JavaScriptBench
diff --git a/‎src/settings.js‎
Lines changed: 8 additions & 0 deletions b/‎src/settings.js‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎tests/test_core.py‎
Lines changed: 14 additions & 0 deletions b/‎tests/test_core.py‎
Lines changed: 14 additions & 0 deletions
diff --git a/‎tools/wasm2c.py‎
Lines changed: 18 additions & 0 deletions b/‎tools/wasm2c.py‎
Lines changed: 18 additions & 0 deletions
@@ -1864,6 +1864,14 @@ var PRINTF_LONG_DOUBLE = 0;
 // [link]
 var WASM2C = 0;
 
+// Experimental sandboxing mode, see
+// https://kripken.github.io/blog/wasm/2020/07/27/wasmboxc.html
+//
+//  * full: Normal full wasm2c sandboxing. This uses a signal handler if it can.
+//  * mask: Masks loads and stores.
+//  * none: No sandboxing at all.
+var WASM2C_SANDBOXING = 'full';
+
 // Setting this affects the path emitted in the wasm that refers to the DWARF
 // file, in -gseparate-dwarf mode. This allows the debugging file to be hosted
 // in a custom location.
 
@@ -6307,6 +6307,20 @@ def check(out, err):
     self.do_runf(test_file('core', 'test_autodebug.c'),
                  'success', output_nicerizer=check)
 
+  @parameterized({
+    'full': ('full',),
+    'mask': ('mask',),
+    'none': ('none',),
+  })
+  def test_wasm2c_sandboxing(self, mode):
+    if not can_do_standalone(self):
+      return self.skipTest('standalone mode not supported')
+    self.set_setting('STANDALONE_WASM')
+    self.set_setting('WASM2C')
+    self.set_setting('WASM2C_SANDBOXING', mode)
+    self.wasm_engines = []
+    self.do_core_test('test_hello_world.c')
+
   ### Integration tests
 
   @sync
 
@@ -186,6 +186,24 @@ def name(i):
     })
 
   total += '\n'.join(invokes)
+
+  # adjust sandboxing
+  TRAP_OOB = 'TRAP(OOB)'
+  assert total.count(TRAP_OOB) == 2
+  if Settings.WASM2C_SANDBOXING == 'full':
+    pass # keep it
+  elif Settings.WASM2C_SANDBOXING == 'none':
+    total = total.replace(TRAP_OOB, '{}')
+  elif Settings.WASM2C_SANDBOXING == 'mask':
+    assert not Settings.ALLOW_MEMORY_GROWTH
+    assert (Settings.INITIAL_MEMORY & (Settings.INITIAL_MEMORY - 1)) == 0, 'poewr of 2'
+    total = total.replace(TRAP_OOB, '{}')
+    MEM_ACCESS = '[addr]'
+    assert total.count(MEM_ACCESS) == 3, '2 from wasm2c, 1 from runtime'
+    total = total.replace(MEM_ACCESS, '[addr & %d]' % (Settings.INITIAL_MEMORY - 1))
+  else:
+    exit_with_error('bad sandboxing')
+
   # write out the final file
   with open(c_file, 'w') as out:
     out.write(total)