diff options
| author | Thomas Lively <tlively@google.com> | 2022-11-11 12:08:08 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-11-11 20:08:08 +0000 |
| commit | cf908c7976d02a9d3d4810a2b5a04e502e4efed2 (patch) | |
| tree | ac04d8c683903cc76b6e95668bf850f03f9b4be8 /test/lit/arrays.wast | |
| parent | 3928189214e03430bbc9f2b51c6af3887b465160 (diff) | |
| download | binaryen-cf908c7976d02a9d3d4810a2b5a04e502e4efed2.tar.gz binaryen-cf908c7976d02a9d3d4810a2b5a04e502e4efed2.tar.bz2 binaryen-cf908c7976d02a9d3d4810a2b5a04e502e4efed2.zip | |
Fix two fuzz bugs with ArrayNewSeg (#5242)
First, we forgot to note the type annotation on `ArrayNewSeg` instructions, so
in small modules where these are the only annotated instructions, the type
section would be incomplete.
Second, in the interpreter we were reserving space for the array before checking
that the segment access was valid. This could cause huge allocations that threw
bad_alloc exceptions before the interpreter could get around to trapping. Fix
the problem by reserving the array after validating the arguements.
Fixes #5236.
Diffstat (limited to 'test/lit/arrays.wast')
| -rw-r--r-- | test/lit/arrays.wast | 20 |
1 files changed, 10 insertions, 10 deletions
diff --git a/test/lit/arrays.wast b/test/lit/arrays.wast index 4a262ef13..bccbaeb09 100644 --- a/test/lit/arrays.wast +++ b/test/lit/arrays.wast @@ -12,6 +12,15 @@ (module ;; CHECK: (type $arrayref_=>_i32 (func (param arrayref) (result i32))) + ;; CHECK: (type $byte-array (array (mut i8))) + ;; ROUNDTRIP: (type $arrayref_=>_i32 (func (param arrayref) (result i32))) + + ;; ROUNDTRIP: (type $byte-array (array (mut i8))) + (type $byte-array (array (mut i8))) + ;; CHECK: (type $func-array (array (mut funcref))) + ;; ROUNDTRIP: (type $func-array (array (mut funcref))) + (type $func-array (array (mut funcref))) + ;; CHECK: (type $ref|array|_=>_i32 (func (param (ref array)) (result i32))) ;; CHECK: (type $nullref_=>_i32 (func (param nullref) (result i32))) @@ -20,9 +29,7 @@ ;; CHECK: (type $none_=>_ref|$func-array| (func (result (ref $func-array)))) - ;; CHECK: (type $byte-array (array (mut i8))) - ;; ROUNDTRIP: (type $arrayref_=>_i32 (func (param arrayref) (result i32))) - + ;; CHECK: (data "hello") ;; ROUNDTRIP: (type $ref|array|_=>_i32 (func (param (ref array)) (result i32))) ;; ROUNDTRIP: (type $nullref_=>_i32 (func (param nullref) (result i32))) @@ -31,13 +38,6 @@ ;; ROUNDTRIP: (type $none_=>_ref|$func-array| (func (result (ref $func-array)))) - ;; ROUNDTRIP: (type $byte-array (array (mut i8))) - (type $byte-array (array (mut i8))) - ;; CHECK: (type $func-array (array (mut funcref))) - ;; ROUNDTRIP: (type $func-array (array (mut funcref))) - (type $func-array (array (mut funcref))) - - ;; CHECK: (data "hello") ;; ROUNDTRIP: (data "hello") (data "hello") ;; CHECK: (elem func $len $impossible-len $unreachable-len) |