[wasm] Fix and tighten memory validation

src/wasm/function-body-decoder.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/signature.h"
 
 #include "src/bit-vector.h"
 #include "src/flags.h"
 #include "src/handles.h"
 #include "src/zone/zone-containers.h"
@@ skipping 1094 matching lines @@
           case kExprI64StoreMem:
             len = DecodeStoreMem(kWasmI64, MachineType::Int64());
             break;
           case kExprF32StoreMem:
             len = DecodeStoreMem(kWasmF32, MachineType::Float32());
             break;
           case kExprF64StoreMem:
             len = DecodeStoreMem(kWasmF64, MachineType::Float64());
             break;
           case kExprGrowMemory: {
+            if (!module_->has_memory) {

[titzer, 2017/01/18 10:17:30]

Can you factor out a little helper to turn this into a one-liner?

if (!CheckHasMemory(error_msg)) break;

[rossberg, 2017/01/18 11:28:09]

Done.

+              error(pc_ - 1, "memory instruction with no memory");
+              break;
+            }
             MemoryIndexOperand operand(this, pc_);
             DCHECK_NOT_NULL(module_);
             if (module_->origin != kAsmJsOrigin) {
               Value val = Pop(0, kWasmI32);
               Push(kWasmI32, BUILD(GrowMemory, val.node));
             } else {
               error("grow_memory is not supported for asmjs modules");
             }
             len = 1 + operand.length;
             break;
           }
           case kExprMemorySize: {
+            if (!module_->has_memory) {
+              error(pc_ - 1, "memory instruction with no memory");
+              break;
+            }
             MemoryIndexOperand operand(this, pc_);
             Push(kWasmI32, BUILD(CurrentMemoryPages));
             len = 1 + operand.length;
             break;
           }
           case kExprCallFunction: {
             CallFunctionOperand operand(this, pc_);
             if (Validate(pc_, operand)) {
               TFNode** buffer = PopArgs(operand.sig);
               TFNode** rets = nullptr;
@@ skipping 160 matching lines @@
   void PushTry(SsaEnv* end_env, SsaEnv* catch_env) {
     const int stack_depth = static_cast<int>(stack_.size());
     control_.emplace_back(Control::Try(pc_, stack_depth, end_env, zone_,
                                        catch_env, current_catch_));
     current_catch_ = static_cast<int32_t>(control_.size() - 1);
   }
 
   void PopControl() { control_.pop_back(); }
 
   int DecodeLoadMem(ValueType type, MachineType mem_type) {
+    if (!module_->has_memory) {
+      error(pc_ - 1, "load instruction with no memory");
+      return 0;
+    }
     MemoryAccessOperand operand(this, pc_,
                                 ElementSizeLog2Of(mem_type.representation()));
 
     Value index = Pop(0, kWasmI32);
     TFNode* node = BUILD(LoadMem, type, mem_type, index.node, operand.offset,
                          operand.alignment, position());
     Push(type, node);
     return 1 + operand.length;
   }
 
   int DecodeStoreMem(ValueType type, MachineType mem_type) {
+    if (!module_->has_memory) {
+      error(pc_ - 1, "store instruction with no memory");
+      return 0;
+    }
     MemoryAccessOperand operand(this, pc_,
                                 ElementSizeLog2Of(mem_type.representation()));
     Value val = Pop(1, type);
     Value index = Pop(0, kWasmI32);
     BUILD(StoreMem, mem_type, index.node, operand.offset, operand.alignment,
           val.node, position());
     return 1 + operand.length;
   }
 
   unsigned ExtractLane(WasmOpcode opcode, ValueType type) {
@@ skipping 698 matching lines @@
 BitVector* AnalyzeLoopAssignmentForTesting(Zone* zone, size_t num_locals,
                                            const byte* start, const byte* end) {
   Decoder decoder(start, end);
   return WasmDecoder::AnalyzeLoopAssignment(&decoder, start,
                                             static_cast<int>(num_locals), zone);
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8