Closed Bug 1914411 Opened 2 years ago Closed 2 years ago

shouldInlineCallDirect: disallow inlining of imported functions

Categories

(Core :: JavaScript: WebAssembly, defect, P1)

defect

Tracking

()

RESOLVED FIXED
131 Branch
Tracking Status
firefox131 --- fixed

People

(Reporter: jseward, Assigned: jseward)

References

Details

Attachments

(1 file)

The lack of such a test leads to
Assertion failure: funcIndex >= numFuncImports, at js/src/wasm/WasmMetadata.h:269
in

js::wasm::IonCompileFunctions
-> IonBuildMIR
   -> EmitBodyExprs
      -> EmitCallRef
         -> FunctionCompiler::shouldInlineCallDirect
            -> CodeMetadata::funcDefFeatureUsage

The lack of such a check has been observed to lead to
Assertion failure: funcIndex >= numFuncImports, at js/src/wasm/WasmMetadata.h:269

Severity: -- → S3
Priority: -- → P1
Pushed by jseward@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/28a1be056b1a shouldInlineCallDirect: disallow inlining of imported functions. r=rhunt.
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 131 Branch
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: