[wasm] Compare the maximum memory size with the spec limit, not with the V8 limit

src/wasm/module-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/wasm/module-decoder.h"
 
 #include "src/base/functional.h"
 #include "src/base/platform/platform.h"
 #include "src/flags.h"
 #include "src/macro-assembler.h"
@@ skipping 298 matching lines @@
             // ===== Imported table ==========================================
             import->index =
                 static_cast<uint32_t>(module->function_tables.size());
             module->function_tables.push_back({0, 0, false,
                                                std::vector<int32_t>(), true,
                                                false, SignatureMap()});
             expect_u8("element type", kWasmAnyFunctionTypeForm);
             WasmIndirectFunctionTable* table = &module->function_tables.back();
             consume_resizable_limits(
                 "element count", "elements", WasmModule::kV8MaxTableSize,
-                &table->min_size, &table->has_max, &table->max_size);
+                &table->min_size, &table->has_max, WasmModule::kV8MaxTableSize,
+                &table->max_size);
             break;
           }
           case kExternalMemory: {
             // ===== Imported memory =========================================
             bool has_max = false;
             consume_resizable_limits("memory", "pages", WasmModule::kV8MaxPages,
                                      &module->min_mem_pages, &has_max,
+                                     WasmModule::kSpecMaxPages,
                                      &module->max_mem_pages);
             break;
           }
           case kExternalGlobal: {
             // ===== Imported global =========================================
             import->index = static_cast<uint32_t>(module->globals.size());
             module->globals.push_back(
                 {kAstStmt, false, WasmInitExpr(), 0, true, false});
             WasmGlobal* global = &module->globals.back();
             global->type = consume_value_type();
@@ skipping 41 matching lines @@
       if (module->function_tables.size() < 1) {
         module->function_tables.push_back({0, 0, false, std::vector<int32_t>(),
                                            false, false, SignatureMap()});
       }
 
       for (uint32_t i = 0; ok() && i < table_count; i++) {
         WasmIndirectFunctionTable* table = &module->function_tables.back();
         expect_u8("table type", kWasmAnyFunctionTypeForm);
         consume_resizable_limits("table elements", "elements",
                                  WasmModule::kV8MaxTableSize, &table->min_size,
-                                 &table->has_max, &table->max_size);
+                                 &table->has_max, WasmModule::kV8MaxTableSize,
+                                 &table->max_size);
       }
       section_iter.advance();
     }
 
     // ===== Memory section ==================================================
     if (section_iter.section_code() == kMemorySectionCode) {
       const byte* pos = pc_;
       uint32_t memory_count = consume_u32v("memory count");
       // Require at most one memory for now.
       if (memory_count > 1) {
         error(pos, pos, "invalid memory count %d, maximum 1", memory_count);
       }
 
       for (uint32_t i = 0; ok() && i < memory_count; i++) {
         bool has_max = false;
-        consume_resizable_limits("memory", "pages", WasmModule::kV8MaxPages,
-                                 &module->min_mem_pages, &has_max,
-                                 &module->max_mem_pages);
+        consume_resizable_limits(
+            "memory", "pages", WasmModule::kV8MaxPages, &module->min_mem_pages,
+            &has_max, WasmModule::kSpecMaxPages, &module->max_mem_pages);
       }
       section_iter.advance();
     }
 
     // ===== Global section ==================================================
     if (section_iter.section_code() == kGlobalSectionCode) {
       uint32_t globals_count = consume_u32v("globals count");
       uint32_t imported_globals = static_cast<uint32_t>(module->globals.size());
       if (!IsWithinLimit(std::numeric_limits<int32_t>::max(), globals_count,
                          imported_globals)) {
@@ skipping 419 matching lines @@
       error(pos, pos, "%s %u out of bounds (%d entries)", name, index,
             static_cast<int>(vector.size()));
       *ptr = nullptr;
       return 0;
     }
     *ptr = &vector[index];
     return index;
   }
 
   void consume_resizable_limits(const char* name, const char* units,
-                                uint32_t max_value, uint32_t* initial,
-                                bool* has_max, uint32_t* maximum) {
+                                uint32_t max_initial, uint32_t* initial,
+                                bool* has_max, uint32_t max_maximum,
+                                uint32_t* maximum) {
     uint32_t flags = consume_u32v("resizable limits flags");
     const byte* pos = pc();
     *initial = consume_u32v("initial size");
     *has_max = false;
-    if (*initial > max_value) {
+    if (*initial > max_initial) {
       error(pos, pos,
             "initial %s size (%u %s) is larger than implementation limit (%u)",
-            name, *initial, units, max_value);
+            name, *initial, units, max_initial);
     }
     if (flags & 1) {
       *has_max = true;
       pos = pc();
       *maximum = consume_u32v("maximum size");
-      if (*maximum > max_value) {
+      if (*maximum > max_maximum) {
         error(
             pos, pos,
             "maximum %s size (%u %s) is larger than implementation limit (%u)",
-            name, *maximum, units, max_value);
+            name, *maximum, units, max_maximum);
       }
       if (*maximum < *initial) {
         error(pos, pos, "maximum %s size (%u %s) is less than initial (%u %s)",
               name, *maximum, units, *initial, units);
       }
     } else {
       *has_max = false;
-      *maximum = max_value;
+      *maximum = max_initial;
     }
   }
 
   bool expect_u8(const char* name, uint8_t expected) {
     const byte* pos = pc();
     uint8_t value = consume_u8(name);
     if (value != expected) {
       error(pos, pos, "expected %s 0x%02x, got 0x%02x", name, expected, value);
       return false;
     }
@@ skipping 312 matching lines @@
     table.push_back(std::move(func_asm_offsets));
   }
   if (decoder.more()) decoder.error("unexpected additional bytes");
 
   return decoder.toResult(std::move(table));
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8