a5449b0fd6
If the maximum number of memory pages is raised using --wasm-max-mem-pages, we might allocate more than kMaxInt bytes for wasm memory. The byte length is stored as int in JSArrayBuffer, hence this can lead to failures. Thus, we now additially check against kMaxInt, and fail instantiation if this check fails. Drive-by: Add/fix more bounds checks. R=ahaas@chromium.org BUG=chromium:724846 Change-Id: Id8e1a1e13e15f4aa355ab9414b4b950510e5e88a Reviewed-on: https://chromium-review.googlesource.com/509255 Reviewed-by: Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#45465}
15 lines
504 B
JavaScript
15 lines
504 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
load('test/mjsunit/wasm/wasm-constants.js');
|
|
load('test/mjsunit/wasm/wasm-module-builder.js');
|
|
|
|
// Flags: --wasm-max-mem-pages=49152
|
|
|
|
let builder = new WasmModuleBuilder();
|
|
const num_pages = 49152;
|
|
builder.addMemory(num_pages, num_pages);
|
|
// num_pages * 64k (page size) > kMaxInt.
|
|
assertThrows(() => builder.instantiate(), RangeError);
|