[wasm] Add more unit tests for trap handler

The unittests test if the trap handler only handles those traps it
is supposed to handle:
* Only handle traps when the thread-in-wasm flag is set.
* Only handle traps of the right type, i.e. memory access violations.
* Only handle traps at recorded instructions.

The tests also test the consistency of the thread-in-wasm flag. I made
one change in the trap handler where that consistency could be
violated.

All tests are executed with the default trap handler provided by V8,
and with the trap handler callback installed in a test signal/exception
handler.

Change-Id: I03904bb6effd2e8694d3f4d1fbf62bc38002646e
Reviewed-on: https://chromium-review.googlesource.com/c/1340246
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57858}

src/trap-handler/handler-inside-posix.cc

@@ -72,6 +72,17 @@ class SigUnmaskStack {
 };
 
 bool TryHandleSignal(int signum, siginfo_t* info, void* context) {
+  // Ensure the faulting thread was actually running Wasm code. This should be
+  // the first check in the trap handler to guarantee that the IsThreadInWasm
+  // flag is only set in wasm code. Otherwise a later signal handler is executed
+  // with the flag set.
+  if (!IsThreadInWasm()) {
+    return false;
+  }
+
+  // Clear g_thread_in_wasm_code, primarily to protect against nested faults.
+  g_thread_in_wasm_code = false;
+
   // Bail out early in case we got called for the wrong kind of signal.
 
   if (signum != kOobSignal) {
@@ -83,14 +94,6 @@ bool TryHandleSignal(int signum, siginfo_t* info, void* context) {
     return false;
   }
 
-  // Ensure the faulting thread was actually running Wasm code.
-  if (!IsThreadInWasm()) {
-    return false;
-  }
-
-  // Clear g_thread_in_wasm_code, primarily to protect against nested faults.
-  g_thread_in_wasm_code = false;
-
   // Begin signal mask scope. We need to be sure to restore the signal mask
   // before we restore the g_thread_in_wasm_code flag.
   {

src/wasm/wasm-memory.cc

@@ -154,6 +154,20 @@ WasmMemoryTracker::~WasmMemoryTracker() {
   DCHECK_EQ(allocated_address_space_, 0u);
 }
 
+void* WasmMemoryTracker::TryAllocateBackingStoreForTesting(
+    Heap* heap, size_t size, void** allocation_base,
+    size_t* allocation_length) {
+  return TryAllocateBackingStore(this, heap, size, allocation_base,
+                                 allocation_length);
+}
+
+void WasmMemoryTracker::FreeBackingStoreForTesting(base::AddressRegion memory,
+                                                   void* buffer_start) {
+  ReleaseAllocation(nullptr, buffer_start);
+  CHECK(FreePages(GetPlatformPageAllocator(),
+                  reinterpret_cast<void*>(memory.begin()), memory.size()));
+}
+
 bool WasmMemoryTracker::ReserveAddressSpace(size_t num_bytes,
                                             ReservationLimit limit) {
   size_t reservation_limit =

src/wasm/wasm-memory.h

@@ -66,6 +66,18 @@ class WasmMemoryTracker {
     friend WasmMemoryTracker;
   };
 
+  // Allow tests to allocate a backing store the same way as we do it for
+  // WebAssembly memory. This is used in unit tests for trap handler to
+  // generate the same signals/exceptions for invalid memory accesses as
+  // we would get with WebAssembly memory.
+  void* TryAllocateBackingStoreForTesting(Heap* heap, size_t size,
+                                          void** allocation_base,
+                                          size_t* allocation_length);
+
+  // Free memory allocated with TryAllocateBackingStoreForTesting.
+  void FreeBackingStoreForTesting(base::AddressRegion memory,
+                                  void* buffer_start);
+
   // Decreases the amount of reserved address space.
   void ReleaseReservation(size_t num_bytes);
 

test/cctest/test-assembler-arm64.cc

@@ -209,8 +209,7 @@ static void InitializeVM() {
   __ Ret();                     \
   __ GetCode(masm.isolate(), nullptr);
 
-#define TEARDOWN() \
-  CHECK(v8::internal::FreePages(GetPlatformPageAllocator(), buf, allocated));
+#define TEARDOWN() FreeAssemblerBuffer(buf, allocated);
 
 #endif  // ifdef USE_SIMULATOR.
 

test/common/assembler-tester.h

@@ -23,6 +23,10 @@ static inline uint8_t* AllocateAssemblerBuffer(
   return static_cast<uint8_t*>(result);
 }
 
+static inline void FreeAssemblerBuffer(uint8_t* buffer, size_t size) {
+  CHECK(FreePages(GetPlatformPageAllocator(), buffer, size));
+}
+
 static inline void MakeAssemblerBufferExecutable(uint8_t* buffer,
                                                  size_t allocated) {
   // Flush the instruction cache as part of making the buffer executable.

test/unittests/BUILD.gn

@@ -254,6 +254,7 @@ v8_source_set("unittests_sources") {
     sources += [
       "assembler/turbo-assembler-x64-unittest.cc",
       "compiler/x64/instruction-selector-x64-unittest.cc",
+      "wasm/trap-handler-x64-unittest.cc",
     ]
   } else if (v8_current_cpu == "ppc" || v8_current_cpu == "ppc64") {
     sources += [