[release/10.0][browser][mono] Make sure we treat the 4GB ptrs as unsigned

src/mono/browser/runtime/crypto.ts

@@ -10,6 +10,7 @@ export function mono_wasm_browser_entropy (bufferPtr: number, bufferLength: numb
         return -1;
     }
 
+    bufferPtr = bufferPtr >>> 0;
     const memoryView = localHeapViewU8();
     const targetView = memoryView.subarray(bufferPtr, bufferPtr + bufferLength);
 

src/mono/browser/runtime/debug.ts

@@ -6,7 +6,7 @@ import { toBase64StringImpl } from "./base64";
 import cwraps from "./cwraps";
 import { VoidPtr, CharPtr } from "./types/emscripten";
 import { mono_log_warn } from "./logging";
-import { forceThreadMemoryViewRefresh, free, localHeapViewU8, malloc } from "./memory";
+import { forceThreadMemoryViewRefresh, fixupPointer, free, localHeapViewU8, malloc } from "./memory";
 import { utf8ToString } from "./strings";
 const commands_received: any = new Map<number, CommandResponse>();
 commands_received.remove = function (key: number): CommandResponse {
@@ -42,12 +42,12 @@ export function mono_wasm_fire_debugger_agent_message_with_data_to_pause (base64
 }
 
 export function mono_wasm_fire_debugger_agent_message_with_data (data: number, len: number): void {
-    const base64String = toBase64StringImpl(new Uint8Array(localHeapViewU8().buffer, data, len));
+    const base64String = toBase64StringImpl(new Uint8Array(localHeapViewU8().buffer, fixupPointer(data, 0), len));
     mono_wasm_fire_debugger_agent_message_with_data_to_pause(base64String);
 }
 
 export function mono_wasm_add_dbg_command_received (res_ok: boolean, id: number, buffer: number, buffer_len: number): void {
-    const dbg_command = new Uint8Array(localHeapViewU8().buffer, buffer, buffer_len);
+    const dbg_command = new Uint8Array(localHeapViewU8().buffer, fixupPointer(buffer, 0), buffer_len);
     const base64String = toBase64StringImpl(dbg_command);
     const buffer_obj = {
         res_ok,

src/mono/browser/runtime/diagnostics/common.ts

@@ -51,7 +51,7 @@ export class DiagnosticConnectionBase {
         }
         const message = this.messagesReceived[0]!;
         const bytes_read = Math.min(message.length, bytes_to_read);
-        Module.HEAPU8.set(message.subarray(0, bytes_read), buffer as any);
+        Module.HEAPU8.set(message.subarray(0, bytes_read), buffer as any >>> 0);
         if (bytes_read === message.length) {
             this.messagesReceived.shift();
         } else {

src/mono/browser/runtime/diagnostics/index.ts

@@ -40,7 +40,7 @@ export function setRuntimeGlobals (globalObjects: GlobalObjects): void {
         if (!wrapper) {
             return -1;
         }
-        const message = (new Uint8Array(Module.HEAPU8.buffer, buffer as any, bytes_to_write)).slice();
+        const message = (new Uint8Array(Module.HEAPU8.buffer, buffer as any >>> 0, bytes_to_write)).slice();
         return wrapper.send(message);
     };
 

src/mono/browser/runtime/jiterpreter-interp-entry.ts

@@ -167,7 +167,7 @@ export function mono_jiterp_free_method_data_interp_entry (imethod: number) {
 // FIXME: move this counter into C and make it thread safe
 export function mono_interp_record_interp_entry (imethod: number) {
     // clear the unbox bit
-    imethod = imethod & ~0x1;
+    imethod = (imethod & ~0x1) >>> 0;
 
     const info = infoTable[imethod];
     // This shouldn't happen but it's not worth crashing over
@@ -199,6 +199,10 @@ export function mono_interp_jit_wasm_entry_trampoline (
     if (argumentCount > maxInlineArgs)
         return 0;
 
+    imethod = imethod >>> 0;
+    method = method as any >>> 0 as any;
+    pParamTypes = pParamTypes as any >>> 0 as any;
+
     const info = new TrampolineInfo(
         imethod, method, argumentCount, pParamTypes,
         unbox, hasThisReference, hasReturnValue, defaultImplementation
@@ -265,10 +269,9 @@ function flush_wasm_entry_trampoline_jit_queue () {
 
     // If the function signature contains types that need stackval_from_data, that'll use
     //  some constant slots, so make some extra space
-    const constantSlots = (4 * jitQueue.length) + 1;
     let builder = trampBuilder;
     if (!builder) {
-        trampBuilder = builder = new WasmBuilder(constantSlots);
+        trampBuilder = builder = new WasmBuilder();
 
         builder.defineType(
             "unbox",
@@ -303,7 +306,7 @@ function flush_wasm_entry_trampoline_jit_queue () {
             WasmValtype.void, true
         );
     } else
-        builder.clear(constantSlots);
+        builder.clear();
 
     if (builder.options.wasmBytesLimit <= getCounter(JiterpCounter.BytesGenerated)) {
         return;

src/mono/browser/runtime/jiterpreter-jit-call.ts

@@ -182,6 +182,11 @@ function getWasmTableEntry (index: number) {
 export function mono_interp_invoke_wasm_jit_call_trampoline (
     thunkIndex: number, ret_sp: number, sp: number, ftndesc: number, thrown: NativePointer
 ) {
+    ret_sp = ret_sp as any >>> 0 as any;
+    sp = sp as any >>> 0 as any;
+    ftndesc = ftndesc as any >>> 0 as any;
+    thrown = thrown as any >>> 0 as any;
+
     const thunk = <Function>getWasmTableEntry(thunkIndex);
     try {
         thunk(ret_sp, sp, ftndesc, thrown);
@@ -234,6 +239,11 @@ export function mono_interp_jit_wasm_jit_call_trampoline (
     method: MonoMethod, rmethod: VoidPtr, cinfo: VoidPtr,
     arg_offsets: VoidPtr, catch_exceptions: number
 ): void {
+    method = method as any >>> 0 as any;
+    rmethod = rmethod as any >>> 0 as any;
+    cinfo = cinfo as any >>> 0 as any;
+    arg_offsets = arg_offsets as any >>> 0 as any;
+
     // multiple cinfos can share the same target function, so for that scenario we want to
     //  use the same TrampolineInfo for all of them. if that info has already been jitted
     //  we want to immediately store its pointer into the cinfo, otherwise we add it to
@@ -296,7 +306,7 @@ export function mono_interp_flush_jitcall_queue (): void {
 
     let builder = trampBuilder;
     if (!builder) {
-        trampBuilder = builder = new WasmBuilder(0);
+        trampBuilder = builder = new WasmBuilder();
         // Function type for compiled trampolines
         builder.defineType(
             "trampoline",
@@ -316,7 +326,7 @@ export function mono_interp_flush_jitcall_queue (): void {
         builder.defineImportedFunction("i", "begin_catch", "begin_catch", true, getRawCwrap("mono_jiterp_begin_catch"));
         builder.defineImportedFunction("i", "end_catch", "end_catch", true, getRawCwrap("mono_jiterp_end_catch"));
     } else
-        builder.clear(0);
+        builder.clear();
 
     if (builder.options.wasmBytesLimit <= getCounter(JiterpCounter.BytesGenerated)) {
         cwraps.mono_jiterp_tlqueue_clear(JitQueue.JitCall);

src/mono/browser/runtime/jiterpreter-support.ts

@@ -103,10 +103,8 @@ export class WasmBuilder {
     traceBuf: Array<string> = [];
     branchTargets = new Set<MintOpcodePtr>();
     options!: JiterpreterOptions;
-    constantSlots: Array<number> = [];
     backBranchOffsets: Array<MintOpcodePtr> = [];
     callHandlerReturnAddresses: Array<MintOpcodePtr> = [];
-    nextConstantSlot = 0;
     backBranchTraceLevel = 0;
 
     containsSimd!: boolean;
@@ -115,14 +113,14 @@ export class WasmBuilder {
     compressImportNames = false;
     lockImports = false;
 
-    constructor (constantSlotCount: number) {
+    constructor () {
         this.stack = [new BlobBuilder()];
-        this.clear(constantSlotCount);
+        this.clear();
         this.cfg = new Cfg(this);
         this.defineType("__cpp_exception", { "ptr": WasmValtype.i32 }, WasmValtype.void, true);
     }
 
-    clear (constantSlotCount: number) {
+    clear () {
         this.options = getOptions();
         if (this.options.maxModuleSize >= blobBuilderCapacity)
             throw new Error(`blobBuilderCapacity ${blobBuilderCapacity} is not large enough for jiterpreter-max-module-size of ${this.options.maxModuleSize}`);
@@ -154,10 +152,6 @@ export class WasmBuilder {
         this.traceBuf.length = 0;
         this.branchTargets.clear();
         this.activeBlocks = 0;
-        this.nextConstantSlot = 0;
-        this.constantSlots.length = this.options.useConstants ? constantSlotCount : 0;
-        for (let i = 0; i < this.constantSlots.length; i++)
-            this.constantSlots[i] = 0;
         this.backBranchOffsets.length = 0;
         this.callHandlerReturnAddresses.length = 0;
 
@@ -209,7 +203,6 @@ export class WasmBuilder {
 
         const exceptionTag = this.getExceptionTag();
         const result: any = {
-            c: <any>this.getConstants(),
             m: { h: memory },
         };
         if (exceptionTag)
@@ -328,22 +321,10 @@ export class WasmBuilder {
     }
 
     ptr_const (pointer: number | ManagedPointer | NativePointer) {
-        let idx = this.options.useConstants ? this.constantSlots.indexOf(<any>pointer) : -1;
-        if (
-            this.options.useConstants &&
-            (idx < 0) && (this.nextConstantSlot < this.constantSlots.length)
-        ) {
-            idx = this.nextConstantSlot++;
-            this.constantSlots[idx] = <any>pointer;
-        }
-
-        if (idx >= 0) {
-            this.appendU8(WasmOpcode.get_global);
-            this.appendLeb(idx);
-        } else {
-            // mono_log_info(`Warning: no constant slot for ${pointer} (${this.nextConstantSlot} slots used)`);
-            this.i32_const(pointer);
-        }
+        // mono_log_info(`Warning: no constant slot for ${pointer} (${this.nextConstantSlot} slots used)`);
+        this.appendU8(WasmOpcode.i32_const);
+        // i32_const is always signed
+        this.appendLeb((pointer as any) | 0);
     }
 
     ip_const (value: MintOpcodePtr) {
@@ -507,7 +488,7 @@ export class WasmBuilder {
         this.appendULeb(
             1 + // memory
             (enableWasmEh ? 1 : 0) + // c++ exception tag
-            importsToEmit.length + this.constantSlots.length +
+            importsToEmit.length +
             ((includeFunctionTable !== false) ? 1 : 0)
         );
 
@@ -521,14 +502,6 @@ export class WasmBuilder {
             this.appendU8(ifi.typeIndex);
         }
 
-        for (let i = 0; i < this.constantSlots.length; i++) {
-            this.appendName("c");
-            this.appendName(i.toString(shortNameBase));
-            this.appendU8(0x03); // global
-            this.appendU8(WasmValtype.i32); // all constants are pointers right now
-            this.appendU8(0x00); // constant
-        }
-
         // import the native heap
         this.appendName("m");
         this.appendName("h");
@@ -909,7 +882,8 @@ export class WasmBuilder {
 
     appendMemarg (offset: number, alignPower: number) {
         this.appendULeb(alignPower);
-        this.appendULeb(offset);
+        // u64
+        this.appendULeb(offset >>> 0);
     }
 
     /*
@@ -919,10 +893,9 @@ export class WasmBuilder {
         if (typeof (ptr1) === "string")
             this.local(ptr1);
         else
-            this.i32_const(ptr1);
+            this.ptr_const(ptr1);
 
         this.i32_const(offset);
-        // FIXME: How do we make sure this has correct semantics for pointers over 2gb?
         this.appendU8(WasmOpcode.i32_add);
     }
 
@@ -931,13 +904,6 @@ export class WasmBuilder {
             throw new Error("Jiterpreter block stack not empty");
         return this.stack[0].getArrayView(fullCapacity);
     }
-
-    getConstants () {
-        const result: { [key: string]: number } = {};
-        for (let i = 0; i < this.constantSlots.length; i++)
-            result[i.toString(shortNameBase)] = this.constantSlots[i];
-        return result;
-    }
 }
 
 export class BlobBuilder {
@@ -1617,7 +1583,7 @@ export function append_profiler_event (builder: WasmBuilder, ip: MintOpcodePtr,
             throw new Error(`Unimplemented profiler event ${opcode}`);
     }
     builder.local("frame");
-    builder.i32_const(ip);
+    builder.ptr_const(ip);
     builder.callImport(event_name);
 }
 
@@ -1633,7 +1599,7 @@ export function append_safepoint (builder: WasmBuilder, ip: MintOpcodePtr) {
     builder.block(WasmValtype.void, WasmOpcode.if_);
     builder.local("frame");
     // Not ip_const, because we can't pass relative IP to do_safepoint
-    builder.i32_const(ip);
+    builder.ptr_const(ip);
     builder.callImport("safepoint");
     builder.endBlock();
 }
@@ -2020,8 +1986,6 @@ export type JiterpreterOptions = {
     countBailouts: boolean;
     // Dump the wasm blob for all compiled traces
     dumpTraces: boolean;
-    // Use runtime imports for pointer constants
-    useConstants: boolean;
     // Enable performing backward branches without exiting traces
     noExitBackwardBranches: boolean;
     // Unwrap gsharedvt wrappers when compiling jitcalls if possible
@@ -2062,7 +2026,6 @@ const optionNames: { [jsName: string]: string } = {
     "estimateHeat": "jiterpreter-estimate-heat",
     "countBailouts": "jiterpreter-count-bailouts",
     "dumpTraces": "jiterpreter-dump-traces",
-    "useConstants": "jiterpreter-use-constants",
     "eliminateNullChecks": "jiterpreter-eliminate-null-checks",
     "noExitBackwardBranches": "jiterpreter-backward-branches-enabled",
     "directJitCalls": "jiterpreter-direct-jit-calls",

src/mono/browser/runtime/jiterpreter-trace-generator.ts

@@ -1115,7 +1115,7 @@ export function generateWasmBody (
                 // Stash obj->vtable->klass so we can do a fast has_parent check later
                 if (canDoFastCheck)
                     builder.local("src_ptr", WasmOpcode.tee_local);
-                builder.i32_const(klass);
+                builder.ptr_const(klass);
                 builder.appendU8(WasmOpcode.i32_eq);
                 builder.block(WasmValtype.void, WasmOpcode.if_); // if A
 
@@ -1206,7 +1206,7 @@ export function generateWasmBody (
                     elementClassOffset = getMemberOffset(JiterpMember.ClassElementClass),
                     destOffset = getArgU16(ip, 1),
                     // Get the class's element class, which is what we will actually type-check against
-                    elementClass = getU32_unaligned(klass + elementClassOffset);
+                    elementClass = getU32_unaligned(klass + elementClassOffset) >>> 0;
 
                 if (!klass || !elementClass) {
                     record_abort(builder.traceIndex, ip, traceName, "null-klass");
@@ -1234,7 +1234,7 @@ export function generateWasmBody (
                 builder.local("src_ptr", WasmOpcode.tee_local);
                 builder.appendU8(WasmOpcode.i32_load);
                 builder.appendMemarg(elementClassOffset, 0);
-                builder.i32_const(elementClass);
+                builder.ptr_const(elementClass);
                 builder.appendU8(WasmOpcode.i32_eq);
 
                 // Check klass->rank == 0
@@ -1285,7 +1285,7 @@ export function generateWasmBody (
                 builder.block();
                 append_ldloca(builder, getArgU16(ip, 1), 4);
                 const vtable = get_imethod_data(frame, getArgU16(ip, 3));
-                builder.i32_const(vtable);
+                builder.ptr_const(vtable);
                 append_ldloc(builder, getArgU16(ip, 2), WasmOpcode.i32_load);
                 builder.callImport("newarr");
                 // If the newarr operation succeeded, continue, otherwise bailout
@@ -1973,6 +1973,7 @@ function append_stloc_tail (builder: WasmBuilder, offset: number, opcodeOrPrefix
         // This looks wrong but I assure you it's correct.
         builder.appendULeb(simdOpcode);
     }
+    offset = offset >>> 0;
     const alignment = computeMemoryAlignment(offset, opcodeOrPrefix, simdOpcode);
     builder.appendMemarg(offset, alignment);
     invalidate_local(offset);
@@ -2335,7 +2336,7 @@ function emit_fieldop (
                     append_ldloc(builder, objectOffset, WasmOpcode.i32_load);
                     append_ldloc(builder, objectOffset, WasmOpcode.i32_load);
                     builder.i32_const(builder.traceIndex);
-                    builder.i32_const(ip);
+                    builder.ptr_const(ip);
                     builder.callImport("notnull");
                 }
             }