diff --git a/src/builtins/typed-array-createtypedarray.tq b/src/builtins/typed-array-createtypedarray.tq index 519d98867b..45a396afe6 100644 --- a/src/builtins/typed-array-createtypedarray.tq +++ b/src/builtins/typed-array-createtypedarray.tq @@ -292,7 +292,7 @@ transitioning macro ConstructByArrayBuffer(implicit context: Context)( // in the step 12 branch. newByteLength = bufferByteLength - offset; newLength = elementsInfo.CalculateLength(newByteLength) - otherwise IfInvalidOffset; + otherwise IfInvalidLength; // 12. Else, } else { diff --git a/src/objects/js-array-buffer.cc b/src/objects/js-array-buffer.cc index 07b37dd7f5..fd9f3133a5 100644 --- a/src/objects/js-array-buffer.cc +++ b/src/objects/js-array-buffer.cc @@ -82,6 +82,7 @@ void JSArrayBuffer::Attach(std::shared_ptr backing_store) { // invariant that their byte_length field is always 0. set_byte_length(0); } else { + CHECK_LE(backing_store->byte_length(), kMaxByteLength); set_byte_length(backing_store->byte_length()); } set_max_byte_length(backing_store->max_byte_length()); diff --git a/src/wasm/wasm-engine.cc b/src/wasm/wasm-engine.cc index e26c906f41..769bb9c781 100644 --- a/src/wasm/wasm-engine.cc +++ b/src/wasm/wasm-engine.cc @@ -1645,6 +1645,9 @@ WasmCodeManager* GetWasmCodeManager() { // {max_mem_pages} is declared in wasm-limits.h. uint32_t max_mem_pages() { + static_assert( + kV8MaxWasmMemoryPages * kWasmPageSize <= JSArrayBuffer::kMaxByteLength, + "Wasm memories must not be bigger than JSArrayBuffers"); STATIC_ASSERT(kV8MaxWasmMemoryPages <= kMaxUInt32); return std::min(uint32_t{kV8MaxWasmMemoryPages}, FLAG_wasm_max_mem_pages); } diff --git a/src/wasm/wasm-limits.h b/src/wasm/wasm-limits.h index fcafb69395..fa7784e724 100644 --- a/src/wasm/wasm-limits.h +++ b/src/wasm/wasm-limits.h @@ -40,7 +40,7 @@ constexpr size_t kV8MaxWasmDataSegments = 100000; // Also, do not use this limit to validate declared memory, use // kSpecMaxMemoryPages for that. constexpr size_t kV8MaxWasmMemoryPages = kSystemPointerSize == 4 - ? 32768 // = 2 GiB + ? 32767 // = 2 GiB : 65536; // = 4 GiB constexpr size_t kV8MaxWasmStringSize = 100000; constexpr size_t kV8MaxWasmModuleSize = 1024 * 1024 * 1024; // = 1 GiB