[wasm] Fix bounds check of a store instruction after a grow_memory instruction

test/common/wasm/wasm-module-runner.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "test/common/wasm/wasm-module-runner.h"
 
 #include "src/handles.h"
 #include "src/isolate.h"
 #include "src/objects.h"
 #include "src/property-descriptor.h"
 #include "src/wasm/module-decoder.h"
 #include "src/wasm/wasm-interpreter.h"
 #include "src/wasm/wasm-js.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-result.h"
-#include "src/zone/zone.h"
 
 namespace v8 {
 namespace internal {
 namespace wasm {
 namespace testing {
 
 uint32_t GetMinModuleMemSize(const WasmModule* module) {
   return WasmModule::kPageSize * module->min_mem_pages;
 }
 
@@ skipping 23 matching lines @@
                                                    ErrorThrower* thrower,
                                                    const WasmModule* module) {
   CHECK(module != nullptr);
 
   if (module->import_table.size() > 0) {
     thrower->Error("Not supported: module has imports.");
   }
   if (module->export_table.size() == 0) {
     thrower->Error("Not supported: module has no exports.");
   }
-
   if (thrower->error()) return Handle<JSObject>::null();
 
   // Although we decoded the module for some pre-validation, run the bytes
   // again through the normal pipeline.
   MaybeHandle<JSObject> module_object = CreateModuleObjectFromBytes(
       isolate, module->module_start, module->module_end, thrower,
       ModuleOrigin::kWasmOrigin);
-  if (module_object.is_null()) return Handle<JSObject>::null();
+  if (module_object.is_null()) {
+    thrower->Error("Module pre-validation failed.");
+    return Handle<JSObject>::null();
+  }
   MaybeHandle<JSObject> maybe_instance = WasmModule::Instantiate(
       isolate, thrower, module_object.ToHandleChecked(),
       Handle<JSReceiver>::null(), Handle<JSArrayBuffer>::null());
   Handle<JSObject> instance;
   if (!maybe_instance.ToHandle(&instance)) {
     return Handle<JSObject>::null();
   }
   return instance;
 }
 
+const Handle<JSObject> CompileInstantiateWasmModuleForTesting(
+    Isolate* isolate, Zone* zone, const byte* module_start,
+    const byte* module_end, ModuleOrigin origin) {
+  ErrorThrower thrower(isolate, "CompileInstantiateWasmModule");
+  std::unique_ptr<const WasmModule> module(DecodeWasmModuleForTesting(
+      isolate, zone, &thrower, module_start, module_end, origin));
+
+  if (module == nullptr) {
+    thrower.Error("Wasm module decode failed");
+    return Handle<JSObject>::null();
+  }
+  return InstantiateModuleForTesting(isolate, &thrower, module.get());
+}
+
+int32_t RunWasmModuleForTesting(Isolate* isolate, Handle<JSObject> instance,
+                                int argc, Handle<Object> argv[],
+                                ModuleOrigin origin) {
+  ErrorThrower thrower(isolate, "RunWasmModule");
+  const char* f_name = origin == ModuleOrigin::kAsmJsOrigin ? "caller" : "main";
+  return CallWasmFunctionForTesting(isolate, instance, &thrower, f_name, argc,
+                                    argv, origin);
+}
+
 int32_t CompileAndRunWasmModule(Isolate* isolate, const byte* module_start,
                                 const byte* module_end, ModuleOrigin origin) {
   HandleScope scope(isolate);
   Zone zone(isolate->allocator());
 
-  ErrorThrower thrower(isolate, "CompileAndRunWasmModule");
-  std::unique_ptr<const WasmModule> module(DecodeWasmModuleForTesting(
-      isolate, &zone, &thrower, module_start, module_end, origin));
-
-  if (module == nullptr) {
-    return -1;
-  }
-  Handle<JSObject> instance =
-      InstantiateModuleForTesting(isolate, &thrower, module.get());
+  Handle<JSObject> instance = CompileInstantiateWasmModuleForTesting(
+      isolate, &zone, module_start, module_end, origin);
   if (instance.is_null()) {
     return -1;
   }
-  const char* f_name = origin == ModuleOrigin::kAsmJsOrigin ? "caller" : "main";
-  return CallWasmFunctionForTesting(isolate, instance, &thrower, f_name, 0,
-                                    nullptr, origin);
+  return RunWasmModuleForTesting(isolate, instance, 0, nullptr, origin);
 }
 
 int32_t InterpretWasmModule(Isolate* isolate, ErrorThrower* thrower,
                             const WasmModule* module, int function_index,
                             WasmVal* args) {
   CHECK(module != nullptr);
 
   Zone zone(isolate->allocator());
   v8::internal::HandleScope scope(isolate);
 
@@ skipping 98 matching lines @@
 void SetupIsolateForWasmModule(Isolate* isolate) {
   WasmJs::InstallWasmMapsIfNeeded(isolate, isolate->native_context());
   WasmJs::InstallWasmModuleSymbolIfNeeded(isolate, isolate->global_object(),
                                           isolate->native_context());
 }
 
 }  // namespace testing
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8