[wasm] Enforce memory and table limits during instantiation.

[wasm] Enforce memory and table limits during instantiation.

R=rossberg@chromium.org
BUG=chromium:575167
Review-Url: https://codereview.chromium.org/2636173002
Cr-Commit-Position: refs/heads/master@{#42426}
Committed: https://chromium.googlesource.com/v8/v8/+/8d76f0e3465a84bbf0bceab114900fbe75844e1f

[titzer, 2017-01-17 13:33:28]

The CQ bit was checked by titzer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-01-17 13:33:34]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-17 13:39:04]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-01-17 13:39:04]

Dry run: Try jobs failed on following builders:
  v8_mac_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_mac_rel_ng/builds/15750)

[rossberg, 2017-01-17 14:22:06]

LGTM

https://codereview.chromium.org/2636173002/diff/1/src/wasm/wasm-objects.cc
File src/wasm/wasm-objects.cc (right):

https://codereview.chromium.org/2636173002/diff/1/src/wasm/wasm-objects.cc#ne...
src/wasm/wasm-objects.cc:137: *isolate->factory()->NewNumber(maximum));
Lossy conversion paranoia triggered

https://codereview.chromium.org/2636173002/diff/1/test/mjsunit/wasm/indirect-...
File test/mjsunit/wasm/indirect-tables.js (right):

https://codereview.chromium.org/2636173002/diff/1/test/mjsunit/wasm/indirect-...
test/mjsunit/wasm/indirect-tables.js:246: let table = new
WebAssembly.Table({element: "anyfunc", initial: kTableSize, maximum:
kTableSize});
Nit: line length

https://codereview.chromium.org/2636173002/diff/1/test/mjsunit/wasm/table.js
File test/mjsunit/wasm/table.js (right):

https://codereview.chromium.org/2636173002/diff/1/test/mjsunit/wasm/table.js#...
test/mjsunit/wasm/table.js:272: table = new WebAssembly.Table({element:
"anyfunc", initial: 0, maximum: kV8MaxWasmTableSize});
Nit: line length

[titzer, 2017-01-17 16:47:18]

https://codereview.chromium.org/2636173002/diff/1/src/wasm/wasm-objects.cc
File src/wasm/wasm-objects.cc (right):

https://codereview.chromium.org/2636173002/diff/1/src/wasm/wasm-objects.cc#ne...
src/wasm/wasm-objects.cc:137: *isolate->factory()->NewNumber(maximum));
On 2017/01/17 14:22:06, rossberg wrote:
> Lossy conversion paranoia triggered

Yeah, even though the input is an int64_t, it is really limited to {-1,
kMaxUint32}, so technically it could be an int33_t.

https://codereview.chromium.org/2636173002/diff/1/test/mjsunit/wasm/indirect-...
File test/mjsunit/wasm/indirect-tables.js (right):

https://codereview.chromium.org/2636173002/diff/1/test/mjsunit/wasm/indirect-...
test/mjsunit/wasm/indirect-tables.js:246: let table = new
WebAssembly.Table({element: "anyfunc", initial: kTableSize, maximum:
kTableSize});
On 2017/01/17 14:22:06, rossberg wrote:
> Nit: line length

Done.

https://codereview.chromium.org/2636173002/diff/1/test/mjsunit/wasm/table.js
File test/mjsunit/wasm/table.js (right):

https://codereview.chromium.org/2636173002/diff/1/test/mjsunit/wasm/table.js#...
test/mjsunit/wasm/table.js:272: table = new WebAssembly.Table({element:
"anyfunc", initial: 0, maximum: kV8MaxWasmTableSize});
On 2017/01/17 14:22:06, rossberg wrote:
> Nit: line length

Done.

[titzer, 2017-01-17 16:50:55]

The CQ bit was checked by titzer@chromium.org

[titzer, 2017-01-17 16:50:55]

The patchset sent to the CQ was uploaded after l-g-t-m from
rossberg@chromium.org
Link to the patchset: https://codereview.chromium.org/2636173002/#ps20001
(title: "Fix formatting")

[commit-bot: I haz the power, 2017-01-17 16:51:04]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-17 16:54:15]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-01-17 16:54:16]

Try jobs failed on following builders:
  v8_linux_mipsel_compile_rel on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_mipsel_compile_rel...)
  v8_linux_nodcheck_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_nodcheck_rel_ng/bu...)
  v8_linux_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_rel_ng/builds/19304)

[titzer, 2017-01-17 17:52:17]

The CQ bit was checked by titzer@chromium.org

[titzer, 2017-01-17 17:52:18]

The patchset sent to the CQ was uploaded after l-g-t-m from
rossberg@chromium.org
Link to the patchset: https://codereview.chromium.org/2636173002/#ps60001
(title: "format string")

[commit-bot: I haz the power, 2017-01-17 17:52:22]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-17 18:34:51]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-01-17 18:34:52]

Try jobs failed on following builders:
  v8_linux_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_rel_ng/builds/19311)
  v8_linux_rel_ng_triggered on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_rel_ng_triggered/b...)

[titzer, 2017-01-17 18:49:48]

The CQ bit was checked by titzer@chromium.org

[titzer, 2017-01-17 18:49:49]

The patchset sent to the CQ was uploaded after l-g-t-m from
rossberg@chromium.org
Link to the patchset: https://codereview.chromium.org/2636173002/#ps80001
(title: "[wasm] Enforce memory and table limits during instantiation.")

[commit-bot: I haz the power, 2017-01-17 18:49:58]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-17 19:16:00]

CQ is committing da patch.

Bot data: {"patchset_id": 80001, "attempt_start_ts": 1484678988647860,
"parent_rev": "cfa6ce3232bb402ab9ecd9c201ab840560cbefcf", "commit_rev":
"8d76f0e3465a84bbf0bceab114900fbe75844e1f"}

[commit-bot: I haz the power, 2017-01-17 19:16:04]

Description was changed from

==========
[wasm] Enforce memory and table limits during instantiation.

R=rossberg@chromium.org
BUG=chromium:575167
==========

to

==========
[wasm] Enforce memory and table limits during instantiation.

R=rossberg@chromium.org
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2636173002
Cr-Commit-Position: refs/heads/master@{#42426}
Committed:
https://chromium.googlesource.com/v8/v8/+/8d76f0e3465a84bbf0bceab114900fbe758...
==========

[commit-bot: I haz the power, 2017-01-17 19:16:05]

Committed patchset #5 (id:80001) as
https://chromium.googlesource.com/v8/v8/+/8d76f0e3465a84bbf0bceab114900fbe758...