tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

simd-partial-oob-store.js (1400B)


      1 // |jit-test| skip-if: !wasmSimdEnabled()
      2 
      3 // Cloned from ad-hack.js but kept separate because it may have to be disabled
      4 // on some devices until bugs are fixed.
      5 
      6 // Bug 1666747 - partially OOB stores are not handled correctly on ARM and ARM64.
      7 // The simulators don't implement the correct semantics anyhow, so when the bug
      8 // is fixed in the code generator they must remain excluded here.
      9 if (getBuildConfiguration("arm64") || getBuildConfiguration("arm64-simulator") ||
     10    getBuildConfiguration("arm") || getBuildConfiguration("arm-simulator")) {
     11      quit(0);
     12 }
     13 
     14 function get(arr, loc, len) {
     15    let res = [];
     16    for ( let i=0; i < len; i++ ) {
     17        res.push(arr[loc+i]);
     18    }
     19    return res;
     20 }
     21 
     22 for ( let offset of iota(16) ) {
     23    var ins = wasmEvalText(`
     24  (module
     25    (memory (export "mem") 1 1)
     26    (func (export "f") (param $loc i32)
     27      (v128.store offset=${offset} (local.get $loc) (v128.const i32x4 ${1+offset} 2 3 ${4+offset*2}))))`);
     28 
     29    // OOB write should trap
     30    assertErrorMessage(() => ins.exports.f(65536-15),
     31                       WebAssembly.RuntimeError,
     32                       /index out of bounds/)
     33 
     34    // Ensure that OOB writes don't write anything.
     35    let start = 65536 - 15 + offset;
     36    let legalBytes = 65536 - start;
     37    var mem8 = new Uint8Array(ins.exports.mem.buffer);
     38    assertSame(get(mem8, start, legalBytes), iota(legalBytes).map((_) => 0));
     39 }