[wasm] Fix and tighten memory validation

test/mjsunit/wasm/grow-memory.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --expose-wasm --stress-compaction
 
 load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 var kPageSize = 0x10000;
@@ skipping 166 matching lines @@
   for (offset = 19*kPageSize; offset < 19*kPageSize + 5; offset++) {
     assertTraps(kTrapMemOutOfBounds, poke);
     assertTraps(kTrapMemOutOfBounds, peek);
   }
 }
 
 testGrowMemoryReadWrite8();
 
 function testGrowMemoryZeroInitialSize() {
   var builder = genGrowMemoryBuilder();
+  builder.addMemory(0, kV8MaxPages, false);
   var module = builder.instantiate();
   var offset;
   function peek() { return module.exports.load(offset); }
   function poke(value) { return module.exports.store(offset, value); }
   function growMem(pages) { return module.exports.grow_memory(pages); }
 
   assertTraps(kTrapMemOutOfBounds, peek);
   assertTraps(kTrapMemOutOfBounds, poke);
 
   assertEquals(0, growMem(1));
@@ skipping 13 matching lines @@
     assertEquals(i, growMem(1));
   }
   poke(20);
   assertEquals(20, peek());
 }
 
 testGrowMemoryZeroInitialSize();
 
 function testGrowMemoryZeroInitialSize32() {
   var builder = genGrowMemoryBuilder();
+  builder.addMemory(0, kV8MaxPages, false);
   var module = builder.instantiate();
   var offset;
   function peek() { return module.exports.load(offset); }
   function poke(value) { return module.exports.store(offset, value); }
   function growMem(pages) { return module.exports.grow_memory(pages); }
 
   assertTraps(kTrapMemOutOfBounds, peek);
   assertTraps(kTrapMemOutOfBounds, poke);
 
   assertEquals(0, growMem(1));
 
   for(offset = 0; offset <= kPageSize - 4; offset++) {
     poke(20);
     assertEquals(20, peek());
   }
 
   for(offset = kPageSize - 3; offset <= kPageSize + 5; offset++) {
     assertTraps(kTrapMemOutOfBounds, peek);
   }
 }
 
 testGrowMemoryZeroInitialSize32();
 
 function testGrowMemoryZeroInitialSize16() {
   var builder = genGrowMemoryBuilder();
+  builder.addMemory(0, kV8MaxPages, false);
   var module = builder.instantiate();
   var offset;
   function peek() { return module.exports.load16(offset); }
   function poke(value) { return module.exports.store16(offset, value); }
   function growMem(pages) { return module.exports.grow_memory(pages); }
 
   assertTraps(kTrapMemOutOfBounds, peek);
   assertTraps(kTrapMemOutOfBounds, poke);
 
   assertEquals(0, growMem(1));
 
   for(offset = 0; offset <= kPageSize - 2; offset++) {
     poke(20);
     assertEquals(20, peek());
   }
 
   for(offset = kPageSize - 1; offset <= kPageSize + 5; offset++) {
     assertTraps(kTrapMemOutOfBounds, peek);
   }
 }
 
 testGrowMemoryZeroInitialSize16();
 
 function testGrowMemoryZeroInitialSize8() {
   var builder = genGrowMemoryBuilder();
+  builder.addMemory(0, kV8MaxPages, false);
   var module = builder.instantiate();
   var offset;
   function peek() { return module.exports.load8(offset); }
   function poke(value) { return module.exports.store8(offset, value); }
   function growMem(pages) { return module.exports.grow_memory(pages); }
 
   assertTraps(kTrapMemOutOfBounds, peek);
   assertTraps(kTrapMemOutOfBounds, poke);
 
   assertEquals(0, growMem(1));
 
   for(offset = 0; offset <= kPageSize - 1; offset++) {
     poke(20);
     assertEquals(20, peek());
   }
 
   for(offset = kPageSize; offset <= kPageSize + 5; offset++) {
     assertTraps(kTrapMemOutOfBounds, peek);
   }
 }
 
 testGrowMemoryZeroInitialSize8();
 
 function testGrowMemoryTrapMaxPagesZeroInitialMemory() {
   var builder = genGrowMemoryBuilder();
+  builder.addMemory(0, kV8MaxPages, false);
   var module = builder.instantiate();
   var maxPages = 16385;
   function growMem(pages) { return module.exports.grow_memory(pages); }
   assertEquals(-1, growMem(maxPages));
 }
 
 testGrowMemoryTrapMaxPagesZeroInitialMemory();
 
 function testGrowMemoryTrapMaxPages() {
   var builder = genGrowMemoryBuilder();
   builder.addMemory(1, 1, false);
   var module = builder.instantiate();
   var maxPages = 16384;
   function growMem(pages) { return module.exports.grow_memory(pages); }
   assertEquals(-1, growMem(maxPages));
 }
 
 testGrowMemoryTrapMaxPages();
 
 function testGrowMemoryTrapsWithNonSmiInput() {
   var builder = genGrowMemoryBuilder();
+  builder.addMemory(0, kV8MaxPages, false);
   var module = builder.instantiate();
   function growMem(pages) { return module.exports.grow_memory(pages); }
   // The parameter of grow_memory is unsigned. Therefore -1 stands for
   // UINT32_MIN, which cannot be represented as SMI.
   assertEquals(-1, growMem(-1));
 };
 
 testGrowMemoryTrapsWithNonSmiInput();
 
 function testGrowMemoryCurrentMemory() {
@@ skipping 154 matching lines @@
   var kSpecMaxPages = 65535;
   builder.addMemory(1, kSpecMaxPages, false);
   var module = builder.instantiate();
   function poke(value) { return module.exports.store(offset, value); }
   function growMem(pages) { return module.exports.grow_memory(pages); }
   assertEquals(1, growMem(20));
   assertEquals(-1, growMem(kV8MaxPages - 20));
 }
 
 testGrowMemoryDeclaredSpecMaxTraps();