1310149 - Baldr: tighten the check in DecodeLimits after the switch to 0xd

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[Benjamin Bouvier [:bbouvier] (inactive)]

In the AngryBots demo, the memory is marked as a default one (0x1) and with a maximum (0x2), so the flags for the limits are 0x3. This is wrong, per 0xc, and our impl was wrong too.

To not block testing of emscripten & spidermonkey, it has been decided to:
1. update to the new behavior (no more default flag; having a maximum is 0x1)
2. allow flags to be 0x3 in the worst case

Then we are still binary compatible with the demo (the default flag being now interpreted as the has-maximum flag, which is true in this case). When the demo gets updated, we should tighten the flags checking (2). Next demo update should come with 0xd, I assume.

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: Bug 1310149: Tighten the check in DecodeLimits;

Review commit: https://reviewboard.mozilla.org/r/88524/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/88524/

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

I've checked that the newer AngryBots wasm binary still gets validated and compiled with this patch.

Comment 3

[Luke Wagner [:luke]]

Comment on attachment 8804611 [details]
Bug 1310149: Tighten the check in DecodeLimits;

https://reviewboard.mozilla.org/r/88524/#review87826

Thanks!

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ddb7b94d3a6a
Tighten the check in DecodeLimits; r=luke

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ddb7b94d3a6a