From 6d7ed2e8707cb865408da6a04d645c65553cd0b1 Mon Sep 17 00:00:00 2001 From: Jakob Kummerow Date: Thu, 9 Dec 2021 22:13:39 +0100 Subject: [PATCH] [wasm] 32-bit platforms: lower kV8MaxWasmMemoryPages by 1 To make sure that Wasm memories don't exceed JSArrayBuffer size. This change shouldn't affect real-world modules, because finding enough contiguous address space to allocate that much memory is virtually impossible anyway. Fixed: chromium:1242339 Change-Id: I68873796b9afb798cb1a64e5e1acc495cf509159 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3328783 Auto-Submit: Jakob Kummerow Reviewed-by: Thibaud Michaud Commit-Queue: Thibaud Michaud Cr-Commit-Position: refs/heads/main@{#78336} --- src/builtins/typed-array-createtypedarray.tq | 2 +- src/objects/js-array-buffer.cc | 1 + src/wasm/wasm-engine.cc | 3 +++ src/wasm/wasm-limits.h | 2 +- 4 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/builtins/typed-array-createtypedarray.tq b/src/builtins/typed-array-createtypedarray.tq index 9004b32ef7..dfb9919801 100644 --- a/src/builtins/typed-array-createtypedarray.tq +++ b/src/builtins/typed-array-createtypedarray.tq @@ -292,7 +292,7 @@ transitioning macro ConstructByArrayBuffer(implicit context: Context)( // in the step 12 branch. newByteLength = bufferByteLength - offset; newLength = elementsInfo.CalculateLength(newByteLength) - otherwise IfInvalidOffset; + otherwise IfInvalidLength; // 12. Else, } else { diff --git a/src/objects/js-array-buffer.cc b/src/objects/js-array-buffer.cc index dac3c8b563..57d8773b7b 100644 --- a/src/objects/js-array-buffer.cc +++ b/src/objects/js-array-buffer.cc @@ -91,6 +91,7 @@ void JSArrayBuffer::Attach(std::shared_ptr backing_store) { // invariant that their byte_length field is always 0. set_byte_length(0); } else { + CHECK_LE(backing_store->byte_length(), kMaxByteLength); set_byte_length(backing_store->byte_length()); } set_max_byte_length(backing_store->max_byte_length()); diff --git a/src/wasm/wasm-engine.cc b/src/wasm/wasm-engine.cc index 31bb88fd48..bc410efc4c 100644 --- a/src/wasm/wasm-engine.cc +++ b/src/wasm/wasm-engine.cc @@ -1649,6 +1649,9 @@ WasmCodeManager* GetWasmCodeManager() { // {max_mem_pages} is declared in wasm-limits.h. uint32_t max_mem_pages() { + static_assert( + kV8MaxWasmMemoryPages * kWasmPageSize <= JSArrayBuffer::kMaxByteLength, + "Wasm memories must not be bigger than JSArrayBuffers"); STATIC_ASSERT(kV8MaxWasmMemoryPages <= kMaxUInt32); return std::min(uint32_t{kV8MaxWasmMemoryPages}, FLAG_wasm_max_mem_pages); } diff --git a/src/wasm/wasm-limits.h b/src/wasm/wasm-limits.h index fcafb69395..fa7784e724 100644 --- a/src/wasm/wasm-limits.h +++ b/src/wasm/wasm-limits.h @@ -40,7 +40,7 @@ constexpr size_t kV8MaxWasmDataSegments = 100000; // Also, do not use this limit to validate declared memory, use // kSpecMaxMemoryPages for that. constexpr size_t kV8MaxWasmMemoryPages = kSystemPointerSize == 4 - ? 32768 // = 2 GiB + ? 32767 // = 2 GiB : 65536; // = 4 GiB constexpr size_t kV8MaxWasmStringSize = 100000; constexpr size_t kV8MaxWasmModuleSize = 1024 * 1024 * 1024; // = 1 GiB