[wasm] Fix bounds check for zero initial memory.

src/compiler/wasm-compiler.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/wasm-compiler.h"
 
 #include <memory>
 
 #include "src/isolate-inl.h"
 
@@ skipping 2831 matching lines @@
   Node* node = graph()->NewNode(op, addr, jsgraph()->Int32Constant(0), val,
                                 *effect_, *control_);
   *effect_ = node;
   return node;
 }
 
 void WasmGraphBuilder::BoundsCheckMem(MachineType memtype, Node* index,
                                       uint32_t offset,
                                       wasm::WasmCodePosition position) {
   DCHECK(module_ && module_->instance);
   uint32_t size = module_->instance->mem_size;

[bradn, 2016/10/13 22:43:41]

Shouldn't this be from min_mem_pages in the module, not the instance (since set
of instructions has to be fixed from compile time on).
It probably works now because there's a dummy instance created, but it's better
to base this on the values in the module structure.

[gdeepti, 2016/10/14 01:28:44]

Tried this, but it looks like the test harness still relies on the older
structure. Deferring this till I can look into this more. 

   byte memsize = wasm::WasmOpcodes::MemSize(memtype);
 
   // Check against the effective size.
   size_t effective_size;
   if (size == 0) {
+    // TODO(gdeepti): Remove filler check used here to stash the size of
+    // memtype for when code is relocated.

[bradn, 2016/10/13 22:43:41]

Maybe a single reloc type will work after all?

If we make the first check always:
offset + memtype - 1 < size

And the second:
index < size - offset - memtype + 1

We can then drop each check based on if the minimum allowed size means the
condition is always true?

[gdeepti, 2016/10/14 01:28:44]

Done.

+    Node* cond = graph()->NewNode(jsgraph()->machine()->Uint32LessThan(),
+                                  jsgraph()->Int32Constant(0),
+                                  jsgraph()->RelocatableInt32Constant(
+                                      static_cast<uint32_t>(memsize),
+                                      RelocInfo::WASM_MEMTYPE_SIZE_REFERENCE));
+    trap_->AddTrapIfFalse(wasm::kTrapMemOutOfBounds, cond, position);
     effective_size = 0;
   } else if (offset >= size ||
              (static_cast<uint64_t>(offset) + memsize) > size) {
     // Two checks are needed in the case where the offset is statically
     // out of bounds; one check for the offset being in bounds, and the next for
     // the offset + index being out of bounds for code to be patched correctly
     // on relocation.
     effective_size = size - memsize + 1;
     Node* cond = graph()->NewNode(jsgraph()->machine()->Uint32LessThan(),
                                   jsgraph()->IntPtrConstant(offset),
@@ skipping 541 matching lines @@
                             function_->code_start_offset),
            compile_ms);
   }
 
   return code;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8