c9c7d4991c
We had a off-by-one bounds check error when checking if we should jump to the default block in a br-table. Instead of always jumping to the default block when we have a jump table with 0 targets we would try to compute an offset past the end of the table. This sometimes would not crash, but it would crash if the there was no block after the br_table, thus adding a cold block would cause a segfault. The actual fix is quite simple, do not count the default block as a jump table entry when computing the limits. This commit also does a bunch of cleanup and adding some comments to the br_table emission code.
62 lines
1.1 KiB
Plaintext
62 lines
1.1 KiB
Plaintext
test interpret
|
|
test run
|
|
target aarch64
|
|
target aarch64 use_bti
|
|
target x86_64
|
|
target s390x
|
|
target riscv64
|
|
|
|
function %br_table_i32(i32) -> i32 {
|
|
jt0 = jump_table [block1, block2, block2, block3]
|
|
|
|
block0(v0: i32):
|
|
br_table v0, block4, jt0
|
|
|
|
block1:
|
|
v1 = iconst.i32 1
|
|
jump block5(v1)
|
|
|
|
block2:
|
|
v2 = iconst.i32 2
|
|
jump block5(v2)
|
|
|
|
block3:
|
|
v3 = iconst.i32 3
|
|
jump block5(v3)
|
|
|
|
block4:
|
|
v4 = iconst.i32 4
|
|
jump block5(v4)
|
|
|
|
block5(v5: i32):
|
|
v6 = iadd.i32 v0, v5
|
|
return v6
|
|
}
|
|
; run: %br_table_i32(0) == 1
|
|
; run: %br_table_i32(1) == 3
|
|
; run: %br_table_i32(2) == 4
|
|
; run: %br_table_i32(3) == 6
|
|
; run: %br_table_i32(4) == 8
|
|
; run: %br_table_i32(5) == 9
|
|
; run: %br_table_i32(6) == 10
|
|
; run: %br_table_i32(-1) == 3
|
|
|
|
|
|
|
|
; RISC-V had a bug where having a br_table on a cold block would cause a segfault
|
|
; See #5496 for more details.
|
|
function %br_table_cold_block(i32) -> i32 system_v {
|
|
jt0 = jump_table []
|
|
|
|
block0(v0: i32):
|
|
jump block1
|
|
|
|
block1 cold:
|
|
br_table v0, block2, jt0
|
|
|
|
block2:
|
|
v1 = iconst.i32 0
|
|
return v1
|
|
}
|
|
; run: %br_table_cold_block(0) == 0
|
|
; run: %br_table_cold_block(1) == 0 |