[wasm] Enforce memory and table limits during instantiation.

test/mjsunit/wasm/table.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --expose-wasm
 
 'use strict';
 
 load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 // Basic tests.
 
 var outOfUint32RangeValue = 1e12;
 var int32ButOob = 1073741824;
+var kMaxUint32 = (4 * 1024 * 1024 * 1024) - 1;
+var kV8MaxWasmTableSize = 10000000;
 
 function assertTableIsValid(table) {
   assertSame(WebAssembly.Table.prototype, table.__proto__);
   assertSame(WebAssembly.Table, table.constructor);
   assertTrue(table instanceof Object);
   assertTrue(table instanceof WebAssembly.Table);
 }
 
 (function TestConstructor() {
   assertTrue(WebAssembly.Table instanceof Function);
   assertSame(WebAssembly.Table, WebAssembly.Table.prototype.constructor);
   assertTrue(WebAssembly.Table.prototype.grow instanceof Function);
   assertTrue(WebAssembly.Table.prototype.get instanceof Function);
   assertTrue(WebAssembly.Table.prototype.set instanceof Function);
   let desc = Object.getOwnPropertyDescriptor(WebAssembly.Table.prototype, 'length');
   assertTrue(desc.get instanceof Function);
   assertSame(undefined, desc.set);
 
   assertThrows(() => new WebAssembly.Table(), TypeError);
   assertThrows(() => new WebAssembly.Table(1), TypeError);
   assertThrows(() => new WebAssembly.Table(""), TypeError);
 
   assertThrows(() => new WebAssembly.Table({}), TypeError);
   assertThrows(() => new WebAssembly.Table({initial: 10}), TypeError);
 
   assertThrows(() => new WebAssembly.Table({element: 0, initial: 10}), TypeError);
   assertThrows(() => new WebAssembly.Table({element: "any", initial: 10}), TypeError);
 
-  assertThrows(() => new WebAssembly.Table({element: "anyfunc", initial: -1}), RangeError);
-  assertThrows(() => new WebAssembly.Table({element: "anyfunc", initial: outOfUint32RangeValue}), RangeError);
+  assertThrows(() => new WebAssembly.Table(
+    {element: "anyfunc", initial: -1}), RangeError);
+  assertThrows(() => new WebAssembly.Table(
+    {element: "anyfunc", initial: outOfUint32RangeValue}), RangeError);
 
-  assertThrows(() => new WebAssembly.Table({element: "anyfunc", initial: 10, maximum: -1}), RangeError);
-  assertThrows(() => new WebAssembly.Table({element: "anyfunc", initial: 10, maximum: outOfUint32RangeValue}), RangeError);
-  assertThrows(() => new WebAssembly.Table({element: "anyfunc", initial: 10, maximum: 9}), RangeError);
-
-  assertThrows(() => new WebAssembly.Table({element: "anyfunc", initial: 0, maximum: int32ButOob}));
+  assertThrows(() => new WebAssembly.Table(
+    {element: "anyfunc", initial: 10, maximum: -1}), RangeError);
+  assertThrows(() => new WebAssembly.Table(
+    {element: "anyfunc", initial: 10, maximum: outOfUint32RangeValue}), RangeError);
+  assertThrows(() => new WebAssembly.Table(
+    {element: "anyfunc", initial: 10, maximum: 9}), RangeError);
 
   let table;
   table = new WebAssembly.Table({element: "anyfunc", initial: 1});
   assertTableIsValid(table);
   assertEquals(1, table.length);
   assertEquals(null, table.get(0));
   assertEquals(undefined, table[0]);
 
   table = new WebAssembly.Table({element: "anyfunc", initial: "2"});
   assertTableIsValid(table);
@@ skipping 25 matching lines @@
   assertTableIsValid(table);
   assertEquals(0, table.length);
 
   table = new WebAssembly.Table({element: "anyfunc", maximum: {valueOf() { return "10" }}});
   assertTableIsValid(table);
   assertEquals(0, table.length);
 
   table = new WebAssembly.Table({element: "anyfunc", initial: 0, maximum: undefined});
   assertTableIsValid(table);
   assertEquals(0, table.length);
+
+  table = new WebAssembly.Table({element: "anyfunc", maximum: kMaxUint32});
+  assertTableIsValid(table);
+  assertEquals(0, table.length);
+
+  table = new WebAssembly.Table({element: "anyfunc", maximum: kV8MaxWasmTableSize + 1});
+  assertTableIsValid(table);
+  assertEquals(0, table.length);
 })();
 
 (function TestMaximumIsReadOnce() {
   var a = true;
   var desc = {element: "anyfunc", initial: 10};
   Object.defineProperty(desc, 'maximum', {get: function() {
     if (a) {
       a = false;
       return 16;
     }
@@ skipping 146 matching lines @@
   table.grow(0);
   check(table);
   table.grow(5);
   check(table);
   table.grow(0);
   check(table);
   assertThrows(() => table.grow(1), RangeError);
   assertThrows(() => table.grow(-10), RangeError);
 
   assertThrows(() => WebAssembly.Table.prototype.grow.call([], 0), TypeError);
+
+  table = new WebAssembly.Table(
+    {element: "anyfunc", initial: 0, maximum: kV8MaxWasmTableSize});
+  table.grow(kV8MaxWasmTableSize);
+  assertThrows(() => table.grow(1), RangeError);
 })();