AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[wasm] Pad all WASM memories to the next power of 2 size

Browse Source 
Combined with existing masking, provides protection against speculative
OOB accesses.

R=clemensh@chromium.org

Bug: chromium:798964
Change-Id: Ib7cdc8bccc6d22b8b45896c63f69cb647deba383
Reviewed-on: https://chromium-review.googlesource.com/856980
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50448}
This commit is contained in:
Ben L. Titzer 2018-01-09 15:10:45 +01:00 committed by Commit Bot
parent 826a6e7fbd
commit ae45cc1f5c
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/wasm/wasm-limits.h
View File

@ -45,6 +45,9 @@ static_assert(kV8MaxWasmMemoryPages <= kSpecMaxWasmMemoryPages,
"v8 should not be more permissive than the spec");
constexpr size_t kSpecMaxWasmTableSize = 0xFFFFFFFFu;
// TODO(titzer): move WASM page size constant here.
constexpr size_t kV8MaxWasmMemoryBytes = kV8MaxWasmMemoryPages * 65536;
constexpr uint64_t kWasmMaxHeapOffset =
static_cast<uint64_t>(
std::numeric_limits<uint32_t>::max()) // maximum base value

9
src/wasm/wasm-memory.cc
View File

@ -86,10 +86,15 @@ void* TryAllocateBackingStore(Isolate* isolate, size_t size,
return memory;
} else {
// TODO(titzer): use guard regions for minicage and merge with above code.
CHECK_LE(size, kV8MaxWasmMemoryBytes);
*allocation_length =
base::bits::RoundUpToPowerOfTwo32(static_cast<uint32_t>(size));
void* memory =
size == 0 ? nullptr : isolate->array_buffer_allocator()->Allocate(size);
size == 0
? nullptr
: isolate->array_buffer_allocator()->Allocate(*allocation_length);
*allocation_base = memory;
*allocation_length = size;
return memory;
}
}