AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[wasm] Stop correctness fuzzing if growing memory fails

Browse Source 
We have similar logic in place when allocating wasm memory fails. For
growing, we also need to hard-abort the program, because it would cause
observable differences in program behaviour otherwise.

R=ahaas@chromium.org, machenbach@chromium.org

Bug: chromium:1063951
Change-Id: I98f3b5364100900fce0e6553a347155a39923ca6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2116036
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66842}
This commit is contained in:
Clemens Backes 2020-03-24 09:21:23 +01:00 committed by Commit Bot
parent 13925319af
commit 48c38718e8
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/wasm/wasm-objects.cc
View File

@ -932,7 +932,13 @@ int32_t WasmMemoryObject::Grow(Isolate* isolate,
// Try allocating a new backing store and copying.
std::unique_ptr<BackingStore> new_backing_store =
backing_store->CopyWasmMemory(isolate, new_pages);
if (!new_backing_store) return -1;
if (!new_backing_store) {
// Crash on out-of-memory if the correctness fuzzer is running.
if (FLAG_correctness_fuzzer_suppressions) {
FATAL("could not grow wasm memory");
}
return -1;
}
// Detach old and create a new one with the new backing store.
old_buffer->Detach(true);