[wasm] Allow full u32 range for table maximum in WebAssembly.Table constructor.

R=clemensh@chromium.org
BUG=chromium:740199

Review-Url: https://codereview.chromium.org/2977543002
Cr-Commit-Position: refs/heads/master@{#46508}

src/wasm/module-compiler.cc

@@ -1340,7 +1340,7 @@ int InstanceBuilder::ProcessImports(Handle<FixedArray> code_table,
 
         if (table.has_max) {
           int64_t imported_max_size =
-              table_instance.table_object->maximum_length();
+              table_instance.table_object->maximum_length()->Number();
           if (imported_max_size < 0) {
             thrower_->LinkError(
                 "table import %d has no maximum length, expected %d", index,

src/wasm/wasm-js.cc

@@ -472,7 +472,7 @@ void WebAssemblyInstantiate(const v8::FunctionCallbackInfo<v8::Value>& args) {
 
 bool GetIntegerProperty(v8::Isolate* isolate, ErrorThrower* thrower,
                         Local<Context> context, Local<v8::Object> object,
-                        Local<String> property, int* result,
+                        Local<String> property, int64_t* result,
                         int64_t lower_bound, uint64_t upper_bound) {
   v8::MaybeLocal<v8::Value> maybe = object->Get(context, property);
   v8::Local<v8::Value> value;
@@ -525,14 +525,14 @@ void WebAssemblyTable(const v8::FunctionCallbackInfo<v8::Value>& args) {
     }
   }
   // The descriptor's 'initial'.
-  int initial = 0;
+  int64_t initial = 0;
   if (!GetIntegerProperty(isolate, &thrower, context, descriptor,
                           v8_str(isolate, "initial"), &initial, 0,
                           i::FLAG_wasm_max_table_size)) {
     return;
   }
   // The descriptor's 'maximum'.
-  int maximum = -1;
+  int64_t maximum = -1;
   Local<String> maximum_key = v8_str(isolate, "maximum");
   Maybe<bool> has_maximum = descriptor->Has(context, maximum_key);
 
@@ -545,8 +545,8 @@ void WebAssemblyTable(const v8::FunctionCallbackInfo<v8::Value>& args) {
   }
 
   i::Handle<i::FixedArray> fixed_array;
-  i::Handle<i::JSObject> table_obj =
-      i::WasmTableObject::New(i_isolate, initial, maximum, &fixed_array);
+  i::Handle<i::JSObject> table_obj = i::WasmTableObject::New(
+      i_isolate, static_cast<uint32_t>(initial), maximum, &fixed_array);
   v8::ReturnValue<v8::Value> return_value = args.GetReturnValue();
   return_value.Set(Utils::ToLocal(table_obj));
 }
@@ -563,14 +563,14 @@ void WebAssemblyMemory(const v8::FunctionCallbackInfo<v8::Value>& args) {
   Local<Context> context = isolate->GetCurrentContext();
   Local<v8::Object> descriptor = args[0]->ToObject(context).ToLocalChecked();
   // The descriptor's 'initial'.
-  int initial = 0;
+  int64_t initial = 0;
   if (!GetIntegerProperty(isolate, &thrower, context, descriptor,
                           v8_str(isolate, "initial"), &initial, 0,
                           i::FLAG_wasm_max_mem_pages)) {
     return;
   }
   // The descriptor's 'maximum'.
-  int maximum = -1;
+  int64_t maximum = -1;
   Local<String> maximum_key = v8_str(isolate, "maximum");
   Maybe<bool> has_maximum = descriptor->Has(context, maximum_key);
 
@@ -589,8 +589,8 @@ void WebAssemblyMemory(const v8::FunctionCallbackInfo<v8::Value>& args) {
     thrower.RangeError("could not allocate memory");
     return;
   }
-  i::Handle<i::JSObject> memory_obj =
-      i::WasmMemoryObject::New(i_isolate, buffer, maximum);
+  i::Handle<i::JSObject> memory_obj = i::WasmMemoryObject::New(
+      i_isolate, buffer, static_cast<int32_t>(maximum));
   args.GetReturnValue().Set(Utils::ToLocal(memory_obj));
 }
 
@@ -638,9 +638,8 @@ void WebAssemblyTableGrow(const v8::FunctionCallbackInfo<v8::Value>& args) {
   }
   new_size64 += old_size;
 
-  int64_t max_size64 = receiver->maximum_length();
-  if (max_size64 < 0 ||
-      max_size64 > static_cast<int64_t>(i::FLAG_wasm_max_table_size)) {
+  int64_t max_size64 = receiver->maximum_length()->Number();
+  if (max_size64 < 0 || max_size64 > i::FLAG_wasm_max_table_size) {
     max_size64 = i::FLAG_wasm_max_table_size;
   }
 

src/wasm/wasm-objects.cc

@@ -184,7 +184,8 @@ Handle<WasmTableObject> WasmTableObject::New(Isolate* isolate, uint32_t initial,
   }
   table_obj->set_functions(**js_functions);
   DCHECK_EQ(maximum, static_cast<int>(maximum));
-  table_obj->set_maximum_length(static_cast<int>(maximum));
+  Handle<Object> max = isolate->factory()->NewNumber(maximum);
+  table_obj->set_maximum_length(*max);
 
   Handle<FixedArray> dispatch_tables = isolate->factory()->NewFixedArray(0);
   table_obj->set_dispatch_tables(*dispatch_tables);

src/wasm/wasm-objects.h

@@ -77,7 +77,8 @@ class WasmTableObject : public JSObject {
   DECL_CAST(WasmTableObject)
 
   DECL_ACCESSORS(functions, FixedArray)
-  DECL_INT_ACCESSORS(maximum_length)
+  // TODO(titzer): introduce DECL_I64_ACCESSORS macro
+  DECL_ACCESSORS(maximum_length, Object)
   DECL_ACCESSORS(dispatch_tables, FixedArray)
 
   enum {  // --
@@ -93,7 +94,7 @@ class WasmTableObject : public JSObject {
   DEF_OFFSET(DispatchTables)
 
   inline uint32_t current_length() { return functions()->length(); }
-  inline bool has_maximum_length() { return maximum_length() >= 0; }
+  inline bool has_maximum_length() { return maximum_length()->Number() >= 0; }
   void grow(Isolate* isolate, uint32_t count);
 
   static Handle<WasmTableObject> New(Isolate* isolate, uint32_t initial,
@@ -680,7 +681,7 @@ ACCESSORS(WasmModuleObject, compiled_module, WasmCompiledModule,
 
 // WasmTableObject
 ACCESSORS(WasmTableObject, functions, FixedArray, kFunctionsOffset)
-SMI_ACCESSORS(WasmTableObject, maximum_length, kMaximumLengthOffset)
+ACCESSORS(WasmTableObject, maximum_length, Object, kMaximumLengthOffset)
 ACCESSORS(WasmTableObject, dispatch_tables, FixedArray, kDispatchTablesOffset)
 
 // WasmMemoryObject

test/mjsunit/wasm/table.js

@@ -14,13 +14,15 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 var outOfUint32RangeValue = 1e12;
 var int32ButOob = 1073741824;
 var kMaxUint32 = (4 * 1024 * 1024 * 1024) - 1;
+var kMaxUint31 = (2 * 1024 * 1024 * 1024) - 1;
 var kV8MaxWasmTableSize = 10000000;
 
-function assertTableIsValid(table) {
+function assertTableIsValid(table, length) {
   assertSame(WebAssembly.Table.prototype, table.__proto__);
   assertSame(WebAssembly.Table, table.constructor);
   assertTrue(table instanceof Object);
   assertTrue(table instanceof WebAssembly.Table);
+  assertEquals(length, table.length);
 }
 
 (function TestConstructor() {
@@ -57,56 +59,48 @@ function assertTableIsValid(table) {
 
   let table;
   table = new WebAssembly.Table({element: "anyfunc", initial: 1});
-  assertTableIsValid(table);
-  assertEquals(1, table.length);
+  assertTableIsValid(table, 1);
   assertEquals(null, table.get(0));
   assertEquals(undefined, table[0]);
 
   table = new WebAssembly.Table({element: "anyfunc", initial: "2"});
-  assertTableIsValid(table);
-  assertEquals(2, table.length);
+  assertTableIsValid(table, 2);
   assertEquals(null, table.get(0));
   assertEquals(null, table.get(1));
   assertEquals(undefined, table[0]);
   assertEquals(undefined, table[1]);
 
   table = new WebAssembly.Table({element: "anyfunc", initial: {valueOf() { return "1" }}});
-  assertTableIsValid(table);
-  assertEquals(1, table.length);
+  assertTableIsValid(table, 1);
   assertEquals(null, table.get(0));
   assertEquals(undefined, table[0]);
 
   table = new WebAssembly.Table({element: "anyfunc", initial: undefined});
-  assertTableIsValid(table);
-  assertEquals(0, table.length);
+  assertTableIsValid(table, 0);
 
   table = new WebAssembly.Table({element: "anyfunc"});
-  assertTableIsValid(table);
-  assertEquals(0, table.length);
+  assertTableIsValid(table, 0);
 
   table = new WebAssembly.Table({element: "anyfunc", maximum: 10});
-  assertTableIsValid(table);
-  assertEquals(0, table.length);
+  assertTableIsValid(table, 0);
 
   table = new WebAssembly.Table({element: "anyfunc", maximum: "10"});
-  assertTableIsValid(table);
-  assertEquals(0, table.length);
+  assertTableIsValid(table, 0);
 
   table = new WebAssembly.Table({element: "anyfunc", maximum: {valueOf() { return "10" }}});
-  assertTableIsValid(table);
-  assertEquals(0, table.length);
+  assertTableIsValid(table, 0);
 
   table = new WebAssembly.Table({element: "anyfunc", initial: 0, maximum: undefined});
-  assertTableIsValid(table);
-  assertEquals(0, table.length);
+  assertTableIsValid(table, 0);
+
+  table = new WebAssembly.Table({element: "anyfunc", maximum: kMaxUint31});
+  assertTableIsValid(table, 0);
 
   table = new WebAssembly.Table({element: "anyfunc", maximum: kMaxUint32});
-  assertTableIsValid(table);
-  assertEquals(0, table.length);
+  assertTableIsValid(table, 0);
 
   table = new WebAssembly.Table({element: "anyfunc", maximum: kV8MaxWasmTableSize + 1});
-  assertTableIsValid(table);
-  assertEquals(0, table.length);
+  assertTableIsValid(table, 0);
 })();
 
 (function TestMaximumIsReadOnce() {
@@ -123,7 +117,7 @@ function assertTableIsValid(table) {
     }
   }});
   let table = new WebAssembly.Table(desc);
-  assertTableIsValid(table);
+  assertTableIsValid(table, 10);
 })();
 
 (function TestMaximumDoesHasProperty() {
@@ -134,7 +128,7 @@ function assertTableIsValid(table) {
   });
   Object.setPrototypeOf(desc, proxy);
   let table = new WebAssembly.Table(desc);
-  assertTableIsValid(table);
+  assertTableIsValid(table, 10);
 })();
 
 (function TestLength() {