438e7ec6dc
This is a reland of5c3092718e(the CL was reverted because of a Chromium test that is now fixed) Original change's description: > Reland "[asmjs] Properly validate asm.js heap sizes" > > This is a reland of5d69010e26> > Original change's description: > > [asmjs] Properly validate asm.js heap sizes > > > > Enforce both engine limitations and spec (http://asmjs.org/spec/latest/) > > limitations on the size of asm.js heaps. > > > > R=clemensh@chromium.org > > CC=mstarzinger@chromium.org > > > > Bug: chromium:873600 > > Change-Id: I104c23bbd0a9a7c494f97f8f9e83ac5a37496dfd > > Reviewed-on: https://chromium-review.googlesource.com/1174411 > > Commit-Queue: Ben Titzer <titzer@chromium.org> > > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > > Cr-Commit-Position: refs/heads/master@{#55163} > > Bug: chromium:873600 > Change-Id: Id24070bda3aafb9e1a32af0732a1b18f633ef932 > Reviewed-on: https://chromium-review.googlesource.com/1179681 > Commit-Queue: Ben Titzer <titzer@chromium.org> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> > Cr-Commit-Position: refs/heads/master@{#55193} Bug: chromium:873600 Change-Id: I6eca2a89589070837b109278f964fc8e9a0fd6f1 Reviewed-on: https://chromium-review.googlesource.com/1183081 Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Commit-Queue: Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#55249}
100 lines
2.9 KiB
JavaScript
100 lines
2.9 KiB
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --validate-asm --allow-natives-syntax --expose-gc --mock-arraybuffer-allocator
|
|
|
|
let gCounter = 1000;
|
|
let gMinHeap = new ArrayBuffer(1 << 12);
|
|
let gStdlib = {Uint8Array: Uint8Array};
|
|
|
|
// The template of asm.js modules used in this test.
|
|
function Template(stdlib, ffi, heap) {
|
|
"use asm";
|
|
var MEM8 = new stdlib.Uint8Array(heap);
|
|
function foo() { return VAL; }
|
|
return { foo: foo };
|
|
}
|
|
|
|
// Create a fresh module each time.
|
|
function NewModule() {
|
|
// Use eval() to get a unique module each time.
|
|
let val = gCounter++;
|
|
let string = (Template + "; Template").replace("VAL", "" + val);
|
|
// print(string);
|
|
let module = eval(string);
|
|
// print(module);
|
|
module(gStdlib, {}, gMinHeap);
|
|
assertTrue(%IsAsmWasmCode(module));
|
|
return {module: module, val: val};
|
|
}
|
|
|
|
(function TestValid_PowerOfTwo() {
|
|
print("TestValid_PowerOfTwo...");
|
|
let r = NewModule();
|
|
for (let i = 12; i <= 24; i++) {
|
|
gc(); // Likely OOM otherwise.
|
|
let size = 1 << i;
|
|
print(" size=" + size);
|
|
let heap = new ArrayBuffer(size);
|
|
var instance = r.module(gStdlib, {}, heap);
|
|
assertTrue(%IsAsmWasmCode(r.module));
|
|
assertEquals(r.val, instance.foo());
|
|
}
|
|
})();
|
|
|
|
(function TestValid_Multiple() {
|
|
print("TestValid_Multiple...");
|
|
let r = NewModule();
|
|
for (let i = 1; i < 47; i += 7) {
|
|
gc(); // Likely OOM otherwise.
|
|
let size = i * (1 << 24);
|
|
print(" size=" + size);
|
|
let heap = new ArrayBuffer(size);
|
|
var instance = r.module(gStdlib, {}, heap);
|
|
assertTrue(%IsAsmWasmCode(r.module));
|
|
assertEquals(r.val, instance.foo());
|
|
}
|
|
})();
|
|
|
|
(function TestInvalid_TooSmall() {
|
|
print("TestInvalid_TooSmall...");
|
|
for (let i = 1; i < 12; i++) {
|
|
let size = 1 << i;
|
|
print(" size=" + size);
|
|
let r = NewModule();
|
|
let heap = new ArrayBuffer(size);
|
|
var instance = r.module(gStdlib, {}, heap);
|
|
assertFalse(%IsAsmWasmCode(r.module));
|
|
assertEquals(r.val, instance.foo());
|
|
}
|
|
})();
|
|
|
|
(function TestInValid_NonPowerOfTwo() {
|
|
print("TestInvalid_NonPowerOfTwo...");
|
|
for (let i = 12; i <= 24; i++) {
|
|
gc(); // Likely OOM otherwise.
|
|
let size = 1 + (1 << i);
|
|
print(" size=" + size);
|
|
let r = NewModule();
|
|
let heap = new ArrayBuffer(size);
|
|
var instance = r.module(gStdlib, {}, heap);
|
|
assertFalse(%IsAsmWasmCode(r.module));
|
|
assertEquals(r.val, instance.foo());
|
|
}
|
|
})();
|
|
|
|
(function TestInValid_NonMultiple() {
|
|
print("TestInvalid_NonMultiple...");
|
|
for (let i = (1 << 24); i < (1 << 25); i += (1 << 22)) {
|
|
gc(); // Likely OOM otherwise.
|
|
let size = i + (1 << 20);
|
|
print(" size=" + size);
|
|
let r = NewModule();
|
|
let heap = new ArrayBuffer(size);
|
|
var instance = r.module(gStdlib, {}, heap);
|
|
assertFalse(%IsAsmWasmCode(r.module));
|
|
assertEquals(r.val, instance.foo());
|
|
}
|
|
})();
|