Fix memory/table segment checks in memory.init/table.init (#3081)
According to the wasm core spec, the checks for the table segments in `table.init` opcode are similar to the checks for `memory.init` opcode: - The size of a passive segment is shrunk to zero after `data.drop` (or `elem.drop`) opcode is executed, and the segment can be used to do `memory.init` (or `table.init`) again - The `memory.init` only traps when `s+n > len(data.data)` or `d+n > len(mem.data)` and `table.init` only traps when `s+n > len(elem.elem)` or `d+n > len(tab.elem)` - The active segment can also be used to do `memory.init` (or `table.init`), while it behaves like a dropped passive segment https://github.com/WebAssembly/bulk-memory-operations/blob/master/proposals/bulk-memory-operations/Overview.md ``` Segments can also be shrunk to size zero by using the following new instructions: - data.drop: discard the data in an data segment - elem.drop: discard the data in an element segment An active segment is equivalent to a passive segment, but with an implicit memory.init followed by a data.drop (or table.init followed by a elem.drop) that is prepended to the module's start function. ``` ps. https://webassembly.github.io/spec/core/bikeshed/#-hrefsyntax-instr-memorymathsfmemoryinitx%E2%91%A0 https://webassembly.github.io/spec/core/bikeshed/#-hrefsyntax-instr-tablemathsftableinitxy%E2%91%A0 https://github.com/bytecodealliance/wasm-micro-runtime/issues/3020
This commit is contained in:
@ -88,17 +88,21 @@ fail:
|
||||
}
|
||||
|
||||
static int
|
||||
wasm_init_table(WASMModuleInstance *inst, uint32 tbl_idx, uint32 elem_idx,
|
||||
wasm_init_table(WASMModuleInstance *inst, uint32 tbl_idx, uint32 seg_idx,
|
||||
uint32 dst_offset, uint32 len, uint32 src_offset)
|
||||
{
|
||||
WASMTableInstance *tbl;
|
||||
uint32 tbl_sz;
|
||||
WASMTableSeg *elem;
|
||||
uint32 elem_len;
|
||||
WASMTableSeg *tbl_seg = inst->module->table_segments + seg_idx;
|
||||
uint32 *tbl_seg_elems = NULL, tbl_seg_len = 0;
|
||||
|
||||
elem = inst->module->table_segments + elem_idx;
|
||||
elem_len = elem->function_count;
|
||||
if (offset_len_out_of_bounds(src_offset, len, elem_len))
|
||||
if (!bh_bitmap_get_bit(inst->e->common.elem_dropped, seg_idx)) {
|
||||
/* table segment isn't dropped */
|
||||
tbl_seg_elems = tbl_seg->func_indexes;
|
||||
tbl_seg_len = tbl_seg->function_count;
|
||||
}
|
||||
|
||||
if (offset_len_out_of_bounds(src_offset, len, tbl_seg_len))
|
||||
goto out_of_bounds;
|
||||
|
||||
tbl = inst->tables[tbl_idx];
|
||||
@ -109,17 +113,10 @@ wasm_init_table(WASMModuleInstance *inst, uint32 tbl_idx, uint32 elem_idx,
|
||||
if (!len)
|
||||
return 0;
|
||||
|
||||
if (bh_bitmap_get_bit(inst->e->common.elem_dropped, elem_idx))
|
||||
goto out_of_bounds;
|
||||
|
||||
if (!wasm_elem_is_passive(inst->module->table_segments[elem_idx].mode))
|
||||
goto out_of_bounds;
|
||||
|
||||
bh_memcpy_s((uint8 *)tbl + offsetof(WASMTableInstance, elems)
|
||||
+ dst_offset * sizeof(uint32),
|
||||
(uint32)((tbl_sz - dst_offset) * sizeof(uint32)),
|
||||
elem->func_indexes + src_offset,
|
||||
(uint32)(len * sizeof(uint32)));
|
||||
tbl_seg_elems + src_offset, (uint32)(len * sizeof(uint32)));
|
||||
|
||||
return 0;
|
||||
out_of_bounds:
|
||||
|
||||
Reference in New Issue
Block a user