[interpreter/test] Fix boundary conditions on memory/table growth (#2290)

Author: rossberg

interpreter/exec/eval.ml

@@ -1173,6 +1173,7 @@ let eval_const (inst : moduleinst) (const : const) : value =
   | [v] -> v
   | vs -> Crash.error const.at "wrong number of results on stack"
 
+
 (* Modules *)
 
 let init_type (inst : moduleinst) (type_ : type_) : moduleinst =

interpreter/runtime/memory.ml

@@ -26,16 +26,17 @@ let valid_limits {min; max} =
 
 let valid_size at i =
   match at with
-  | I32AT -> I64.le_u i 0xffffL
-  | I64AT -> true
+  | I32AT -> I64.le_u i 0x1_0000L
+  | I64AT -> I64.le_u i 0x1_0000_0000_0000L
 
 let create n =
+  if n > Int64.(div max_int page_size) then raise OutOfMemory else
+  let size = Int64.(mul n page_size) in
   try
-    let size = Int64.(mul n page_size) in
     let mem = Array1_64.create Int8_unsigned C_layout size in
     Array1.fill mem 0;
     mem
-  with Out_of_memory -> raise OutOfMemory
+  with Out_of_memory | Invalid_argument _ -> raise OutOfMemory
 
 let alloc (MemoryT (at, lim) as ty) =
   assert Free.((memorytype ty).types = Set.empty);

interpreter/runtime/table.ml

@@ -24,6 +24,7 @@ let valid_size at i =
   | I64AT -> true
 
 let create size r =
+  if size < 0L then raise OutOfMemory else
   try Lib.Array64.make size r
   with Out_of_memory | Invalid_argument _ -> raise OutOfMemory
 

spectec/src/backend-interpreter/interpreter.ml

@@ -370,7 +370,7 @@ and eval_expr env expr =
   (* Optimized getter for list init *)
   | IterE (e1, (ListN (e2, None), [])) ->
     let v = eval_expr env e1 in
-    let i = eval_expr env e2 |> al_to_nat in
+    let i = try eval_expr env e2 |> al_to_nat with Z.Overflow -> raise Exception.OutOfMemory in
     if i > 1024 * 64 * 1024 (* 1024 pages *) then
       raise Exception.OutOfMemory
     else

test/core/memory64/memory_grow64.wast

@@ -93,3 +93,18 @@
 (assert_return (invoke "check-memory-zero" (i64.const 0x40000) (i64.const 0x4_ffff)) (i32.const 0))
 (assert_return (invoke "grow" (i64.const 1)) (i64.const 5))
 (assert_return (invoke "check-memory-zero" (i64.const 0x50000) (i64.const 0x5_ffff)) (i32.const 0))
+
+
+(module
+  (memory i64 1)
+  (func (export "grow") (param i64) (result i64) (memory.grow (local.get 0)))
+  (func (export "size") (result i64) (memory.size))
+)
+(assert_return (invoke "grow" (i64.const 0x1_0000_0000_0000)) (i64.const -1))
+(assert_return (invoke "size") (i64.const 1))
+(assert_return (invoke "grow" (i64.const 0xFFFF_FFFF_FFFF))
+  (either (i64.const -1) (i64.const 1))
+)
+(assert_return (invoke "size")
+  (either (i64.const 1) (i64.const 0x1_0000_0000_0000))
+)

test/core/memory64/table_grow64.wast

@@ -32,3 +32,20 @@
 (assert_return (invoke "get-t64" (i64.const 4)) (ref.extern 4))
 (assert_trap (invoke "set-t64" (i64.const 5) (ref.extern 2)) "out of bounds table access")
 (assert_trap (invoke "get-t64" (i64.const 5)) "out of bounds table access")
+
+
+(module
+  (table i64 1 funcref)
+  (func (export "grow") (param i64) (result i64)
+    (table.grow (ref.null func) (local.get 0))
+  )
+  (func (export "size") (result i64) (table.size))
+)
+(assert_return (invoke "grow" (i64.const 0xFFFF_FFFF_FFFF_FFFF)) (i64.const -1))
+(assert_return (invoke "size") (i64.const 1))
+(assert_return (invoke "grow" (i64.const 0xFFFF_FFFF_FFFF_FFFE))
+  (either (i64.const -1) (i64.const 1))
+)
+(assert_return (invoke "size")
+  (either (i64.const 1) (i64.const 0xFFFF_FFFF_FFFF_FFFF))
+)

test/core/memory_grow.wast

@@ -424,3 +424,19 @@
   )
   "type mismatch"
 )
+
+
+(module
+  (memory 1)
+  (func (export "grow") (param i32) (result i32) (memory.grow (local.get 0)))
+  (func (export "size") (result i32) (memory.size))
+)
+(assert_return (invoke "grow" (i32.const 0x1_0000)) (i32.const -1))
+(assert_return (invoke "size") (i32.const 1))
+;; This may be too slow on some implementations
+;; (assert_return (invoke "grow" (i32.const 0xFFFF))
+;;   (either (i32.const -1) (i32.const 1))
+;; )
+;; (assert_return (invoke "size")
+;;   (either (i32.const 1) (i32.const 0x1_0000))
+;; )

test/core/table_grow.wast

@@ -196,3 +196,21 @@
   )
   "type mismatch"
 )
+
+
+(module
+  (table 1 funcref)
+  (func (export "grow") (param i32) (result i32)
+    (table.grow (ref.null func) (local.get 0))
+  )
+  (func (export "size") (result i32) (table.size))
+)
+(assert_return (invoke "grow" (i32.const 0xFFFF_FFFF)) (i32.const -1))
+(assert_return (invoke "size") (i32.const 1))
+;; This may be too slow on some implementations
+;; (assert_return (invoke "grow" (i32.const 0xFFFF_FFFE))
+;;   (either (i32.const -1) (i32.const 1))
+;; )
+;; (assert_return (invoke "size")
+;;   (either (i32.const 1) (i32.const 0xFFFF_FFFF))
+;; )