Skip to content

Commit 985b850

Browse files
committed
Merge pull request #141 from WebAssembly/rename-incompletely-specified-behavior
Change 'incompletely specified behavior' phrasing to 'limited local nondeterminism'
2 parents fddb8fc + 225ce8b commit 985b850

File tree

3 files changed

+52
-37
lines changed

3 files changed

+52
-37
lines changed

IncompletelySpecifiedBehavior.md

Lines changed: 0 additions & 36 deletions
This file was deleted.

Nondeterminism.md

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Nondeterminism in WebAssembly
2+
3+
WebAssembly is a [portable](Portability.md) sandboxed platform with limited,
4+
local, nondeterminism.
5+
* *Limited*: non-deterministic execution can only occur in a small number of
6+
well-defined cases (described below) and, in those cases, the implementation
7+
may select from a limited set of possible behaviors.
8+
* *Local*: when non-deterministic execution occurs, the effect is local,
9+
there is no "spooky action at a distance".
10+
11+
The limited, local, non-deterministic model implies:
12+
* Applications can't access data outside the sandbox without going through
13+
appropriate APIs, or otherwise escape the sandbox.
14+
* WebAssembly always maintains valid, trusted callstacks; stray pointer writes
15+
cannot corrupt return addresses or spilled variables on the stack.
16+
* Calls and branches always have valid destinations ensuring
17+
[Control Flow Integrity](http://research.microsoft.com/apps/pubs/default.aspx?id=64250).
18+
* WebAssembly has no [nasal demons](https://en.wikipedia.org/w/index.php?title=Nasal_demons).
19+
20+
Ideally, WebAssembly would be fully deterministic (except where nondeterminism
21+
was essential to the API, like random number generators, date/time functions or
22+
input events). Nondeterminism is only specified as a compromise when there is no
23+
other practical way to achieve [portable](Portability.md) native performance.
24+
25+
The following is a list of the places where the WebAssembly specification
26+
currently admits nondeterminism:
27+
28+
- [When threads are added as a feature](EssentialPostMVPFeatures.md#threads),
29+
even without shared memory, nondeterminism will be visible through the
30+
global sequence of API calls. With shared memory, the result of load
31+
operations is nondeterministic.
32+
33+
- [Out of bounds heap accesses *may* want some flexibility](AstSemantics.md#out-of-bounds)
34+
35+
- [NaN bit patterns](AstSemantics.md#floating-point-operations)
36+
37+
- [Fixed-width SIMD may want some flexibility](EssentialPostMVPFeatures.md#fixed-width-simd)
38+
- In SIMD.js, floating point values may or may not have subnormals flushed to zero.
39+
- In SIMD.js, operations ending in "Approximation" return approximations that may vary between platforms.
40+
41+
- Environment-dependent resource limits may be exhausted.
42+
43+
## Note for users of C, C++, and similar languages
44+
45+
Some operations which have fully defined behavior in WebAssembly itself may nonetheless have undefined behavior at the source code level. For example, while unaligned memory access is fully defined in WebAssembly, C and C++ compilers make no guarantee that a (non-packed) unaligned memory access at the source level is harmlessly translated into an unaligned memory access in WebAssembly. And in practice, popular C and C++ compilers do optimize on the assumption that alignment rules are followed, meaning that they don't always preserve program behavior otherwise.
46+
47+
On WebAssembly, the primary invariants are always maintained. Demons can't actually fly out your nose, as that would constitute an escape from the sandbox. And, callstacks can't become corrupted.
48+
49+
Other than that, programs which invoke undefined behavior at the source language level may be compiled into WebAssembly programs which do anything else, including corrupting the contents of the application heap, calling APIs with arbitrary parameters, hanging, trapping, or consuming arbitrary amounts of resources (within the limits).
50+
51+
[Tools are being developed and ported](Tooling.md) to help developers find and fix bugs in their code.

Portability.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ efficiently on a variety of operating systems and instruction set architectures,
55
[on the Web](Web.md) and [off the Web](NonWeb.md).
66

77
Execution environments which, despite
8-
[allowed implementation variants](IncompletelySpecifiedBehavior.md), don't offer
8+
[limited, local, non-determinism](Nondeterminism.md), don't offer
99
the following characteristics may be able to execute WebAssembly modules
1010
nonetheless. In some cases they may have to emulate behavior that the host
1111
hardware or operating system don't offer so that WebAssembly modules execute

0 commit comments

Comments
 (0)