocatedLength(uint32_t length); > uint32_t mask() const { return m_mask; } > >+ template<typename T> T* owner() const { return reinterpret_cast<T*>(m_owner); } > void setOwner(JSObject* owner) > { > ASSERT(!m_owner); >diff --git a/Source/JavaScriptCore/wasm/WasmValidate.cpp b/Source/JavaScriptCore/wasm/WasmValidate.cpp >index a4b78e458df4598e0ccda61fa94ec919a29afcf4..9b26798a0a98e4ef1e455447ab679041e504709f 100644 >--- a/Source/JavaScriptCore/wasm/WasmValidate.cpp >+++ b/Source/JavaScriptCore/wasm/WasmValidate.cpp >@@ -105,8 +105,8 @@ public: > Result WARN_UNUSED_RETURN addRefIsNull(ExpressionType& value, ExpressionType& result); > > // Tables >- Result WARN_UNUSED_RETURN addTableGet(ExpressionType& idx, ExpressionType& result); >- Result WARN_UNUSED_RETURN addTableSet(ExpressionType& idx, ExpressionType& value); >+ Result WARN_UNUSED_RETURN addTableGet(uint32_t, ExpressionType& idx, ExpressionType& result); >+ Result WARN_UNUSED_RETURN addTableSet(uint32_t, ExpressionType& idx, ExpressionType& value); > > // Locals > Result WARN_UNUSED_RETURN getLocal(uint32_t index, ExpressionType& result); >@@ -147,7 +147,7 @@ public: > > // Calls > Result WARN_UNUSED_RETURN addCall(unsigned calleeIndex, const Signature&, const Vector<ExpressionType>& args, ExpressionType& result); >- Result WARN_UNUSED_RETURN addCallIndirect(const Signature&, const Vector<ExpressionType>& args, ExpressionType& result); >+ Result WARN_UNUSED_RETURN addCallIndirect(unsigned tableIndex, const Signature&, const Vector<ExpressionType>& args, ExpressionType& result); > > ALWAYS_INLINE void didKill(ExpressionType) { } > >@@ -177,20 +177,22 @@ auto Validate::addArguments(const Signature& signature) -> Result > return { }; > } > >-auto Validate::addTableGet(ExpressionType& idx, ExpressionType& result) -> Result >+auto Validate::addTableGet(unsigned tableIndex, ExpressionType& idx, ExpressionType& result) -> Result > { > result = Type::Anyref; > WASM_VALIDATOR_FAIL_IF(Type::I32 != idx, "table.get index to type ", idx, " expected ", Type::I32); >- WASM_VALIDATOR_FAIL_IF(TableElementType::Anyref != m_module.tableInformation.type(), "table.get expects the table to have type ", Type::Anyref); >+ WASM_VALIDATOR_FAIL_IF(tableIndex >= m_module.tableCount(), "table index ", tableIndex, " is invalid, limit is ", m_module.tableCount()); >+ WASM_VALIDATOR_FAIL_IF(TableElementType::Anyref != m_module.tables[tableIndex].type(), "table.get expects the table to have type ", Type::Anyref); > > return { }; > } > >-auto Validate::addTableSet(ExpressionType& idx, ExpressionType& value) -> Result >+auto Validate::addTableSet(unsigned tableIndex, ExpressionType& idx, ExpressionType& value) -> Result > { > WASM_VALIDATOR_FAIL_IF(Type::I32 != idx, "table.set index to type ", idx, " expected ", Type::I32); >+ WASM_VALIDATOR_FAIL_IF(tableIndex >= m_module.tableCount(), "table index ", tableIndex, " is invalid, limit is ", m_module.tableCount()); > WASM_VALIDATOR_FAIL_IF(Type::Anyref != value, "table.set value to type ", value, " expected ", Type::Anyref); >- WASM_VALIDATOR_FAIL_IF(TableElementType::Anyref != m_module.tableInformation.type(), "table.set expects the table to have type ", Type::Anyref); >+ WASM_VALIDATOR_FAIL_IF(TableElementType::Anyref != m_module.tables[tableIndex].type(), "table.set expects the table to have type ", Type::Anyref); > > return { }; > } >@@ -368,9 +370,10 @@ auto Validate::addCall(unsigned, const Signature& signature, const Vector<Expres > return { }; > } > >-auto Validate::addCallIndirect(const Signature& signature, const Vector<ExpressionType>& args, ExpressionType& result) -> Result >+auto Validate::addCallIndirect(unsigned tableIndex, const Signature& signature, const Vector<ExpressionType>& args, ExpressionType& result) -> Result > { >- WASM_VALIDATOR_FAIL_IF(m_module.tableInformation.type() != TableElementType::Funcref, "Table must have type Anyfunc to call"); >+ WASM_VALIDATOR_FAIL_IF(tableIndex >= m_module.tableCount(), "table index ", tableIndex, " is invalid, limit is ", m_module.tableCount()); >+ WASM_VALIDATOR_FAIL_IF(m_module.tables[tableIndex].type() != TableElementType::Funcref, "Table must have type Anyfunc to call"); > const auto argumentCount = signature.argumentCount(); > WASM_VALIDATOR_FAIL_IF(argumentCount != args.size() - 1, "arity mismatch in call_indirect, got ", args.size() - 1, " arguments, expected ", argumentCount); > >diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp b/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp >index 666bf47f1fe23302fc30fd4e1dc73945ea4b3d3f..f62291dcb45502fb2aac092237f4eaf44e2e0430 100644 >--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp >+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp >@@ -53,6 +53,7 @@ JSWebAssemblyInstance::JSWebAssemblyInstance(VM& vm, Structure* structure, Ref<W > : Base(vm, structure) > , m_instance(WTFMove(instance)) > , m_vm(&vm) >+ , m_tables(m_instance->module().moduleInformation().tableCount()) > { > for (unsigned i = 0; i < this->instance().numImportFunctions(); ++i) > new (this->instance().importFunction<WriteBarrier<JSObject>>(i)) WriteBarrier<JSObject>(); >@@ -85,7 +86,8 @@ void JSWebAssemblyInstance::visitChildren(JSCell* cell, SlotVisitor& visitor) > visitor.append(thisObject->m_codeBlock); > visitor.append(thisObject->m_moduleNamespaceObject); > visitor.append(thisObject->m_memory); >- visitor.append(thisObject->m_table); >+ for (unsigned i = 0; i < thisObject->instance().module().moduleInformation().tableCount(); ++i) >+ visitor.append(thisObject->m_tables[i]); > visitor.append(thisObject->m_callee); > visitor.reportExtraMemoryVisited(thisObject->m_instance->extraMemoryAllocated()); > for (unsigned i = 0; i < thisObject->instance().numImportFunctions(); ++i) >diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h b/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h >index 21784a939d8eb47e8f5246e2663ef367704928e5..e1631fcbb1833e018ef7c4d6178091824d4e6128 100644 >--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h >+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h >@@ -71,11 +71,13 @@ public: > } > Wasm::MemoryMode memoryMode() { return memory()->memory().mode(); } > >- JSWebAssemblyTable* table() { return m_table.get(); } >- void setTable(VM& vm, JSWebAssemblyTable* value) { >- ASSERT(!table()); >- m_table.set(vm, this, value); >- instance().setTable(makeRef(*table()->table())); >+ JSWebAssemblyTable* table(unsigned i) { return m_tables[i].get(); } >+ void setTable(VM& vm, uint32_t index, JSWebAssemblyTable* value) >+ { >+ ASSERT(index < m_tables.size()); >+ ASSERT(!table(index)); >+ m_tables[index].set(vm, this, value); >+ instance().setTable(index, makeRef(*table(index)->table())); > } > > JSWebAssemblyModule* module() const { return m_module.get(); } >@@ -98,7 +100,7 @@ private: > WriteBarrier<JSWebAssemblyCodeBlock> m_codeBlock; > WriteBarrier<JSModuleNamespaceObject> m_moduleNamespaceObject; > WriteBarrier<JSWebAssemblyMemory> m_memory; >- WriteBarrier<JSWebAssemblyTable> m_table; >+ Vector<WriteBarrier<JSWebAssemblyTable>> m_tables; > WriteBarrier<WebAssemblyToJSCallee> m_callee; > }; > >diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp b/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp >index 4f801e576927ff66ee50c650890efe021707b8f2..f5045ff58cf30e7f2c69700dabf5caa1241ba69d 100644 >--- a/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp >+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp >@@ -113,8 +113,6 @@ void WebAssemblyModuleRecord::link(ExecState* exec, JSValue, JSObject* importObj > return makeString(before, " ", String::fromUTF8(import.module), ":", String::fromUTF8(import.field), " ", after); > }; > >- bool hasTableImport = false; >- > for (const auto& import : moduleInformation.imports) { > // Validation and linking other than Wasm::ExternalKind::Function is already done in JSWebAssemblyInstance. > // Eventually we will move all the linking code in JSWebAssemblyInstance here and remove this switch statement. >@@ -259,20 +257,18 @@ void WebAssemblyModuleRecord::link(ExecState* exec, JSValue, JSObject* importObj > } > > case Wasm::ExternalKind::Table: { >- RELEASE_ASSERT(!hasTableImport); // This should be guaranteed by a validation failure. > // 7. Otherwise (i is a table import): >- hasTableImport = true; > JSWebAssemblyTable* table = jsDynamicCast<JSWebAssemblyTable*>(vm, value); > // i. If v is not a WebAssembly.Table object, throw a WebAssembly.LinkError. > if (!table) > return exception(createJSWebAssemblyLinkError(exec, vm, importFailMessage(import, "Table import", "is not an instance of WebAssembly.Table"))); > >- uint32_t expectedInitial = moduleInformation.tableInformation.initial(); >+ uint32_t expectedInitial = moduleInformation.tables[import.kindIndex].initial(); > uint32_t actualInitial = table->length(); > if (actualInitial < expectedInitial) > return exception(createJSWebAssemblyLinkError(exec, vm, importFailMessage(import, "Table import", "provided an 'initial' that is too small"))); > >- if (Optional<uint32_t> expectedMaximum = moduleInformation.tableInformation.maximum()) { >+ if (Optional<uint32_t> expectedMaximum = moduleInformation.tables[import.kindIndex].maximum()) { > Optional<uint32_t> actualMaximum = table->maximum(); > if (!actualMaximum) > return exception(createJSWebAssemblyLinkError(exec, vm, importFailMessage(import, "Table import", "does not have a 'maximum' but the module requires that it does"))); >@@ -280,14 +276,14 @@ void WebAssemblyModuleRecord::link(ExecState* exec, JSValue, JSObject* importObj > return exception(createJSWebAssemblyLinkError(exec, vm, importFailMessage(import, "Imported Table", "'maximum' is larger than the module's expected 'maximum'"))); > } > >- auto expectedType = moduleInformation.tableInformation.type(); >+ auto expectedType = moduleInformation.tables[import.kindIndex].type(); > auto actualType = table->table()->type(); > if (expectedType != actualType) > return exception(createJSWebAssemblyLinkError(exec, vm, importFailMessage(import, "Table import", "provided a 'type' that is wrong"))); > > // ii. Append v to tables. > // iii. Append v.[[Table]] to imports. >- m_instance->setTable(vm, table); >+ m_instance->setTable(vm, import.kindIndex, table); > RETURN_IF_EXCEPTION(scope, void()); > break; > } >@@ -297,16 +293,16 @@ void WebAssemblyModuleRecord::link(ExecState* exec, JSValue, JSObject* importObj > } > } > >- { >- if (!!moduleInformation.tableInformation && moduleInformation.tableInformation.isImport()) { >+ for (unsigned i = 0; i < moduleInformation.tableCount(); ++i) { >+ if (moduleInformation.tables[i].isImport()) { > // We should either have a Table import or we should have thrown an exception. >- RELEASE_ASSERT(hasTableImport); >+ RELEASE_ASSERT(m_instance->table(i)); > } > >- if (!!moduleInformation.tableInformation && !hasTableImport) { >- RELEASE_ASSERT(!moduleInformation.tableInformation.isImport()); >+ if (!m_instance->table(i)) { >+ RELEASE_ASSERT(!moduleInformation.tables[i].isImport()); > // We create a Table when it's a Table definition. >- RefPtr<Wasm::Table> wasmTable = Wasm::Table::tryCreate(moduleInformation.tableInformation.initial(), moduleInformation.tableInformation.maximum(), moduleInformation.tableInformation.type()); >+ RefPtr<Wasm::Table> wasmTable = Wasm::Table::tryCreate(moduleInformation.tables[i].initial(), moduleInformation.tables[i].maximum(), moduleInformation.tables[i].type()); > if (!wasmTable) > return exception(createJSWebAssemblyLinkError(exec, vm, "couldn't create Table")); > JSWebAssemblyTable* table = JSWebAssemblyTable::create(exec, vm, globalObject->webAssemblyTableStructure(), wasmTable.releaseNonNull()); >@@ -314,7 +310,7 @@ void WebAssemblyModuleRecord::link(ExecState* exec, JSValue, JSObject* importObj > // If it's defined to be too large, we should have thrown a validation error. > scope.assertNoException(); > ASSERT(table); >- m_instance->setTable(vm, table); >+ m_instance->setTable(vm, i, table); > RETURN_IF_EXCEPTION(scope, void()); > } > } >@@ -369,10 +365,8 @@ void WebAssemblyModuleRecord::link(ExecState* exec, JSValue, JSObject* importObj > } > case Wasm::ExternalKind::Table: { > // This should be guaranteed by module verification. >- RELEASE_ASSERT(m_instance->table()); >- ASSERT(exp.kindIndex == 0); >- >- exportedValue = m_instance->table(); >+ RELEASE_ASSERT(m_instance->table(exp.kindIndex)); >+ exportedValue = m_instance->table(exp.kindIndex); > break; > } > case Wasm::ExternalKind::Memory: { >@@ -459,7 +453,6 @@ JSValue WebAssemblyModuleRecord::evaluate(ExecState* exec) > Wasm::Module& module = m_instance->instance().module(); > Wasm::CodeBlock* codeBlock = m_instance->instance().codeBlock(); > const Wasm::ModuleInformation& moduleInformation = module.moduleInformation(); >- JSWebAssemblyTable* table = m_instance->table(); > > const Vector<Wasm::Segment::Ptr>& data = moduleInformation.data; > >@@ -471,16 +464,16 @@ JSValue WebAssemblyModuleRecord::evaluate(ExecState* exec) > // Also, it could be that a table wasn't imported, or that the table > // imported wasn't compatible. However, those should error out before > // getting here. >- ASSERT(!!table); >+ ASSERT(!!m_instance->table(element.tableIndex)); > > if (!element.functionIndices.size()) > continue; > >- uint32_t tableIndex = element.offset.isGlobalImport() >+ uint32_t elementIndex = element.offset.isGlobalImport() > ? static_cast<uint32_t>(m_instance->instance().loadI32Global(element.offset.globalImportIndex())) > : element.offset.constValue(); > >- fn(element, tableIndex); >+ fn(element, element.tableIndex, elementIndex); > > if (exception) > break; >@@ -504,9 +497,9 @@ JSValue WebAssemblyModuleRecord::evaluate(ExecState* exec) > }; > > // Validation of all element ranges comes before all Table and Memory initialization. >- forEachElement([&] (const Wasm::Element& element, uint32_t tableIndex) { >- uint64_t lastWrittenIndex = static_cast<uint64_t>(tableIndex) + static_cast<uint64_t>(element.functionIndices.size()) - 1; >- if (UNLIKELY(lastWrittenIndex >= table->length())) >+ forEachElement([&] (const Wasm::Element& element, uint32_t tableIndex, uint32_t elementIndex) { >+ uint64_t lastWrittenIndex = static_cast<uint64_t>(elementIndex) + static_cast<uint64_t>(element.functionIndices.size()) - 1; >+ if (UNLIKELY(lastWrittenIndex >= m_instance->table(tableIndex)->length())) > exception = JSValue(throwException(exec, scope, createJSWebAssemblyLinkError(exec, vm, "Element is trying to set an out of bounds table index"_s))); > }); > >@@ -525,7 +518,7 @@ JSValue WebAssemblyModuleRecord::evaluate(ExecState* exec) > return exception.value(); > > JSGlobalObject* globalObject = m_instance->globalObject(vm); >- forEachElement([&] (const Wasm::Element& element, uint32_t tableIndex) { >+ forEachElement([&] (const Wasm::Element& element, uint32_t tableIndex, uint32_t elementIndex) { > for (uint32_t i = 0; i < element.functionIndices.size(); ++i) { > // FIXME: This essentially means we're exporting an import. > // We need a story here. We need to create a WebAssemblyFunction >@@ -541,14 +534,14 @@ JSValue WebAssemblyModuleRecord::evaluate(ExecState* exec) > // Because a WebAssemblyWrapperFunction can never wrap another WebAssemblyWrapperFunction, > // the only type this could be is WebAssemblyFunction. > RELEASE_ASSERT(wasmFunction); >- table->set(tableIndex, wasmFunction); >- ++tableIndex; >+ m_instance->table(tableIndex)->set(elementIndex, wasmFunction); >+ ++elementIndex; > continue; > } > >- table->set(tableIndex, >+ m_instance->table(tableIndex)->set(elementIndex, > WebAssemblyWrapperFunction::create(vm, globalObject, globalObject->webAssemblyWrapperFunctionStructure(), functionImport, functionIndex, m_instance.get(), signatureIndex)); >- ++tableIndex; >+ ++elementIndex; > continue; > } > >@@ -562,8 +555,8 @@ JSValue WebAssemblyModuleRecord::evaluate(ExecState* exec) > WebAssemblyFunction* function = WebAssemblyFunction::create( > vm, globalObject, globalObject->webAssemblyFunctionStructure(), signature.argumentCount(), String(), m_instance.get(), embedderEntrypointCallee, entrypointLoadLocation, signatureIndex); > >- table->set(tableIndex, function); >- ++tableIndex; >+ m_instance->table(tableIndex)->set(elementIndex, function); >+ ++elementIndex; > } > }); > >diff --git a/Source/JavaScriptCore/wasm/wasm.json b/Source/JavaScriptCore/wasm/wasm.json >index 30bbc74723783922edbbf634993490f48b7b7e02..83831a73385a80efd49f6183dfbc885dc5bd90c3 100644 >--- a/Source/JavaScriptCore/wasm/wasm.json >+++ b/Source/JavaScriptCore/wasm/wasm.json >@@ -66,10 +66,10 @@ > "tee_local": { "category": "special", "value": 34, "return": ["any"], "parameter": ["any"], "immediate": [{"name": "local_index", "type": "varuint32"}], "description": "write a local variable or parameter and return the same value" }, > "get_global": { "category": "special", "value": 35, "return": ["any"], "parameter": [], "immediate": [{"name": "global_index", "type": "varuint32"}], "description": "read a global variable" }, > "set_global": { "category": "special", "value": 36, "return": [], "parameter": ["any"], "immediate": [{"name": "global_index", "type": "varuint32"}], "description": "write a global variable" }, >- "table.get": { "category": "special", "value": 37, "return": ["anyref"], "parameter": ["i32"], "immediate": [], "description": "get a table value" }, >- "table.set": { "category": "special", "value": 38, "return": [], "parameter": ["i32", "anyref"], "immediate": [], "description": "set a table value" }, >+ "table.get": { "category": "special", "value": 37, "return": ["anyref"], "parameter": ["i32"], "immediate": [{"name": "table_index", "type": "varuint32"}], "description": "get a table value" }, >+ "table.set": { "category": "special", "value": 38, "return": [], "parameter": ["i32", "anyref"], "immediate": [{"name": "table_index", "type": "varuint32"}], "description": "set a table value" }, > "call": { "category": "call", "value": 16, "return": ["call"], "parameter": ["call"], "immediate": [{"name": "function_index", "type": "varuint32"}], "description": "call a function by its index" }, >- "call_indirect": { "category": "call", "value": 17, "return": ["call"], "parameter": ["call"], "immediate": [{"name": "type_index", "type": "varuint32"}, {"name": "reserved", "type": "varuint1"}], "description": "call a function indirect with an expected signature" }, >+ "call_indirect": { "category": "call", "value": 17, "return": ["call"], "parameter": ["call"], "immediate": [{"name": "type_index", "type": "varuint32"}, {"name": "table_index","type": "varuint32"}],"description": "call a function indirect with an expected signature" }, > "i32.load8_s": { "category": "memory", "value": 44, "return": ["i32"], "parameter": ["addr"], "immediate": [{"name": "flags", "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" }, > "i32.load8_u": { "category": "memory", "value": 45, "return": ["i32"], "parameter": ["addr"], "immediate": [{"name": "flags", "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" }, > "i32.load16_s": { "category": "memory", "value": 46, "return": ["i32"], "parameter": ["addr"], "immediate": [{"name": "flags", "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" }, >diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog >index 8dee3f28e95447e8e404c0ce730f8493248329e4..55c7bd2050fd515a1d9dfd37c49b2c2c0842d30b 100644 >--- a/JSTests/ChangeLog >+++ b/JSTests/ChangeLog >@@ -1,3 +1,43 @@ >+2019-06-13 Justin Michaud <justin_michaud@apple.com> >+ >+ [WASM-References] Add support for multiple tables >+ https://bugs.webkit.org/show_bug.cgi?id=198760 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ * wasm/Builder.js: >+ * wasm/js-api/call-indirect.js: >+ (const.oneTable): >+ (const.multiTable): >+ (multiTable): >+ (multiTable.Polyphic2Import): >+ (multiTable.VirtualImport): >+ (const.wasmModuleWhichImportJS): Deleted. >+ (const.makeTable): Deleted. >+ (): Deleted. >+ (Polyphic2Import): Deleted. >+ (VirtualImport): Deleted. >+ * wasm/js-api/table.js: >+ (new.WebAssembly.Module): >+ (assert.throws): >+ (assertBadTableImport): >+ (assert.truthy): >+ (assert.throws.new.WebAssembly.Module.builder.WebAssembly): Deleted. >+ * wasm/references/anyref_table.js: >+ * wasm/references/anyref_table_import.js: >+ (makeImport): >+ (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport): >+ (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl): >+ * wasm/references/multitable.js: Added. >+ (assert.throws.1.exports.set_tbl0): >+ (assert.throws): >+ (assert.eq): >+ * wasm/references/validation.js: >+ (assert.throws.new.WebAssembly.Module.bin): >+ (assert.throws): >+ * wasm/spec-tests/imports.wast.js: >+ * wasm/wasm.json: >+ > 2019-06-11 Guillaume Emont <guijemont@igalia.com> > > Skip stress/ftl-gettypedarrayoffset-wasteful.js on Arm/Linux >diff --git a/JSTests/wasm/Builder.js b/JSTests/wasm/Builder.js >index 7e7c1b7dc223c883e10e6f373bcdd3c6c29d511b..cbc54d4877af17a6d68941a163964148f23a02a8 100644 >--- a/JSTests/wasm/Builder.js >+++ b/JSTests/wasm/Builder.js >@@ -306,6 +306,7 @@ const _checkImms = (op, imms, expectedImms, ret) => { > case "target_count": break; // improve checking https://bugs.webkit.org/show_bug.cgi?id=163421 > case "target_table": break; // improve checking https://bugs.webkit.org/show_bug.cgi?id=163421 > case "reserved": break; // improve checking https://bugs.webkit.org/show_bug.cgi?id=163421 >+ case "table_index": break; // improve checking https://bugs.webkit.org/show_bug.cgi?id=163421 > default: throw new Error(`Implementation problem: unhandled immediate "${expect.name}" on "${op}"`); > } > } >diff --git a/JSTests/wasm/js-api/call-indirect.js b/JSTests/wasm/js-api/call-indirect.js >index 01cd42f9b79a921b1bbaa5ab576fc0d910438328..2fafcc192b120539c7aa4551d443daae7bd81972 100644 >--- a/JSTests/wasm/js-api/call-indirect.js >+++ b/JSTests/wasm/js-api/call-indirect.js >@@ -1,7 +1,7 @@ > import * as assert from '../assert.js'; > import Builder from '../Builder.js'; > >-const wasmModuleWhichImportJS = () => { >+const oneTable = () => { > const builder = (new Builder()) > .Type().End() > .Import() >@@ -31,6 +31,39 @@ const wasmModuleWhichImportJS = () => { > return module; > }; > >+const multiTable = () => { >+ const builder = (new Builder()) >+ .Type().End() >+ .Import() >+ .Function("imp", "func", { params: ["i32"] }) >+ .Table("imp", "table0", { initial: 0, maximum: 0, element: "anyfunc"}) >+ .Table("imp", "table", { initial: 1, maximum: 1, element: "anyfunc"}) >+ .End() >+ .Function().End() >+ .Export() >+ .Function("changeCounter") >+ .Function("callFunc") >+ .End() >+ .Code() >+ .Function("changeCounter", { params: ["i32", "i32"] }) >+ .I32Const(42) >+ .GetLocal(0) >+ .I32Add() >+ .GetLocal(1) >+ .CallIndirect(0, 1) // Calls table[0](param[0] + 42). >+ .End() >+ .Function("callFunc", { params: ["i32"] }) >+ .GetLocal(0) >+ .Call(0) // Calls func(param[0] + 42) >+ .End() >+ .End(); >+ const bin = builder.WebAssembly().get(); >+ const module = new WebAssembly.Module(bin); >+ return module; >+}; >+ >+for (const wasmModuleWhichImportJS of [oneTable, multiTable]) { >+ > const makeTable = () => { > return new WebAssembly.Table({initial: 1, maximum: 1, element: "anyfunc"}); > }; >@@ -40,7 +73,7 @@ const makeTable = () => { > const counterSetter = v => counter = v; > const table = makeTable(); > const module = wasmModuleWhichImportJS(); >- const instance = new WebAssembly.Instance(module, { imp: { func: counterSetter, table} }); >+ const instance = new WebAssembly.Instance(module, { imp: { func: counterSetter, table, table0: new WebAssembly.Table({initial: 0, maximum: 0, element: "anyfunc"}) } }); > table.set(0, instance.exports.callFunc); > for (let i = 0; i < 4096; ++i) { > // Invoke this a bunch of times to make sure the IC in the wasm -> JS stub works correctly. >@@ -57,11 +90,11 @@ const makeTable = () => { > const module = wasmModuleWhichImportJS(); > > const tableA = makeTable(); >- const instanceA = new WebAssembly.Instance(module, { imp: { func: counterASetter, table: tableA} }); >+ const instanceA = new WebAssembly.Instance(module, { imp: { func: counterASetter, table: tableA, table0: new WebAssembly.Table({initial: 0, maximum: 0, element: "anyfunc"}) } }); > tableA.set(0, instanceA.exports.callFunc); > > const tableB = makeTable(); >- const instanceB = new WebAssembly.Instance(module, { imp: { func: counterBSetter, table: tableB} }); >+ const instanceB = new WebAssembly.Instance(module, { imp: { func: counterBSetter, table: tableB, table0: new WebAssembly.Table({initial: 0, maximum: 0, element: "anyfunc"}) } }); > tableB.set(0, instanceB.exports.callFunc); > for (let i = 0; i < 2048; ++i) { > instanceA.exports.changeCounter(i, 0); >@@ -93,7 +126,7 @@ const makeTable = () => { > let instances = []; > for (let i = 0; i < num; ++i) { > let table = makeTable(); >- instances[i] = new WebAssembly.Instance(module, { imp: { func: counterSetters[i], table} }); >+ instances[i] = new WebAssembly.Instance(module, { imp: { func: counterSetters[i], table, table0: new WebAssembly.Table({initial: 0, maximum: 0, element: "anyfunc"}) } }); > table.set(0, instances[i].exports.callFunc); > } > for (let i = 0; i < 2048; ++i) { >@@ -104,3 +137,5 @@ const makeTable = () => { > } > } > })(); >+ >+} >diff --git a/JSTests/wasm/js-api/table.js b/JSTests/wasm/js-api/table.js >index bbca89ec34f71912084f6309aac2d64550a43bd1..1b844431ce65f91c4375325d5cae53dc8bc243c7 100644 >--- a/JSTests/wasm/js-api/table.js >+++ b/JSTests/wasm/js-api/table.js >@@ -13,7 +13,7 @@ import * as assert from '../assert.js'; > .End() > .Code() > .End(); >- assert.throws(() => new WebAssembly.Module(builder.WebAssembly().get()), WebAssembly.CompileError, "WebAssembly.Module doesn't parse at byte 34: Cannot have more than one Table for now"); >+ new WebAssembly.Module(builder.WebAssembly().get()) > } > > { >@@ -38,7 +38,7 @@ import * as assert from '../assert.js'; > .End() > .Code() > .End(); >- assert.throws(() => new WebAssembly.Module(builder.WebAssembly().get()), WebAssembly.CompileError, "WebAssembly.Module doesn't parse at byte 17: Table count of 2 is invalid, at most 1 is allowed for now (evaluating 'new WebAssembly.Module(builder.WebAssembly().get())')"); >+ new WebAssembly.Module(builder.WebAssembly().get()) > } > > { >@@ -73,7 +73,28 @@ import * as assert from '../assert.js'; > .CallIndirect(0, 1) > .End() > .End(); >- assert.throws(() => new WebAssembly.Module(builder.WebAssembly().get()), WebAssembly.CompileError, "WebAssembly.Module doesn't parse at byte 6: call_indirect's 'reserved' varuint1 must be 0x0, in function at index 0 (evaluating 'new WebAssembly.Module(builder.WebAssembly().get())')"); >+ assert.throws(() => new WebAssembly.Module(builder.WebAssembly().get()), WebAssembly.CompileError, "WebAssembly.Module doesn't parse at byte 6: call_indirect's table index 1 invalid, limit is 1, in function at index 0 (evaluating 'new WebAssembly.Module(builder.WebAssembly().get())')"); >+} >+ >+{ >+ const builder = new Builder() >+ .Type().End() >+ .Function().End() >+ .Table() >+ .Table({initial:20, element:"anyfunc"}) >+ .Table({initial:20, element:"anyfunc"}) >+ .End() >+ .Export() >+ .Function("foo") >+ .End() >+ .Code() >+ .Function("foo", {params: ["i32"]}) >+ .GetLocal(0) >+ .GetLocal(0) >+ .CallIndirect(0, 1) >+ .End() >+ .End(); >+ new WebAssembly.Module(builder.WebAssembly().get()) > } > > { >@@ -186,7 +207,7 @@ function assertBadTableImport(tableDescription, message) { > .Function().End() > .Code() > .End(); >- assert.throws(() => new WebAssembly.Module(builder.WebAssembly().get()), WebAssembly.CompileError, "WebAssembly.Module doesn't parse at byte 39: Cannot have more than one Table for now"); >+ new WebAssembly.Module(builder.WebAssembly().get()) > } > > >@@ -320,3 +341,26 @@ assert.throws(() => WebAssembly.Table.prototype.grow(undefined), TypeError, `exp > assert.eq(instance.exports.table.length, 20); > assert.truthy(instance.exports.table instanceof WebAssembly.Table); > } >+ >+{ >+ const builder = new Builder() >+ .Type().End() >+ .Function().End() >+ .Table() >+ .Table({initial: 0, maximum: 1, element: "anyfunc"}) >+ .Table({initial: 20, maximum: 30, element: "anyfunc"}) >+ .End() >+ .Export() >+ .Table("table0", 0) >+ .Table("table", 1) >+ .Table("table2", 1) >+ .End() >+ .Code().End(); >+ >+ const module = new WebAssembly.Module(builder.WebAssembly().get()); >+ const instance = new WebAssembly.Instance(module); >+ assert.eq(instance.exports.table, instance.exports.table2); >+ assert.eq(instance.exports.table.length, 20); >+ assert.eq(instance.exports.table0.length, 0); >+ assert.truthy(instance.exports.table instanceof WebAssembly.Table); >+} >diff --git a/JSTests/wasm/references/anyref_table.js b/JSTests/wasm/references/anyref_table.js >index 8a0c293e55693aa201ba3bbfe1d0ce65d82a591d..c751a76116b87d7262ed9c48b3f20ac7ba5d9128 100644 >--- a/JSTests/wasm/references/anyref_table.js >+++ b/JSTests/wasm/references/anyref_table.js >@@ -18,12 +18,12 @@ const $1 = new WebAssembly.Instance(new WebAssembly.Module((new Builder()) > .Function("set_tbl", { params: ["anyref"], ret: "void" }) > .I32Const(0) > .GetLocal(0) >- .TableSet() >+ .TableSet(0) > .End() > > .Function("get_tbl", { params: [], ret: "anyref" }) > .I32Const(0) >- .TableGet() >+ .TableGet(0) > .End() > > .Function("tbl_is_null", { params: [], ret: "i32" }) >diff --git a/JSTests/wasm/references/anyref_table_import.js b/JSTests/wasm/references/anyref_table_import.js >index 88cab7c23fe7b40ad69ec236d4bb69d23518b63e..1742bb208c0a82424270ed5b90ff0a6b40875301 100644 >--- a/JSTests/wasm/references/anyref_table_import.js >+++ b/JSTests/wasm/references/anyref_table_import.js >@@ -22,12 +22,12 @@ import Builder from '../Builder.js'; > .Function("set_tbl", { params: ["anyref"], ret: "void" }) > .I32Const(0) > .GetLocal(0) >- .TableSet() >+ .TableSet(0) > .End() > > .Function("get_tbl", { params: [], ret: "anyref" }) > .I32Const(0) >- .TableGet() >+ .TableGet(0) > .End() > > .Function("tbl_is_null", { params: [], ret: "i32" }) >@@ -88,12 +88,12 @@ import Builder from '../Builder.js'; > .Function("set_tbl", { params: ["anyref"], ret: "void" }) > .I32Const(0) > .GetLocal(0) >- .TableSet() >+ .TableSet(0) > .End() > > .Function("get_tbl", { params: [], ret: "anyref" }) > .I32Const(0) >- .TableGet() >+ .TableGet(0) > .End() > > .Function("tbl_is_null", { params: [], ret: "i32" }) >@@ -127,12 +127,12 @@ import Builder from '../Builder.js'; > .Function("set_tbl", { params: ["anyref"], ret: "void" }) > .I32Const(0) > .GetLocal(0) >- .TableSet() >+ .TableSet(0) > .End() > > .Function("get_tbl", { params: [], ret: "anyref" }) > .I32Const(0) >- .TableGet() >+ .TableGet(0) > .End() > > .Function("tbl_is_null", { params: [], ret: "i32" }) >diff --git a/JSTests/wasm/references/multitable.js b/JSTests/wasm/references/multitable.js >new file mode 100644 >index 0000000000000000000000000000000000000000..3a31fd6b5c8e33717875400d4b01ea87d5216a8c >--- /dev/null >+++ b/JSTests/wasm/references/multitable.js >@@ -0,0 +1,287 @@ >+import * as assert from '../assert.js'; >+import Builder from '../Builder.js'; >+ >+{ >+ const $1 = new WebAssembly.Instance(new WebAssembly.Module((new Builder()) >+ .Type().End() >+ .Function().End() >+ .Table() >+ .Table({initial: 0, maximum: 0, element: "anyref"}) >+ .Table({initial: 20, maximum: 30, element: "anyref"}) >+ .End() >+ .Export() >+ .Function("set_tbl") >+ .Function("get_tbl") >+ .Function("get_tbl0") >+ .Function("set_tbl0") >+ .Table("tbl", 1) >+ .End() >+ .Code() >+ .Function("set_tbl", { params: ["anyref"], ret: "void" }) >+ .I32Const(0) >+ .GetLocal(0) >+ .TableSet(1) >+ .End() >+ >+ .Function("get_tbl", { params: [], ret: "anyref" }) >+ .I32Const(0) >+ .TableGet(1) >+ .End() >+ >+ .Function("get_tbl0", { params: [], ret: "anyref" }) >+ .I32Const(0) >+ .TableGet(0) >+ .End() >+ >+ .Function("set_tbl0", { params: ["anyref"], ret: "void" }) >+ .I32Const(0) >+ .GetLocal(0) >+ .TableSet(0) >+ .End() >+ .End().WebAssembly().get())); >+ >+ fullGC() >+ >+ assert.eq($1.exports.get_tbl(), null) >+ >+ $1.exports.set_tbl("hi") >+ fullGC() >+ assert.eq($1.exports.get_tbl(), "hi") >+ assert.eq($1.exports.tbl.get(0), "hi") >+ assert.eq($1.exports.tbl.get(1), null) >+ >+ assert.throws(() => $1.exports.get_tbl0(), Error, "Out of bounds table access (evaluating 'func(...args)')"); >+ assert.throws(() => $1.exports.set_tbl0(null), Error, "Out of bounds table access (evaluating 'func(...args)')"); >+} >+ >+{ >+ const tbl = new WebAssembly.Table({initial:0, element:"anyref"}); >+ const $1 = new WebAssembly.Instance(new WebAssembly.Module((new Builder()) >+ .Type().End() >+ .Import() >+ .Table("imp", "tbl", {initial: 0, element: "anyref"}) >+ .End() >+ .Function().End() >+ .Table() >+ .Table({initial: 20, maximum: 30, element: "anyref"}) >+ .End() >+ .Export() >+ .Function("set_tbl") >+ .Function("get_tbl") >+ .Function("get_tbl0") >+ .Function("set_tbl0") >+ .Table("tbl", 1) >+ .End() >+ .Code() >+ .Function("set_tbl", { params: ["anyref"], ret: "void" }) >+ .I32Const(0) >+ .GetLocal(0) >+ .TableSet(1) >+ .End() >+ >+ .Function("get_tbl", { params: [], ret: "anyref" }) >+ .I32Const(0) >+ .TableGet(1) >+ .End() >+ >+ .Function("get_tbl0", { params: [], ret: "anyref" }) >+ .I32Const(0) >+ .TableGet(0) >+ .End() >+ >+ .Function("set_tbl0", { params: ["anyref"], ret: "void" }) >+ .I32Const(0) >+ .GetLocal(0) >+ .TableSet(0) >+ .End() >+ .End().WebAssembly().get()), { imp: { tbl }}); >+ >+ fullGC() >+ >+ assert.eq($1.exports.get_tbl(), null) >+ >+ $1.exports.set_tbl("hi") >+ fullGC() >+ assert.eq($1.exports.get_tbl(), "hi") >+ assert.eq($1.exports.tbl.get(0), "hi") >+ assert.eq($1.exports.tbl.get(1), null) >+ >+ assert.throws(() => $1.exports.get_tbl0(), Error, "Out of bounds table access (evaluating 'func(...args)')"); >+ assert.throws(() => $1.exports.set_tbl0(null), Error, "Out of bounds table access (evaluating 'func(...args)')"); >+} >+ >+{ >+ const tbl = new WebAssembly.Table({initial:1, element:"anyref"}); >+ const $1 = new WebAssembly.Instance(new WebAssembly.Module((new Builder()) >+ .Type().End() >+ .Import() >+ .Table("imp", "tbl", {initial: 1, element: "anyref"}) >+ .End() >+ .Function().End() >+ .Table() >+ .Table({initial: 20, maximum: 30, element: "anyref"}) >+ .End() >+ .Export() >+ .Function("set_tbl") >+ .Function("get_tbl") >+ .Function("get_tbl0") >+ .Function("set_tbl0") >+ .Table("tbl", 1) >+ .End() >+ .Code() >+ .Function("set_tbl", { params: ["anyref"], ret: "void" }) >+ .I32Const(0) >+ .GetLocal(0) >+ .TableSet(1) >+ .End() >+ >+ .Function("get_tbl", { params: [], ret: "anyref" }) >+ .I32Const(0) >+ .TableGet(1) >+ .End() >+ >+ .Function("get_tbl0", { params: [], ret: "anyref" }) >+ .I32Const(0) >+ .TableGet(0) >+ .End() >+ >+ .Function("set_tbl0", { params: ["anyref"], ret: "void" }) >+ .I32Const(0) >+ .GetLocal(0) >+ .TableSet(0) >+ .End() >+ .End().WebAssembly().get()), { imp: { tbl }}); >+ >+ fullGC() >+ >+ assert.eq($1.exports.get_tbl(), null) >+ >+ $1.exports.set_tbl("hi") >+ fullGC() >+ $1.exports.set_tbl0(null) >+ assert.eq($1.exports.get_tbl(), "hi") >+ assert.eq($1.exports.get_tbl0(), null) >+ assert.eq($1.exports.tbl.get(0), "hi") >+ assert.eq($1.exports.tbl.get(1), null) >+ assert.eq(tbl.get(0), null) >+} >+ >+{ >+ const $1 = new WebAssembly.Instance(new WebAssembly.Module((new Builder()) >+ .Type().End() >+ .Function().End() >+ .Table() >+ .Table({initial: 3, maximum: 30, element: "anyfunc"}) >+ .Table({initial: 2, maximum: 30, element: "anyfunc"}) >+ .End() >+ .Export() >+ .Function("call_tbl0") >+ .Function("call_tbl1") >+ .Function("ret42") >+ .Function("ret1337") >+ .Function("ret256") >+ .End() >+ .Element() >+ .Element({tableIndex: 1, offset: 0, functionIndices: [2]}) >+ .End() >+ .Code() >+ .Function("call_tbl0", { params: ["i32"], ret: "i32" }) >+ .GetLocal(0) >+ .CallIndirect(1,0) >+ .End() >+ >+ .Function("call_tbl1", { params: ["i32"], ret: "i32" }) >+ .GetLocal(0) >+ .CallIndirect(1,1) >+ .End() >+ >+ .Function("ret42", { params: [], ret: "i32" }) >+ .I32Const(42) >+ .End() >+ >+ .Function("ret1337", { params: [], ret: "i32" }) >+ .I32Const(1337) >+ .End() >+ >+ .Function("ret256", { params: [], ret: "i32" }) >+ .I32Const(256) >+ .End() >+ .End().WebAssembly().get())); >+ >+ fullGC() >+ >+ assert.eq($1.exports.call_tbl1(0), 42) >+ assert.throws(() => $1.exports.call_tbl0(0), Error, "call_indirect to a null table entry (evaluating 'func(...args)')") >+ assert.throws(() => $1.exports.call_tbl1(1), Error, "call_indirect to a null table entry (evaluating 'func(...args)')") >+} >+ >+{ >+ const $1 = new WebAssembly.Instance(new WebAssembly.Module((new Builder()) >+ .Type().End() >+ .Function().End() >+ .Table() >+ .Table({initial: 3, maximum: 30, element: "anyfunc"}) >+ .Table({initial: 2, maximum: 30, element: "anyfunc"}) >+ .End() >+ .Export() >+ .Function("call_tbl0") >+ .Function("call_tbl1") >+ .Function("ret42") >+ .Function("ret1337") >+ .Function("ret256") >+ .End() >+ .Element() >+ .Element({tableIndex: 1, offset: 0, functionIndices: [2]}) >+ .Element({tableIndex: 0, offset: 0, functionIndices: [3]}) >+ .Element({tableIndex: 1, offset: 1, functionIndices: [4]}) >+ .End() >+ .Code() >+ .Function("call_tbl0", { params: ["i32"], ret: "i32" }) >+ .GetLocal(0) >+ .CallIndirect(1,0) >+ .End() >+ >+ .Function("call_tbl1", { params: ["i32"], ret: "i32" }) >+ .GetLocal(0) >+ .CallIndirect(1,1) >+ .End() >+ >+ .Function("ret42", { params: [], ret: "i32" }) >+ .I32Const(42) >+ .End() >+ >+ .Function("ret1337", { params: [], ret: "i32" }) >+ .I32Const(1337) >+ .End() >+ >+ .Function("ret256", { params: [], ret: "i32" }) >+ .I32Const(256) >+ .End() >+ .End().WebAssembly().get())); >+ >+ fullGC() >+ >+ assert.eq($1.exports.call_tbl1(0), 42) >+ assert.eq($1.exports.call_tbl0(0), 1337) >+ assert.eq($1.exports.call_tbl1(1), 256) >+ assert.throws(() => $1.exports.call_tbl0(1), Error, "call_indirect to a null table entry (evaluating 'func(...args)')") >+ assert.throws(() => $1.exports.call_tbl0(2), Error, "call_indirect to a null table entry (evaluating 'func(...args)')") >+ assert.throws(() => $1.exports.call_tbl1(2), Error, "Out of bounds call_indirect (evaluating 'func(...args)')") >+} >+ assert.throws(() => new WebAssembly.Instance(new WebAssembly.Module((new Builder()) >+ .Type().End() >+ .Function().End() >+ .Table() >+ .Table({initial: 3, maximum: 3, element: "anyfunc"}) >+ .Table({initial: 2, maximum: 2, element: "anyfunc"}) >+ .End() >+ .Element() >+ .Element({tableIndex: 1, offset: 0, functionIndices: [0]}) >+ .Element({tableIndex: 0, offset: 0, functionIndices: [0]}) >+ .Element({tableIndex: 1, offset: 2, functionIndices: [0]}) >+ .End() >+ .Code() >+ .Function("ret42", { params: [], ret: "i32" }) >+ .I32Const(42) >+ .End() >+ .End().WebAssembly().get())), Error, "Element is trying to set an out of bounds table index (evaluating 'new WebAssembly.Instance')") >diff --git a/JSTests/wasm/references/validation.js b/JSTests/wasm/references/validation.js >index d38c265bfff610ad494884f9a77a6373c84e52a3..538828cca91377cc69803d31a6c0efb06d1c1fff 100644 >--- a/JSTests/wasm/references/validation.js >+++ b/JSTests/wasm/references/validation.js >@@ -24,6 +24,9 @@ import Builder from '../Builder.js'; > { > const builder = (new Builder()) > .Type().End() >+ .Import() >+ .Table("imp", "tbl", {initial: 2, element: "anyfunc"}) >+ .End() > .Function().End() > .Export() > .Function("j") >@@ -32,7 +35,7 @@ import Builder from '../Builder.js'; > .Function("j", { params: [], ret: "void" }) > .I32Const(0) > .I32Const(0) >- .TableSet() >+ .TableSet(0) > .End() > .End(); > >@@ -56,7 +59,7 @@ import Builder from '../Builder.js'; > .Function("j", { params: ["anyref"], ret: "void" }) > .I32Const(0) > .GetLocal(0) >- .TableSet() >+ .TableSet(0) > .End() > .End(); > >@@ -79,7 +82,7 @@ import Builder from '../Builder.js'; > .Code() > .Function("j", { params: [], ret: "anyref" }) > .I32Const(0) >- .TableGet() >+ .TableGet(0) > .End() > .End(); > >diff --git a/JSTests/wasm/spec-tests/imports.wast.js b/JSTests/wasm/spec-tests/imports.wast.js >index 48d140966a4f758367080297a4c03caa74833531..494d82cda3d5ba4fdfbb5b960e062d2a143b44d4 100644 >--- a/JSTests/wasm/spec-tests/imports.wast.js >+++ b/JSTests/wasm/spec-tests/imports.wast.js >@@ -189,13 +189,14 @@ assert_trap(() => call($14, "call", [3])); > assert_trap(() => call($14, "call", [100])); > > // imports.wast:293 >-assert_invalid("\x00\x61\x73\x6d\x01\x00\x00\x00\x02\x8d\x80\x80\x80\x00\x02\x00\x00\x01\x70\x00\x0a\x00\x00\x01\x70\x00\x0a"); >+// These tests assert that we can only have one table. The references spec makes this incorrect, and this should be fixed when it gets merged into the main spec. >+//assert_invalid("\x00\x61\x73\x6d\x01\x00\x00\x00\x02\x8d\x80\x80\x80\x00\x02\x00\x00\x01\x70\x00\x0a\x00\x00\x01\x70\x00\x0a"); > > // imports.wast:297 >-assert_invalid("\x00\x61\x73\x6d\x01\x00\x00\x00\x02\x87\x80\x80\x80\x00\x01\x00\x00\x01\x70\x00\x0a\x04\x84\x80\x80\x80\x00\x01\x70\x00\x0a"); >+//assert_invalid("\x00\x61\x73\x6d\x01\x00\x00\x00\x02\x87\x80\x80\x80\x00\x01\x00\x00\x01\x70\x00\x0a\x04\x84\x80\x80\x80\x00\x01\x70\x00\x0a"); > > // imports.wast:301 >-assert_invalid("\x00\x61\x73\x6d\x01\x00\x00\x00\x04\x87\x80\x80\x80\x00\x02\x70\x00\x0a\x70\x00\x0a"); >+//assert_invalid("\x00\x61\x73\x6d\x01\x00\x00\x00\x04\x87\x80\x80\x80\x00\x02\x70\x00\x0a\x70\x00\x0a"); > > // imports.wast:306 > let $15 = instance("\x00\x61\x73\x6d\x01\x00\x00\x00\x02\x97\x80\x80\x80\x00\x01\x04\x74\x65\x73\x74\x0c\x74\x61\x62\x6c\x65\x2d\x31\x30\x2d\x69\x6e\x66\x01\x70\x00\x0a"); >diff --git a/JSTests/wasm/wasm.json b/JSTests/wasm/wasm.json >index 30bbc74723783922edbbf634993490f48b7b7e02..83831a73385a80efd49f6183dfbc885dc5bd90c3 100644 >--- a/JSTests/wasm/wasm.json >+++ b/JSTests/wasm/wasm.json >@@ -66,10 +66,10 @@ > "tee_local": { "category": "special", "value": 34, "return": ["any"], "parameter": ["any"], "immediate": [{"name": "local_index", "type": "varuint32"}], "description": "write a local variable or parameter and return the same value" }, > "get_global": { "category": "special", "value": 35, "return": ["any"], "parameter": [], "immediate": [{"name": "global_index", "type": "varuint32"}], "description": "read a global variable" }, > "set_global": { "category": "special", "value": 36, "return": [], "parameter": ["any"], "immediate": [{"name": "global_index", "type": "varuint32"}], "description": "write a global variable" }, >- "table.get": { "category": "special", "value": 37, "return": ["anyref"], "parameter": ["i32"], "immediate": [], "description": "get a table value" }, >- "table.set": { "category": "special", "value": 38, "return": [], "parameter": ["i32", "anyref"], "immediate": [], "description": "set a table value" }, >+ "table.get": { "category": "special", "value": 37, "return": ["anyref"], "parameter": ["i32"], "immediate": [{"name": "table_index", "type": "varuint32"}], "description": "get a table value" }, >+ "table.set": { "category": "special", "value": 38, "return": [], "parameter": ["i32", "anyref"], "immediate": [{"name": "table_index", "type": "varuint32"}], "description": "set a table value" }, > "call": { "category": "call", "value": 16, "return": ["call"], "parameter": ["call"], "immediate": [{"name": "function_index", "type": "varuint32"}], "description": "call a function by its index" }, >- "call_indirect": { "category": "call", "value": 17, "return": ["call"], "parameter": ["call"], "immediate": [{"name": "type_index", "type": "varuint32"}, {"name": "reserved", "type": "varuint1"}], "description": "call a function indirect with an expected signature" }, >+ "call_indirect": { "category": "call", "value": 17, "return": ["call"], "parameter": ["call"], "immediate": [{"name": "type_index", "type": "varuint32"}, {"name": "table_index","type": "varuint32"}],"description": "call a function indirect with an expected signature" }, > "i32.load8_s": { "category": "memory", "value": 44, "return": ["i32"], "parameter": ["addr"], "immediate": [{"name": "flags", "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" }, > "i32.load8_u": { "category": "memory", "value": 45, "return": ["i32"], "parameter": ["addr"], "immediate": [{"name": "flags", "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" }, > "i32.load16_s": { "category": "memory", "value": 46, "return": ["i32"], "parameter": ["addr"], "immediate": [{"name": "flags", "type": "varuint32"}, {"name": "offset", "type": "varuint32"}], "description": "load from memory" },
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=372080">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Flags:
saam
:
review-
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 198760
:
372080
|
372175
|
372266
|
372313
|
372347
|
372376
|
372380
|
372381