AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
07d82db1eb
v8/test/mjsunit/regress/wasm/regress-666741.js

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

10 lines
319 B
JavaScript
Raw Normal View History

[wasm] Throw a RangeError if Wasm memory could not be allocated. This fixes a bug found by the fuzzer where we would attempt to dereference a null handle if memory allocation failed. In this case, the failure was because the amount of memory requested was above V8's hardcoded limit. BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=666741 Review-Url: https://codereview.chromium.org/2514983002 Cr-Commit-Position: refs/heads/master@{#41158}
2016-11-21 21:58:35 +00:00
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
Reland^5 "[flags] warn about contradictory flags" This is a reland of 2000aea58aed517a755178ebb4712c18acb0c88b Changes compared to last reland: - Add rule in variants.py for --enable_experimental_regexp_engine. - Make sure --abort-on-contradictory-flags works as well as --fuzzing to disable the checking for fuzzers, including for d8 flags. Original change's description: > Reland^4 "[flags] warn about contradictory flags" > > This is a reland of 0ba115e6a9ef0a8aa2af9ce22a1a4521a4a0b363 > Changes compared to last reland: > - Fix Python code trying to write to expected_outcomes, which is now a > computed property. > - Fix remaining place in d8.cc that ignored the --fuzzing flag. > - Expect flag contradictions for --cache in code_serializer variant. > > Original change's description: > > Reland^3 "[flags] warn about contradictory flags" > > > > Changes: > > - Also allow second parameter influenced by --cache to be reassigned. > > - Fix --stress-opt to only --always-opt in the last iteration as before. > > > > Original change's description: > > > Reland^2 "[flags] warn about contradictory flags" > > > > > > This is a reland of d8f8a7e2105305921ca31450ecc38e009bc075c3 > > > Change compared to last reland: > > > - Do not check for d8 flag contradictions in the presence of --fuzzing > > > - Allow identical re-declaration of --cache=* > > > > > > Original change's description: > > > > Reland "[flags] warn about contradictory flags" > > > > > > > > This is a reland of b8f91666649b637e87a338f884d7987b169f6692 > > > > Difference to previous CL: Additional functionality to specify > > > > incompatible flags based on GN variables and extra-flags, used > > > > to fix the issues that came up on the waterfall. > > > > > > > > This also changes the rules regarding repeated flags: While > > > > explicitly repeated flags are allowed for boolean values as long > > > > as they are identical, repeated flags or explicit flags in the > > > > presence of an active implication are disallowed for non-boolean > > > > flags. The latter simplifies specifying conflict rules in > > > > variants.py. Otherwise a rule like > > > > > > > > INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = { > > > > "--gc-interval=*": ["--gc-interval=*"], > > > > } > > > > > > > > wouldn't work because specifying the same GC interval twice > > > > wouldn't actually count as a conflict. This was an issue with > > > > test/mjsunit/wasm/gc-buffer.js, which specifies > > > > --gc-interval=500 exactly like the extra flag by the stress bot. > > > > > > > > Also, this now expands contradictory flags checking to d8 flags > > > > for consistency. > > > > > > > > Original change's description: > > > > > [flags] warn about contradictory flags > > > > > > > > > > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/ > > > > > > > > > > Bug: v8:10577 > > > > > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab > > > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792 > > > > > Reviewed-by: Clemens Backes <clemensb@chromium.org> > > > > > Reviewed-by: Michael Achenbach <machenbach@chromium.org> > > > > > Reviewed-by: Georg Neis <neis@chromium.org> > > > > > Reviewed-by: Tamer Tas <tmrts@chromium.org> > > > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > > > > > Cr-Commit-Position: refs/heads/master@{#68168} > > > > > > > > Bug: v8:10577 > > > > Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341 > > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115 > > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > > > > Reviewed-by: Tamer Tas <tmrts@chromium.org> > > > > Reviewed-by: Clemens Backes <clemensb@chromium.org> > > > > Reviewed-by: Georg Neis <neis@chromium.org> > > > > Cr-Commit-Position: refs/heads/master@{#68989} > > > > > > Bug: v8:10577 > > > Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276 > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464 > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > > > Reviewed-by: Clemens Backes <clemensb@chromium.org> > > > Cr-Commit-Position: refs/heads/master@{#69339} > > > > Bug: v8:10577 > > Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng > > Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng > > Change-Id: I4a69dc57a102782cb453144323e3752ac8278624 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352770 > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > > Reviewed-by: Clemens Backes <clemensb@chromium.org> > > Cr-Commit-Position: refs/heads/master@{#69433} > > Change-Id: Ib6d2aeb495210f581ac671221c265df58e8e5e70 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398640 > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Reviewed-by: Tamer Tas <tmrts@chromium.org> > Cr-Commit-Position: refs/heads/master@{#69954} Bug: v8:10577 TBR: clemensb@chromium.org, tmrts@chromium.org Change-Id: Iab2d32cdcc2648934fc52255ccf3ae3ec9ca4d9b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416386 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#70000}
2020-09-18 14:40:24 +00:00
// Flags: --enable-slow-asserts --expose-wasm
[wasm] Throw a RangeError if Wasm memory could not be allocated. This fixes a bug found by the fuzzer where we would attempt to dereference a null handle if memory allocation failed. In this case, the failure was because the amount of memory requested was above V8's hardcoded limit. BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=666741 Review-Url: https://codereview.chromium.org/2514983002 Cr-Commit-Position: refs/heads/master@{#41158}
2016-11-21 21:58:35 +00:00
(function __f_7() {
[wasm] Check size of tables dynamically We used to check the size of tables at compile time, and threw a CompilationError if a given size exceeded the implementation-defined limit. However, the spec defines that an error should only be thrown when the implementation-defined limit is reached, which is either at instantiation time of during runtime at a table.grow. With this CL the V8 implementation becomes spec compliant in this regard. R=jkummerow@chromium.org Bug: v8:10556 Change-Id: I7d0e688b385a65e4060a569e5ab1dec68947ceea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2326331 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#69267}
2020-08-06 10:14:12 +00:00
assertThrows(() => new WebAssembly.Memory({initial: 79199}), RangeError);
[wasm] Throw a RangeError if Wasm memory could not be allocated. This fixes a bug found by the fuzzer where we would attempt to dereference a null handle if memory allocation failed. In this case, the failure was because the amount of memory requested was above V8's hardcoded limit. BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=666741 Review-Url: https://codereview.chromium.org/2514983002 Cr-Commit-Position: refs/heads/master@{#41158}
2016-11-21 21:58:35 +00:00
})();
Reference in New Issue Copy Permalink