[wasm] Fix and tighten memory validation

test/unittests/wasm/function-body-decoder-unittest.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "test/unittests/test-utils.h"
 
 #include "src/v8.h"
 
 #include "test/common/wasm/test-signatures.h"
 
@@ skipping 183 matching lines @@
         if (types[0] != ret_type || types[1] != param_type) {
           // Test signature mismatch.
           FunctionSig sig(1, 1, types);
           EXPECT_FAILURE_SC(&sig, code);
         }
       }
     }
   }
 };
 
+namespace {
+// A helper for tests that require a module environment for functions,
+// globals, or memories.
+class TestModuleEnv : public ModuleEnv {
+ public:
+  explicit TestModuleEnv(ModuleOrigin origin = kWasmOrigin)
+      : ModuleEnv(&mod, nullptr) {
+    mod.origin = origin;
+  }
+  byte AddGlobal(ValueType type, bool mutability = true) {
+    mod.globals.push_back({type, mutability, WasmInitExpr(), 0, false, false});
+    CHECK(mod.globals.size() <= 127);
+    return static_cast<byte>(mod.globals.size() - 1);
+  }
+  byte AddSignature(FunctionSig* sig) {
+    mod.signatures.push_back(sig);
+    CHECK(mod.signatures.size() <= 127);
+    return static_cast<byte>(mod.signatures.size() - 1);
+  }
+  byte AddFunction(FunctionSig* sig) {
+    mod.functions.push_back({sig,      // sig
+                             0,        // func_index
+                             0,        // sig_index
+                             0,        // name_offset
+                             0,        // name_length
+                             0,        // code_start_offset
+                             0,        // code_end_offset
+                             false,    // import
+                             false});  // export
+    CHECK(mod.functions.size() <= 127);
+    return static_cast<byte>(mod.functions.size() - 1);
+  }
+  byte AddImport(FunctionSig* sig) {
+    byte result = AddFunction(sig);
+    mod.functions[result].imported = true;
+    return result;
+  }
+
+  void InitializeMemory() {
+    mod.has_memory = true;
+    mod.min_mem_pages = 1;
+    mod.max_mem_pages = 100;
+  }
+
+  void InitializeFunctionTable() {
+    mod.function_tables.push_back(
+        {0, 0, true, std::vector<int32_t>(), false, false, SignatureMap()});
+  }
+
+ private:
+  WasmModule mod;
+};
+}  // namespace
+
 TEST_F(FunctionBodyDecoderTest, Int32Const1) {
   byte code[] = {kExprI32Const, 0};
   for (int i = -64; i <= 63; i++) {
     code[1] = static_cast<byte>(i & 0x7F);
     EXPECT_VERIFIES_C(i_i, code);
   }
 }
 
 TEST_F(FunctionBodyDecoderTest, EmptyFunction) {
   byte code[] = {0};
@@ skipping 802 matching lines @@
   TestUnop(kExprI32UConvertF64, kWasmI32, kWasmF64);
   TestUnop(kExprF64SConvertI32, kWasmF64, kWasmI32);
   TestUnop(kExprF64UConvertI32, kWasmF64, kWasmI32);
   TestUnop(kExprF64ConvertF32, kWasmF64, kWasmF32);
   TestUnop(kExprF32SConvertI32, kWasmF32, kWasmI32);
   TestUnop(kExprF32UConvertI32, kWasmF32, kWasmI32);
   TestUnop(kExprF32ConvertF64, kWasmF32, kWasmF64);
 }
 
 TEST_F(FunctionBodyDecoderTest, MacrosStmt) {
+  TestModuleEnv module_env;
+  module = &module_env;
+  module_env.InitializeMemory();
   EXPECT_VERIFIES(v_i, WASM_SET_LOCAL(0, WASM_I32V_3(87348)));
   EXPECT_VERIFIES(v_i, WASM_STORE_MEM(MachineType::Int32(), WASM_I32V_1(24),
                                       WASM_I32V_1(40)));
   EXPECT_VERIFIES(v_i, WASM_IF(WASM_GET_LOCAL(0), WASM_NOP));
   EXPECT_VERIFIES(v_i, WASM_IF_ELSE(WASM_GET_LOCAL(0), WASM_NOP, WASM_NOP));
   EXPECT_VERIFIES(v_v, WASM_NOP);
   EXPECT_VERIFIES(v_v, B1(WASM_NOP));
   EXPECT_VERIFIES(v_v, WASM_LOOP(WASM_NOP));
   EXPECT_VERIFIES(v_v, WASM_LOOP(WASM_BR(0)));
 }
@@ skipping 116 matching lines @@
       TestBinop(kExpr##name, sig);                          \
     }                                                       \
   }
 
   FOREACH_SIMPLE_OPCODE(DECODE_TEST);
 
 #undef DECODE_TEST
 }
 
 TEST_F(FunctionBodyDecoderTest, MemorySize) {
+  TestModuleEnv module_env;
+  module = &module_env;
+  module_env.InitializeMemory();
   byte code[] = {kExprMemorySize, 0};
   EXPECT_VERIFIES_C(i_i, code);
   EXPECT_FAILURE_C(f_ff, code);
 }
 
 TEST_F(FunctionBodyDecoderTest, LoadMemOffset) {
+  TestModuleEnv module_env;
+  module = &module_env;
+  module_env.InitializeMemory();
   for (int offset = 0; offset < 128; offset += 7) {
     byte code[] = {kExprI32Const, 0, kExprI32LoadMem, ZERO_ALIGNMENT,
                    static_cast<byte>(offset)};
     EXPECT_VERIFIES_C(i_i, code);
   }
 }
 
 TEST_F(FunctionBodyDecoderTest, LoadMemAlignment) {
+  TestModuleEnv module_env;
+  module = &module_env;
+  module_env.InitializeMemory();
   struct {
     WasmOpcode instruction;
     uint32_t maximum_aligment;
   } values[] = {
       {kExprI32LoadMem8U, 0},   // --
       {kExprI32LoadMem8S, 0},   // --
       {kExprI32LoadMem16U, 1},  // --
       {kExprI32LoadMem16S, 1},  // --
       {kExprI64LoadMem8U, 0},   // --
       {kExprI64LoadMem8S, 0},   // --
@@ skipping 14 matching lines @@
       if (static_cast<uint32_t>(alignment) <= values[i].maximum_aligment) {
         EXPECT_VERIFIES_C(v_i, code);
       } else {
         EXPECT_FAILURE_C(v_i, code);
       }
     }
   }
 }
 
 TEST_F(FunctionBodyDecoderTest, StoreMemOffset) {
+  TestModuleEnv module_env;
+  module = &module_env;
+  module_env.InitializeMemory();
   for (int offset = 0; offset < 128; offset += 7) {
     byte code[] = {WASM_STORE_MEM_OFFSET(MachineType::Int32(), offset,
                                          WASM_ZERO, WASM_ZERO)};
     EXPECT_VERIFIES_C(v_i, code);
   }
 }
 
 TEST_F(FunctionBodyDecoderTest, StoreMemOffset_void) {
+  TestModuleEnv module_env;
+  module = &module_env;
+  module_env.InitializeMemory();
   EXPECT_FAILURE(i_i, WASM_STORE_MEM_OFFSET(MachineType::Int32(), 0, WASM_ZERO,
                                             WASM_ZERO));
 }
 
 #define BYTE0(x) ((x)&0x7F)
 #define BYTE1(x) ((x >> 7) & 0x7F)
 #define BYTE2(x) ((x >> 14) & 0x7F)
 #define BYTE3(x) ((x >> 21) & 0x7F)
 
 #define VARINT1(x) BYTE0(x)
 #define VARINT2(x) BYTE0(x) | 0x80, BYTE1(x)
 #define VARINT3(x) BYTE0(x) | 0x80, BYTE1(x) | 0x80, BYTE2(x)
 #define VARINT4(x) BYTE0(x) | 0x80, BYTE1(x) | 0x80, BYTE2(x) | 0x80, BYTE3(x)
 
 TEST_F(FunctionBodyDecoderTest, LoadMemOffset_varint) {
+  TestModuleEnv module_env;
+  module = &module_env;
+  module_env.InitializeMemory();
   EXPECT_VERIFIES(i_i, WASM_ZERO, kExprI32LoadMem, ZERO_ALIGNMENT,
                   VARINT1(0x45));
   EXPECT_VERIFIES(i_i, WASM_ZERO, kExprI32LoadMem, ZERO_ALIGNMENT,
                   VARINT2(0x3999));
   EXPECT_VERIFIES(i_i, WASM_ZERO, kExprI32LoadMem, ZERO_ALIGNMENT,
                   VARINT3(0x344445));
   EXPECT_VERIFIES(i_i, WASM_ZERO, kExprI32LoadMem, ZERO_ALIGNMENT,
                   VARINT4(0x36666667));
 }
 
 TEST_F(FunctionBodyDecoderTest, StoreMemOffset_varint) {
+  TestModuleEnv module_env;
+  module = &module_env;
+  module_env.InitializeMemory();
   EXPECT_VERIFIES(v_i, WASM_ZERO, WASM_ZERO, kExprI32StoreMem, ZERO_ALIGNMENT,
                   VARINT1(0x33));
   EXPECT_VERIFIES(v_i, WASM_ZERO, WASM_ZERO, kExprI32StoreMem, ZERO_ALIGNMENT,
                   VARINT2(0x1111));
   EXPECT_VERIFIES(v_i, WASM_ZERO, WASM_ZERO, kExprI32StoreMem, ZERO_ALIGNMENT,
                   VARINT3(0x222222));
   EXPECT_VERIFIES(v_i, WASM_ZERO, WASM_ZERO, kExprI32StoreMem, ZERO_ALIGNMENT,
                   VARINT4(0x44444444));
 }
 
 TEST_F(FunctionBodyDecoderTest, AllLoadMemCombinations) {
+  TestModuleEnv module_env;
+  module = &module_env;
+  module_env.InitializeMemory();
   for (size_t i = 0; i < arraysize(kValueTypes); i++) {
     ValueType local_type = kValueTypes[i];
     for (size_t j = 0; j < arraysize(machineTypes); j++) {
       MachineType mem_type = machineTypes[j];
       byte code[] = {WASM_LOAD_MEM(mem_type, WASM_ZERO)};
       FunctionSig sig(1, 0, &local_type);
       if (local_type == WasmOpcodes::ValueTypeFor(mem_type)) {
         EXPECT_VERIFIES_SC(&sig, code);
       } else {
         EXPECT_FAILURE_SC(&sig, code);
       }
     }
   }
 }
 
 TEST_F(FunctionBodyDecoderTest, AllStoreMemCombinations) {
+  TestModuleEnv module_env;
+  module = &module_env;
+  module_env.InitializeMemory();
   for (size_t i = 0; i < arraysize(kValueTypes); i++) {
     ValueType local_type = kValueTypes[i];
     for (size_t j = 0; j < arraysize(machineTypes); j++) {
       MachineType mem_type = machineTypes[j];
       byte code[] = {WASM_STORE_MEM(mem_type, WASM_ZERO, WASM_GET_LOCAL(0))};
       FunctionSig sig(0, 1, &local_type);
       if (local_type == WasmOpcodes::ValueTypeFor(mem_type)) {
         EXPECT_VERIFIES_SC(&sig, code);
       } else {
         EXPECT_FAILURE_SC(&sig, code);
       }
     }
   }
 }
 
-namespace {
-// A helper for tests that require a module environment for functions and
-// globals.
-class TestModuleEnv : public ModuleEnv {
- public:
-  explicit TestModuleEnv(ModuleOrigin origin = kWasmOrigin)
-      : ModuleEnv(&mod, nullptr) {
-    mod.origin = origin;
-  }
-  byte AddGlobal(ValueType type, bool mutability = true) {
-    mod.globals.push_back({type, mutability, WasmInitExpr(), 0, false, false});
-    CHECK(mod.globals.size() <= 127);
-    return static_cast<byte>(mod.globals.size() - 1);
-  }
-  byte AddSignature(FunctionSig* sig) {
-    mod.signatures.push_back(sig);
-    CHECK(mod.signatures.size() <= 127);
-    return static_cast<byte>(mod.signatures.size() - 1);
-  }
-  byte AddFunction(FunctionSig* sig) {
-    mod.functions.push_back({sig,      // sig
-                             0,        // func_index
-                             0,        // sig_index
-                             0,        // name_offset
-                             0,        // name_length
-                             0,        // code_start_offset
-                             0,        // code_end_offset
-                             false,    // import
-                             false});  // export
-    CHECK(mod.functions.size() <= 127);
-    return static_cast<byte>(mod.functions.size() - 1);
-  }
-  byte AddImport(FunctionSig* sig) {
-    byte result = AddFunction(sig);
-    mod.functions[result].imported = true;
-    return result;
-  }
-
-  void InitializeFunctionTable() {
-    mod.function_tables.push_back(
-        {0, 0, true, std::vector<int32_t>(), false, false, SignatureMap()});
-  }
-
- private:
-  WasmModule mod;
-};
-}  // namespace
-
 TEST_F(FunctionBodyDecoderTest, SimpleCalls) {
   FunctionSig* sig = sigs.i_i();
   TestModuleEnv module_env;
   module = &module_env;
 
   module_env.AddFunction(sigs.i_v());
   module_env.AddFunction(sigs.i_i());
   module_env.AddFunction(sigs.i_ii());
 
   EXPECT_VERIFIES_S(sig, WASM_CALL_FUNCTION0(0));
@@ skipping 314 matching lines @@
       } else {
         EXPECT_FAILURE_S(&sig, WASM_SET_GLOBAL(0, WASM_GET_LOCAL(0)));
       }
     }
   }
 }
 
 TEST_F(FunctionBodyDecoderTest, WasmGrowMemory) {
   TestModuleEnv module_env;
   module = &module_env;
+  module_env.InitializeMemory();
 
   byte code[] = {WASM_GET_LOCAL(0), kExprGrowMemory, 0};
   EXPECT_VERIFIES_C(i_i, code);
   EXPECT_FAILURE_C(i_d, code);
 }
 
 TEST_F(FunctionBodyDecoderTest, AsmJsGrowMemory) {
   TestModuleEnv module_env(kAsmJsOrigin);
   module = &module_env;
+  module_env.InitializeMemory();
 
   byte code[] = {WASM_GET_LOCAL(0), kExprGrowMemory, 0};
   EXPECT_FAILURE_C(i_i, code);
 }
 
 TEST_F(FunctionBodyDecoderTest, AsmJsBinOpsCheckOrigin) {
   ValueType float32int32float32[] = {kWasmF32, kWasmI32, kWasmF32};
   FunctionSig sig_f_if(1, 2, float32int32float32);
   ValueType float64int32float64[] = {kWasmF64, kWasmI32, kWasmF64};
   FunctionSig sig_d_id(1, 2, float64int32float64);
@@ skipping 11 matching lines @@
       {kExprI32AsmjsStoreMem8, sigs.i_ii()},
       {kExprI32AsmjsStoreMem16, sigs.i_ii()},
       {kExprI32AsmjsStoreMem, sigs.i_ii()},
       {kExprF32AsmjsStoreMem, &sig_f_if},
       {kExprF64AsmjsStoreMem, &sig_d_id},
   };
 
   {
     TestModuleEnv module_env(kAsmJsOrigin);
     module = &module_env;
+    module_env.InitializeMemory();
     for (size_t i = 0; i < arraysize(AsmJsBinOps); i++) {
       TestBinop(AsmJsBinOps[i].op, AsmJsBinOps[i].sig);
     }
   }
 
   {
     TestModuleEnv module_env;
     module = &module_env;
+    module_env.InitializeMemory();
     for (size_t i = 0; i < arraysize(AsmJsBinOps); i++) {
       byte code[] = {
           WASM_BINOP(AsmJsBinOps[i].op, WASM_GET_LOCAL(0), WASM_GET_LOCAL(1))};
       EXPECT_FAILURE_SC(AsmJsBinOps[i].sig, code);
     }
   }
 }
 
 TEST_F(FunctionBodyDecoderTest, AsmJsUnOpsCheckOrigin) {
   ValueType float32int32[] = {kWasmF32, kWasmI32};
@@ skipping 18 matching lines @@
                     {kExprI32AsmjsLoadMem, sigs.i_i()},
                     {kExprF32AsmjsLoadMem, &sig_f_i},
                     {kExprF64AsmjsLoadMem, &sig_d_i},
                     {kExprI32AsmjsSConvertF32, sigs.i_f()},
                     {kExprI32AsmjsUConvertF32, sigs.i_f()},
                     {kExprI32AsmjsSConvertF64, sigs.i_d()},
                     {kExprI32AsmjsUConvertF64, sigs.i_d()}};
   {
     TestModuleEnv module_env(kAsmJsOrigin);
     module = &module_env;
+    module_env.InitializeMemory();
     for (size_t i = 0; i < arraysize(AsmJsUnOps); i++) {
       TestUnop(AsmJsUnOps[i].op, AsmJsUnOps[i].sig);
     }
   }
 
   {
     TestModuleEnv module_env;
     module = &module_env;
+    module_env.InitializeMemory();
     for (size_t i = 0; i < arraysize(AsmJsUnOps); i++) {
       byte code[] = {WASM_UNOP(AsmJsUnOps[i].op, WASM_GET_LOCAL(0))};
       EXPECT_FAILURE_SC(AsmJsUnOps[i].sig, code);
     }
   }
 }
 
 TEST_F(FunctionBodyDecoderTest, BreakEnd) {
   EXPECT_VERIFIES(
       i_i, WASM_BLOCK_I(WASM_I32_ADD(WASM_BRV(0, WASM_ZERO), WASM_ZERO)));
@@ skipping 951 matching lines @@
   iter.next();
   EXPECT_TRUE(iter.has_next());
   EXPECT_EQ(kExprI32Const, iter.current());
   iter.next();
   EXPECT_FALSE(iter.has_next());
 }
 
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8