[wasm] Block compile/instantiate of large array buffers

third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp

Index: third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp b/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
index a0c4d830b0038274700ce939d2a12684a327e4e6..088ffae13740f8ca77a9b39a8c641e8d302b7763 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
@@ -142,6 +142,9 @@ MessageLevel MessageLevelFromNonFatalErrorLevel(int errorLevel) {
   }
   return level;
 }
+
+const size_t kWasmWireBytesLimit = 1 << 12;
+
 }  // namespace
 
 void V8Initializer::messageHandlerInMainThread(v8::Local<v8::Message> message,
@@ -319,6 +322,36 @@ static bool codeGenerationCheckCallbackInMainThread(
   return false;
 }
 
+static bool allowWasmCompileCallbackInMainThread(v8::Local<v8::Value> source,
+                                                 bool asPromise) {
+  if (asPromise)

[bradnelson, 2017/02/18 22:16:22]

Maybe comment that we allow any size for promise i.e. async cases?

[Mircea Trofin, 2017/02/19 00:18:33]

Done.

+    return true;
+  if (source->IsArrayBuffer() &&
+      v8::Local<v8::ArrayBuffer>::Cast(source)->ByteLength() >
+          kWasmWireBytesLimit) {
+    return false;
+  }
+  if (source->IsArrayBufferView() &&
+      v8::Local<v8::ArrayBufferView>::Cast(source)->ByteLength() >
+          kWasmWireBytesLimit) {
+    return false;
+  }
+  return true;
+}
+
+static bool allowWasmInstantiateCallbackInMainThread(
+    v8::Local<v8::WasmCompiledModule> source,
+    v8::Local<v8::Value> ffi,
+    bool asPromise) {
+  if (asPromise)
+    return true;
+  if (static_cast<size_t>(source->GetWasmWireBytes()->Length()) >
+      kWasmWireBytesLimit) {
+    return false;
+  }
+  return true;
+}
+
 static void initializeV8Common(v8::Isolate* isolate) {
   isolate->AddGCPrologueCallback(V8GCController::gcPrologue);
   isolate->AddGCEpilogueCallback(V8GCController::gcEpilogue);
@@ -414,7 +447,9 @@ void V8Initializer::initializeMainThread() {
       failedAccessCheckCallbackInMainThread);
   isolate->SetAllowCodeGenerationFromStringsCallback(
       codeGenerationCheckCallbackInMainThread);
-
+  isolate->SetAllowWasmCompileCallback(allowWasmCompileCallbackInMainThread);
+  isolate->SetAllowWasmInstantiateCallback(
+      allowWasmInstantiateCallbackInMainThread);
   if (RuntimeEnabledFeatures::v8IdleTasksEnabled()) {
     V8PerIsolateData::enableIdleTasks(
         isolate, WTF::makeUnique<V8IdleTaskRunner>(scheduler));