// Copyright 2015 the V8 project authors. All rights reserved.

// Use of this source code is governed by a BSD-style license that can be

// found in the LICENSE file.

#if V8_TARGET_OS_LINUX

#include <sys/mman.h>

#include <sys/stat.h>

// `sys/mman.h defines `MAP_TYPE`, but `MAP_TYPE` also gets defined within V8.

// Since we don't need `sys/mman.h`'s `MAP_TYPE`, we undefine it immediately

// after the `#include`.

#undef MAP_TYPE

#endif // V8_TARGET_OS_LINUX

#include "src/wasm/wasm-objects.h"

#include <optional>

#include "src/base/iterator.h"

#include "src/base/vector.h"

#include "src/builtins/builtins-inl.h"

#include "src/compiler/wasm-compiler.h"

#include "src/debug/debug.h"

#include "src/logging/counters.h"

#include "src/objects/managed-inl.h"

#include "src/objects/objects-inl.h"

#include "src/objects/oddball.h"

#include "src/objects/shared-function-info.h"

#include "src/roots/roots-inl.h"

#include "src/utils/utils.h"

#include "src/wasm/canonical-types.h"

#include "src/wasm/code-space-access.h"

#include "src/wasm/module-compiler.h"

#include "src/wasm/module-decoder.h"

#include "src/wasm/module-instantiate.h"

#include "src/wasm/stacks.h"

#include "src/wasm/value-type.h"

#include "src/wasm/wasm-code-manager.h"

#include "src/wasm/wasm-code-pointer-table-inl.h"

#include "src/wasm/wasm-engine.h"

#include "src/wasm/wasm-limits.h"

#include "src/wasm/wasm-module.h"

#include "src/wasm/wasm-objects-inl.h"

#include "src/wasm/wasm-subtyping.h"

#include "src/wasm/wasm-value.h"

#if V8_ENABLE_DRUMBRAKE

#include "src/wasm/interpreter/wasm-interpreter-inl.h"

#include "src/wasm/interpreter/wasm-interpreter-runtime.h"

#endif // V8_ENABLE_DRUMBRAKE

// Needs to be last so macros do not get undefined.

#include "src/objects/object-macros.h"

#define TRACE_IFT(...) \

do { \

if (false) PrintF(__VA_ARGS__); \

} while (false)

namespace v8 {

namespace internal {

namespace {

// Utilities for handling "uses" lists. We reserve one slot for the

// used length, then store pairs of (instance, table_index).

static constexpr int kReservedSlotOffset = 1;

void SetUsedLength(Tagged<ProtectedWeakFixedArray> uses, int length) {

// {set} includes a DCHECK for sufficient capacity.

uses->set(0, Smi::FromInt(length));

}

int GetUsedLength(Tagged<ProtectedWeakFixedArray> uses) {

if (uses->length() == 0) return 0;

return Cast<Smi>(uses->get(0)).value();

}

void SetEntry(Tagged<ProtectedWeakFixedArray> uses, int slot_index,

Tagged<WasmTrustedInstanceData> user, int table_index) {

DCHECK(slot_index & 1);

uses->set(slot_index, MakeWeak(user));

uses->set(slot_index + 1, Smi::FromInt(table_index));

}

// These are two separate functions because GCMole produces bogus warnings

// when we return a std::pair<A, B> and call it as `auto [a, b] = ...`.

Tagged<WasmTrustedInstanceData> GetInstance(

Tagged<ProtectedWeakFixedArray> uses, int slot_index) {

DCHECK(slot_index & 1);

return Cast<WasmTrustedInstanceData>(

uses->get(slot_index).GetHeapObjectAssumeWeak());

}

int GetTableIndex(Tagged<ProtectedWeakFixedArray> uses, int slot_index) {

DCHECK(slot_index & 1);

return Cast<Smi>(uses->get(slot_index + 1)).value();

}

void CopyEntry(Tagged<ProtectedWeakFixedArray> dst, int dst_index,

Tagged<ProtectedWeakFixedArray> src, int src_index) {

DCHECK(dst_index & 1);

DCHECK(src_index & 1);

// There shouldn't be a reason to copy cleared entries.

DCHECK(

IsWasmTrustedInstanceData(src->get(src_index).GetHeapObjectAssumeWeak()));

DCHECK(IsSmi(src->get(src_index + 1)));

dst->set(dst_index, src->get(src_index));

dst->set(dst_index + 1, src->get(src_index + 1));

}

} // namespace

// Import a few often used types from the wasm namespace.

using WasmFunction = wasm::WasmFunction;

using WasmModule = wasm::WasmModule;

// static

DirectHandle<WasmModuleObject> WasmModuleObject::New(

Isolate* isolate, std::shared_ptr<wasm::NativeModule> native_module,

DirectHandle<Script> script) {

DirectHandle<Managed<wasm::NativeModule>> managed_native_module;

if (script->type() == Script::Type::kWasm) {

managed_native_module = direct_handle(

Cast<Managed<wasm::NativeModule>>(script->wasm_managed_native_module()),

isolate);

} else {

const WasmModule* module = native_module->module();

size_t memory_estimate =

native_module->committed_code_space() +

wasm::WasmCodeManager::EstimateNativeModuleMetaDataSize(module);

managed_native_module = Managed<wasm::NativeModule>::From(

isolate, memory_estimate, std::move(native_module));

}

DirectHandle<WasmModuleObject> module_object = Cast<WasmModuleObject>(

isolate->factory()->NewJSObject(isolate->wasm_module_constructor()));

module_object->set_managed_native_module(*managed_native_module);

module_object->set_script(*script);

return module_object;

}

DirectHandle<String> WasmModuleObject::ExtractUtf8StringFromModuleBytes(

Isolate* isolate, DirectHandle<WasmModuleObject> module_object,

wasm::WireBytesRef ref, InternalizeString internalize) {

base::Vector<const uint8_t> wire_bytes =

module_object->native_module()->wire_bytes();

return ExtractUtf8StringFromModuleBytes(isolate, wire_bytes, ref,

internalize);

}

DirectHandle<String> WasmModuleObject::ExtractUtf8StringFromModuleBytes(

Isolate* isolate, base::Vector<const uint8_t> wire_bytes,

wasm::WireBytesRef ref, InternalizeString internalize) {

base::Vector<const uint8_t> name_vec =

wire_bytes.SubVector(ref.offset(), ref.end_offset());

// UTF8 validation happens at decode time.

DCHECK(unibrow::Utf8::ValidateEncoding(name_vec.begin(), name_vec.length()));

auto* factory = isolate->factory();

return internalize

? factory->InternalizeUtf8String(

base::Vector<const char>::cast(name_vec))

: factory

->NewStringFromUtf8(base::Vector<const char>::cast(name_vec))

.ToHandleChecked();

}

MaybeDirectHandle<String> WasmModuleObject::GetModuleNameOrNull(

Isolate* isolate, DirectHandle<WasmModuleObject> module_object) {

const WasmModule* module = module_object->module();

if (!module->name.is_set()) return {};

return ExtractUtf8StringFromModuleBytes(isolate, module_object, module->name,

kNoInternalize);

}

MaybeDirectHandle<String> WasmModuleObject::GetFunctionNameOrNull(

Isolate* isolate, DirectHandle<WasmModuleObject> module_object,

uint32_t func_index) {

DCHECK_LT(func_index, module_object->module()->functions.size());

wasm::WireBytesRef name =

module_object->module()->lazily_generated_names.LookupFunctionName(

wasm::ModuleWireBytes(module_object->native_module()->wire_bytes()),

func_index);

if (!name.is_set()) return {};

return ExtractUtf8StringFromModuleBytes(isolate, module_object, name,

kNoInternalize);

}

base::Vector<const uint8_t> WasmModuleObject::GetRawFunctionName(

int func_index) {

if (func_index == wasm::kAnonymousFuncIndex) {

return base::Vector<const uint8_t>({nullptr, 0});

}

DCHECK_GT(module()->functions.size(), func_index);

wasm::ModuleWireBytes wire_bytes(native_module()->wire_bytes());

wasm::WireBytesRef name_ref =

module()->lazily_generated_names.LookupFunctionName(wire_bytes,

func_index);

wasm::WasmName name = wire_bytes.GetNameOrNull(name_ref);

return base::Vector<const uint8_t>::cast(name);

}

DirectHandle<WasmTableObject> WasmTableObject::New(

Isolate* isolate, DirectHandle<WasmTrustedInstanceData> trusted_data,

wasm::ValueType type, wasm::CanonicalValueType canonical_type,

uint32_t initial, bool has_maximum, uint64_t maximum,

DirectHandle<Object> initial_value, wasm::AddressType address_type,

DirectHandle<WasmDispatchTable>* out_dispatch_table) {

CHECK(type.is_object_reference());

DCHECK_LE(initial, wasm::max_table_size());

DirectHandle<FixedArray> entries = isolate->factory()->NewFixedArray(initial);

for (int i = 0; i < static_cast<int>(initial); ++i) {

entries->set(i, *initial_value);

}

bool is_function_table = canonical_type.IsFunctionType();

const bool shared = false;

DirectHandle<WasmDispatchTable> dispatch_table =

is_function_table ? isolate->factory()->NewWasmDispatchTable(

initial, canonical_type, shared)

: DirectHandle<WasmDispatchTable>{};

DirectHandle<UnionOf<Undefined, Number, BigInt>> max =

isolate->factory()->undefined_value();

if (has_maximum) {

if (address_type == wasm::AddressType::kI32) {

DCHECK_GE(kMaxUInt32, maximum);

max = isolate->factory()->NewNumber(maximum);

} else {

max = BigInt::FromUint64(isolate, maximum);

}

}

DirectHandle<JSFunction> table_ctor(

isolate->native_context()->wasm_table_constructor(), isolate);

auto table_obj =

Cast<WasmTableObject>(isolate->factory()->NewJSObject(table_ctor));

DisallowGarbageCollection no_gc;

if (!trusted_data.is_null()) {

table_obj->set_trusted_data(*trusted_data);

} else {

table_obj->clear_trusted_data();

}

table_obj->set_entries(*entries);

table_obj->set_current_length(initial);

table_obj->set_maximum_length(*max);

table_obj->set_raw_type(static_cast<int>(type.raw_bit_field()));

table_obj->set_address_type(address_type);

table_obj->set_padding_for_address_type_0(0);

table_obj->set_padding_for_address_type_1(0);

#if TAGGED_SIZE_8_BYTES

table_obj->set_padding_for_address_type_2(0);

#endif

if (is_function_table) {

DCHECK_EQ(table_obj->current_length(), dispatch_table->length());

table_obj->set_trusted_dispatch_table(*dispatch_table);

if (out_dispatch_table) *out_dispatch_table = dispatch_table;

} else {

table_obj->clear_trusted_dispatch_table();

}

return table_obj;

}

int WasmTableObject::Grow(Isolate* isolate, DirectHandle<WasmTableObject> table,

uint32_t count, DirectHandle<Object> init_value) {

uint32_t old_size = table->current_length();

if (count == 0) return old_size; // Degenerate case: nothing to do.

// Check if growing by {count} is valid.

static_assert(wasm::kV8MaxWasmTableSize <= kMaxUInt32);

uint64_t static_max_size = wasm::max_table_size();

uint32_t max_size = static_cast<uint32_t>(std::min(

static_max_size, table->maximum_length_u64().value_or(static_max_size)));

DCHECK_LE(old_size, max_size);

if (count > max_size - old_size) return -1;

uint32_t new_size = old_size + count;

// Even with 2x over-allocation, there should not be an integer overflow.

static_assert(wasm::kV8MaxWasmTableSize <= kMaxInt / 2);

DCHECK_GE(kMaxInt, new_size);

int old_capacity = table->entries()->length();

if (new_size > static_cast<uint32_t>(old_capacity)) {

int grow = static_cast<int>(new_size) - old_capacity;

// Grow at least by the old capacity, to implement exponential growing.

grow = std::max(grow, old_capacity);

// Never grow larger than the max size.

grow = std::min(grow, static_cast<int>(max_size - old_capacity));

auto new_store = isolate->factory()->CopyFixedArrayAndGrow(

direct_handle(table->entries(), isolate), grow);

table->set_entries(*new_store, WriteBarrierMode::UPDATE_WRITE_BARRIER);

}

if (table->has_trusted_dispatch_table()) {

DirectHandle<WasmDispatchTable> dispatch_table(

table->trusted_dispatch_table(isolate), isolate);

DCHECK_EQ(old_size, dispatch_table->length());

DirectHandle<WasmDispatchTable> new_dispatch_table =

WasmDispatchTable::Grow(isolate, dispatch_table, new_size);

if (!dispatch_table.is_identical_to(new_dispatch_table)) {

table->set_trusted_dispatch_table(*new_dispatch_table);

}

DCHECK_EQ(new_size, table->trusted_dispatch_table(isolate)->length());

#if V8_ENABLE_DRUMBRAKE

if (v8_flags.wasm_jitless) {

Tagged<ProtectedWeakFixedArray> uses = dispatch_table->protected_uses();

int used_length = GetUsedLength(uses);

for (int i = kReservedSlotOffset; i < used_length; i += 2) {

if (uses->get(i).IsCleared()) continue;

Tagged<WasmTrustedInstanceData> instance = GetInstance(uses, i);

if (instance->has_interpreter_object()) {

int table_index = GetTableIndex(uses, i);

wasm::WasmInterpreterRuntime::UpdateIndirectCallTable(

isolate, direct_handle(instance->instance_object(), isolate),

table_index);

}

}

}

#endif // V8_ENABLE_DRUMBRAKE

}

// Only update the current length after all allocations of sub-objects

// (in particular: the new dispatch table) are done, so that heap verification

// can assert that the dispatch table's length matches the table's length.

table->set_current_length(new_size);

for (uint32_t entry = old_size; entry < new_size; ++entry) {

WasmTableObject::Set(isolate, table, entry, init_value);

}

return old_size;

}

MaybeDirectHandle<Object> WasmTableObject::JSToWasmElement(

Isolate* isolate, DirectHandle<WasmTableObject> table,

DirectHandle<Object> entry, const char** error_message) {

const WasmModule* module = !table->has_trusted_data()

? nullptr

: table->trusted_data(isolate)->module();

return wasm::JSToWasmObject(isolate, module, entry, table->type(module),

error_message);

}

void WasmTableObject::SetFunctionTableEntry(Isolate* isolate,

DirectHandle<WasmTableObject> table,

int entry_index,

DirectHandle<Object> entry) {

if (IsWasmNull(*entry, isolate)) {

table->ClearDispatchTable(entry_index); // Degenerate case.

table->entries()->set(entry_index, ReadOnlyRoots(isolate).wasm_null());

return;

}

DCHECK(IsWasmFuncRef(*entry));

DirectHandle<Object> external = WasmInternalFunction::GetOrCreateExternal(

direct_handle(Cast<WasmFuncRef>(*entry)->internal(isolate), isolate));

if (WasmExportedFunction::IsWasmExportedFunction(*external)) {

auto exported_function = Cast<WasmExportedFunction>(external);

auto func_data = exported_function->shared()->wasm_exported_function_data();

DirectHandle<WasmTrustedInstanceData> target_instance_data(

func_data->instance_data(), isolate);

int func_index = func_data->function_index();

const WasmModule* module = target_instance_data->module();

SBXCHECK_BOUNDS(func_index, module->functions.size());

auto* wasm_function = module->functions.data() + func_index;

UpdateDispatchTable(isolate, table, entry_index, wasm_function,

target_instance_data

#if V8_ENABLE_DRUMBRAKE

,

func_index

#endif // V8_ENABLE_DRUMBRAKE

);

} else if (WasmJSFunction::IsWasmJSFunction(*external)) {

UpdateDispatchTable(isolate, table, entry_index,

Cast<WasmJSFunction>(external));

} else {

DCHECK(WasmCapiFunction::IsWasmCapiFunction(*external));

UpdateDispatchTable(isolate, table, entry_index,

Cast<WasmCapiFunction>(external));

}

table->entries()->set(entry_index, *entry);

}

// Note: This needs to be handlified because it can call {NewWasmImportData}.

void WasmTableObject::Set(Isolate* isolate, DirectHandle<WasmTableObject> table,

uint32_t index, DirectHandle<Object> entry) {

// Callers need to perform bounds checks, type check, and error handling.

DCHECK(table->is_in_bounds(index));

DirectHandle<FixedArray> entries(table->entries(), isolate);

// The FixedArray is addressed with int's.

int entry_index = static_cast<int>(index);

wasm::ValueType unsafe_type = table->unsafe_type();

if (unsafe_type.has_index()) {

DCHECK(table->has_trusted_data());

const wasm::WasmModule* module = table->trusted_data(isolate)->module();

if (module->has_signature(table->type(module).ref_index())) {

SetFunctionTableEntry(isolate, table, entry_index, entry);

return;

}

entries->set(entry_index, *entry);

return;

}

switch (unsafe_type.generic_kind()) {

case wasm::GenericKind::kExtern:

case wasm::GenericKind::kString:

case wasm::GenericKind::kStringViewWtf8:

case wasm::GenericKind::kStringViewWtf16:

case wasm::GenericKind::kStringViewIter:

case wasm::GenericKind::kEq:

case wasm::GenericKind::kStruct:

case wasm::GenericKind::kArray:

case wasm::GenericKind::kAny:

case wasm::GenericKind::kI31:

case wasm::GenericKind::kNone:

case wasm::GenericKind::kNoFunc:

case wasm::GenericKind::kNoExtern:

case wasm::GenericKind::kExn:

case wasm::GenericKind::kNoExn:

case wasm::GenericKind::kCont:

case wasm::GenericKind::kNoCont:

entries->set(entry_index, *entry);

return;

case wasm::GenericKind::kFunc:

SetFunctionTableEntry(isolate, table, entry_index, entry);

return;

case wasm::GenericKind::kBottom:

case wasm::GenericKind::kTop:

case wasm::GenericKind::kVoid:

case wasm::GenericKind::kExternString:

break;

}

UNREACHABLE();

}

DirectHandle<Object> WasmTableObject::Get(Isolate* isolate,

DirectHandle<WasmTableObject> table,

uint32_t index) {

DirectHandle<FixedArray> entries(table->entries(), isolate);

// Callers need to perform bounds checks and error handling.

DCHECK(table->is_in_bounds(index));

// The FixedArray is addressed with int's.

int entry_index = static_cast<int>(index);

DirectHandle<Object> entry(entries->get(entry_index), isolate);

if (IsWasmNull(*entry, isolate)) return entry;

if (IsWasmFuncRef(*entry)) return entry;

wasm::ValueType unsafe_type = table->unsafe_type();

if (unsafe_type.has_index()) {

DCHECK(table->has_trusted_data());

const WasmModule* module = table->trusted_data(isolate)->module();

wasm::ModuleTypeIndex element_type = table->type(module).ref_index();

if (module->has_array(element_type) || module->has_struct(element_type)) {

return entry;

}

DCHECK(module->has_signature(element_type));

// Fall through.

} else {

switch (unsafe_type.generic_kind()) {

case wasm::GenericKind::kStringViewWtf8:

case wasm::GenericKind::kStringViewWtf16:

case wasm::GenericKind::kStringViewIter:

case wasm::GenericKind::kExtern:

case wasm::GenericKind::kString:

case wasm::GenericKind::kEq:

case wasm::GenericKind::kI31:

case wasm::GenericKind::kStruct:

case wasm::GenericKind::kArray:

case wasm::GenericKind::kAny:

case wasm::GenericKind::kNone:

case wasm::GenericKind::kNoFunc:

case wasm::GenericKind::kNoExtern:

case wasm::GenericKind::kExn:

case wasm::GenericKind::kNoExn:

case wasm::GenericKind::kCont:

case wasm::GenericKind::kNoCont:

return entry;

case wasm::GenericKind::kFunc:

// Placeholder; handled below.

break;

case wasm::GenericKind::kBottom:

case wasm::GenericKind::kTop:

case wasm::GenericKind::kVoid:

case wasm::GenericKind::kExternString:

UNREACHABLE();

}

}

// {entry} is not a valid entry in the table. It has to be a placeholder

// for lazy initialization.

DirectHandle<Tuple2> tuple = Cast<Tuple2>(entry);

auto trusted_instance_data = direct_handle(

Cast<WasmInstanceObject>(tuple->value1())->trusted_data(isolate),

isolate);

int function_index = Cast<Smi>(tuple->value2()).value();

// Create a WasmInternalFunction and WasmFuncRef for the function if it does

// not exist yet, and store it in the table.

DirectHandle<WasmFuncRef> func_ref =

WasmTrustedInstanceData::GetOrCreateFuncRef(

isolate, trusted_instance_data, function_index);

entries->set(entry_index, *func_ref);

return func_ref;

}

void WasmTableObject::Fill(Isolate* isolate,

DirectHandle<WasmTableObject> table, uint32_t start,

DirectHandle<Object> entry, uint32_t count) {

// Bounds checks must be done by the caller.

DCHECK_LE(start, table->current_length());

DCHECK_LE(count, table->current_length());

DCHECK_LE(start + count, table->current_length());

for (uint32_t i = 0; i < count; i++) {

WasmTableObject::Set(isolate, table, start + i, entry);

}

}

#if V8_ENABLE_SANDBOX || DEBUG

bool FunctionSigMatchesTable(wasm::CanonicalTypeIndex sig_id,

wasm::CanonicalValueType table_type) {

DCHECK(table_type.is_object_reference());

// When in-sandbox data is corrupted, we can't trust the statically

// checked types; to prevent sandbox escapes, we have to verify actual

// types before installing the dispatch table entry. There are three

// alternative success conditions:

// (1) Generic "funcref" tables can hold any function entry.

if (!table_type.has_index() &&

table_type.generic_kind() == wasm::GenericKind::kFunc) {

return true;

}

// (2) Most function types are expected to be final, so they can be compared

// cheaply by canonicalized index equality.

wasm::CanonicalTypeIndex canonical_table_type = table_type.ref_index();

if (V8_LIKELY(sig_id == canonical_table_type)) return true;

// (3) In the remaining cases, perform the full subtype check.

return wasm::GetWasmEngine()->type_canonicalizer()->IsCanonicalSubtype(

sig_id, canonical_table_type);

}

#endif // V8_ENABLE_SANDBOX || DEBUG

// static

void WasmTableObject::UpdateDispatchTable(

Isolate* isolate, DirectHandle<WasmTableObject> table, int entry_index,

const wasm::WasmFunction* func,

DirectHandle<WasmTrustedInstanceData> target_instance_data

#if V8_ENABLE_DRUMBRAKE

,

int target_func_index

#endif // V8_ENABLE_DRUMBRAKE

) {

DirectHandle<TrustedObject> implicit_arg =

func->imported

// The function in the target instance was imported. Use its imports

// table to look up the ref.

? direct_handle(Cast<TrustedObject>(

target_instance_data->dispatch_table_for_imports()

->implicit_arg(func->func_index)),

isolate)

// For wasm functions, just pass the target instance data.

: target_instance_data;

WasmCodePointer call_target =

target_instance_data->GetCallTarget(func->func_index);

#if V8_ENABLE_DRUMBRAKE

if (target_func_index <

static_cast<int>(

target_instance_data->module()->num_imported_functions)) {

target_func_index = target_instance_data->imported_function_indices()->get(

target_func_index);

}

#endif // V8_ENABLE_DRUMBRAKE

const WasmModule* target_module = target_instance_data->module();

wasm::CanonicalTypeIndex sig_id =

target_module->canonical_sig_id(func->sig_index);

DirectHandle<WasmDispatchTable> dispatch_table(

table->trusted_dispatch_table(isolate), isolate);

SBXCHECK(FunctionSigMatchesTable(sig_id, dispatch_table->table_type()));

if (v8_flags.wasm_generic_wrapper && IsWasmImportData(*implicit_arg)) {

auto import_data = Cast<WasmImportData>(implicit_arg);

constexpr bool kShared = false;

DirectHandle<WasmImportData> new_import_data =

isolate->factory()->NewWasmImportData(import_data, kShared);

new_import_data->set_call_origin(*dispatch_table);

new_import_data->set_table_slot(entry_index);

implicit_arg = new_import_data;

}

if (target_instance_data->dispatch_table_for_imports()->IsAWrapper(

func->func_index)) {

wasm::WasmCodeRefScope code_ref_scope;

uint64_t signature_hash = wasm::GetTypeCanonicalizer()

->LookupFunctionSignature(sig_id)

->signature_hash();

dispatch_table->SetForWrapper(

entry_index, Cast<WasmImportData>(*implicit_arg),

wasm::GetProcessWideWasmCodePointerTable()->GetEntrypoint(

call_target, signature_hash),

sig_id, signature_hash,

#if V8_ENABLE_DRUMBRAKE

target_func_index,

#endif

wasm::GetWasmImportWrapperCache()->FindWrapper(call_target),

WasmDispatchTable::kExistingEntry);

} else {

dispatch_table->SetForNonWrapper(

entry_index, Cast<WasmTrustedInstanceData>(*implicit_arg), call_target,

sig_id,

#if V8_ENABLE_DRUMBRAKE

target_func_index,

#endif

WasmDispatchTable::kExistingEntry);

}

#if V8_ENABLE_DRUMBRAKE

if (v8_flags.wasm_jitless) {

Tagged<ProtectedWeakFixedArray> uses = dispatch_table->protected_uses();

int used_length = GetUsedLength(uses);

for (int i = kReservedSlotOffset; i < used_length; i += 2) {

if (uses->get(i).IsCleared()) continue;

Tagged<WasmTrustedInstanceData> instance = GetInstance(uses, i);

if (instance->has_interpreter_object()) {

int table_index = GetTableIndex(uses, i);

wasm::WasmInterpreterRuntime::UpdateIndirectCallTable(

isolate, direct_handle(instance->instance_object(), isolate),

table_index);

}

}

}

#endif // V8_ENABLE_DRUMBRAKE

}

// static

void WasmTableObject::UpdateDispatchTable(

Isolate* isolate, DirectHandle<WasmTableObject> table, int entry_index,

DirectHandle<WasmJSFunction> function) {

Tagged<WasmJSFunctionData> function_data =

function->shared()->wasm_js_function_data();

wasm::CanonicalTypeIndex sig_id = function_data->sig_index();

wasm::WasmCodeRefScope code_ref_scope;

DirectHandle<WasmDispatchTable> dispatch_table(

table->trusted_dispatch_table(isolate), isolate);

SBXCHECK(FunctionSigMatchesTable(sig_id, dispatch_table->table_type()));

DirectHandle<WasmImportData> import_data(

Cast<WasmImportData>(function_data->internal()->implicit_arg()), isolate);

WasmCodePointer code_pointer = function_data->internal()->call_target();

wasm::WasmImportWrapperCache* cache = wasm::GetWasmImportWrapperCache();

wasm::WasmCode* wasm_code = cache->FindWrapper(code_pointer);

Address call_target = wasm::GetProcessWideWasmCodePointerTable()

->GetEntrypointWithoutSignatureCheck(code_pointer);

uint64_t signature_hash;

if (wasm_code) {

DCHECK_EQ(wasm_code->instruction_start(), call_target);

signature_hash = wasm_code->signature_hash();

} else {

// The function's code_pointer is not a compiled wrapper.

// Opportunistically check if a matching wrapper has already been

// compiled, but otherwise don't eagerly compile it now.

const wasm::CanonicalSig* sig =

wasm::GetWasmEngine()->type_canonicalizer()->LookupFunctionSignature(

sig_id);

signature_hash = sig->signature_hash();

wasm::ResolvedWasmImport resolved({}, -1, function, sig, sig_id,

wasm::WellKnownImport::kUninstantiated);

wasm::ImportCallKind kind = resolved.kind();

DirectHandle<JSReceiver> callable = resolved.callable();

DCHECK_NE(wasm::ImportCallKind::kLinkError, kind);

int expected_arity = static_cast<int>(sig->parameter_count());

if (kind == wasm::ImportCallKind::kJSFunctionArityMismatch) {

expected_arity = Cast<JSFunction>(callable)

->shared()

->internal_formal_parameter_count_without_receiver();

}

wasm::Suspend suspend = function_data->GetSuspend();

wasm_code = cache->MaybeGet(kind, sig_id, expected_arity, suspend);

if (wasm_code) {

call_target = wasm_code->instruction_start();

DCHECK_EQ(sig->signature_hash(), wasm_code->signature_hash());

} else {

// We still don't have a compiled wrapper. Allocate a new import_data

// so we can store the proper call_origin for later wrapper tier-up.

DCHECK(call_target ==

Builtins::EntryOf(Builtin::kWasmToJsWrapperAsm, isolate) ||

call_target == Builtins::EntryOf(

Builtin::kWasmToJsWrapperInvalidSig, isolate));

constexpr bool kShared = false;

import_data = isolate->factory()->NewWasmImportData(

callable, suspend, MaybeDirectHandle<WasmTrustedInstanceData>{}, sig,

kShared);

import_data->SetIndexInTableAsCallOrigin(*dispatch_table, entry_index);

}

}

DCHECK(wasm_code ||

call_target ==

Builtins::EntryOf(Builtin::kWasmToJsWrapperAsm, isolate) ||

call_target ==

Builtins::EntryOf(Builtin::kWasmToJsWrapperInvalidSig, isolate));

dispatch_table->SetForWrapper(entry_index, *import_data, call_target, sig_id,

signature_hash,

#if V8_ENABLE_DRUMBRAKE

WasmDispatchTable::kInvalidFunctionIndex,

#endif // V8_ENABLE_DRUMBRAKE

wasm_code, WasmDispatchTable::kExistingEntry);

}

// static

void WasmTableObject::UpdateDispatchTable(

Isolate* isolate, DirectHandle<WasmTableObject> table, int entry_index,

DirectHandle<WasmCapiFunction> capi_function) {

DirectHandle<WasmCapiFunctionData> func_data(

capi_function->shared()->wasm_capi_function_data(), isolate);

const wasm::CanonicalSig* sig = func_data->sig();

DCHECK(wasm::GetTypeCanonicalizer()->Contains(sig));

wasm::CanonicalTypeIndex sig_index = func_data->sig_index();

wasm::WasmCodeRefScope code_ref_scope;

wasm::WasmImportWrapperCache* cache = wasm::GetWasmImportWrapperCache();

auto kind = wasm::ImportCallKind::kWasmToCapi;

int param_count = static_cast<int>(sig->parameter_count());

wasm::WasmCode* wasm_code =

cache->MaybeGet(kind, sig_index, param_count, wasm::kNoSuspend);

if (wasm_code == nullptr) {

wasm::WasmCompilationResult result =

compiler::CompileWasmCapiCallWrapper(sig);

{

wasm::WasmImportWrapperCache::ModificationScope cache_scope(cache);

wasm::WasmImportWrapperCache::CacheKey key(kind, sig_index, param_count,

wasm::kNoSuspend);

wasm_code = cache_scope.AddWrapper(

key, std::move(result), wasm::WasmCode::Kind::kWasmToCapiWrapper,

sig->signature_hash());

}

// To avoid lock order inversion, code printing must happen after the

// end of the {cache_scope}.

wasm_code->MaybePrint();

isolate->counters()->wasm_generated_code_size()->Increment(

wasm_code->instructions().length());

isolate->counters()->wasm_reloc_size()->Increment(

wasm_code->reloc_info().length());

}

Tagged<WasmImportData> implicit_arg =

Cast<WasmImportData>(func_data->internal()->implicit_arg());

Address call_target = wasm_code->instruction_start();

Tagged<WasmDispatchTable> dispatch_table =

table->trusted_dispatch_table(isolate);

SBXCHECK(FunctionSigMatchesTable(sig_index, dispatch_table->table_type()));

dispatch_table->SetForWrapper(entry_index, implicit_arg, call_target,

sig_index, wasm_code->signature_hash(),

#if V8_ENABLE_DRUMBRAKE

WasmDispatchTable::kInvalidFunctionIndex,

#endif // V8_ENABLE_DRUMBRAKE

wasm_code, WasmDispatchTable::kExistingEntry);

}

void WasmTableObject::ClearDispatchTable(int index) {

DisallowGarbageCollection no_gc;

Isolate* isolate = Isolate::Current();

Tagged<WasmDispatchTable> dispatch_table = trusted_dispatch_table(isolate);

dispatch_table->Clear(index, WasmDispatchTable::kExistingEntry);

#if V8_ENABLE_DRUMBRAKE

if (v8_flags.wasm_jitless) {

Tagged<ProtectedWeakFixedArray> uses = dispatch_table->protected_uses();

int used_length = GetUsedLength(uses);

for (int i = kReservedSlotOffset; i < used_length; i += 2) {

if (uses->get(i).IsCleared()) continue;

Tagged<WasmTrustedInstanceData> non_shared_instance_data =

GetInstance(uses, i);

if (non_shared_instance_data->has_interpreter_object()) {

int table_index = GetTableIndex(uses, i);

DirectHandle<WasmInstanceObject> instance_handle(

non_shared_instance_data->instance_object(), isolate);

wasm::WasmInterpreterRuntime::ClearIndirectCallCacheEntry(

isolate, instance_handle, table_index, index);

}

}

}

#endif // V8_ENABLE_DRUMBRAKE

}

// static

void WasmTableObject::SetFunctionTablePlaceholder(

Isolate* isolate, DirectHandle<WasmTableObject> table, int entry_index,

DirectHandle<WasmTrustedInstanceData> trusted_instance_data,

int func_index) {

// Put (instance, func_index) as a Tuple2 into the entry_index.

// The {WasmExportedFunction} will be created lazily.

// Allocate directly in old space as the tuples are typically long-lived, and

// we create many of them, which would result in lots of GC when initializing

// large tables.

// TODO(42204563): Avoid crashing if the instance object is not available.

CHECK(trusted_instance_data->has_instance_object());

DirectHandle<Tuple2> tuple = isolate->factory()->NewTuple2(

direct_handle(trusted_instance_data->instance_object(), isolate),

direct_handle(Smi::FromInt(func_index), isolate), AllocationType::kOld);

table->entries()->set(entry_index, *tuple);

}

// static

void WasmTableObject::GetFunctionTableEntry(

Isolate* isolate, DirectHandle<WasmTableObject> table, int entry_index,

bool* is_valid, bool* is_null,

MaybeDirectHandle<WasmTrustedInstanceData>* instance_data,

int* function_index, MaybeDirectHandle<WasmJSFunction>* maybe_js_function) {

#if DEBUG

if (table->has_trusted_data()) {

const wasm::WasmModule* module = table->trusted_data(isolate)->module();

DCHECK(wasm::IsSubtypeOf(table->type(module), wasm::kWasmFuncRef, module));

} else {

// A function table defined outside a module may only have type exactly

// {funcref}.

DCHECK(table->unsafe_type() == wasm::kWasmFuncRef);

}

DCHECK_LT(entry_index, table->current_length());

#endif

// We initialize {is_valid} with {true}. We may change it later.

*is_valid = true;

DirectHandle<Object> element(table->entries()->get(entry_index), isolate);

*is_null = IsWasmNull(*element, isolate);

if (*is_null) return;

if (IsWasmFuncRef(*element)) {

DirectHandle<WasmInternalFunction> internal{

Cast<WasmFuncRef>(*element)->internal(isolate), isolate};

element = WasmInternalFunction::GetOrCreateExternal(internal);

}

if (WasmExportedFunction::IsWasmExportedFunction(*element)) {

auto target_func = Cast<WasmExportedFunction>(element);

auto func_data = Cast<WasmExportedFunctionData>(

target_func->shared()->wasm_exported_function_data());

*instance_data = direct_handle(func_data->instance_data(), isolate);

*function_index = func_data->function_index();

*maybe_js_function = MaybeDirectHandle<WasmJSFunction>();

return;

}

if (WasmJSFunction::IsWasmJSFunction(*element)) {

*instance_data = MaybeDirectHandle<WasmTrustedInstanceData>();

*maybe_js_function = Cast<WasmJSFunction>(element);

return;

}

if (IsTuple2(*element)) {

auto tuple = Cast<Tuple2>(element);

*instance_data = direct_handle(

Cast<WasmInstanceObject>(tuple->value1())->trusted_data(isolate),

isolate);

*function_index = Cast<Smi>(tuple->value2()).value();

*maybe_js_function = MaybeDirectHandle<WasmJSFunction>();

return;

}

*is_valid = false;

}

DirectHandle<WasmSuspendingObject> WasmSuspendingObject::New(

Isolate* isolate, DirectHandle<JSReceiver> callable) {

DirectHandle<JSFunction> suspending_ctor(

isolate->native_context()->wasm_suspending_constructor(), isolate);

auto suspending_obj = Cast<WasmSuspendingObject>(

isolate->factory()->NewJSObject(suspending_ctor));

suspending_obj->set_callable(*callable);

return suspending_obj;

}

namespace {

void SetInstanceMemory(Tagged<WasmTrustedInstanceData> trusted_instance_data,

Tagged<JSArrayBuffer> buffer, int memory_index) {

DisallowHeapAllocation no_gc;

const WasmModule* module = trusted_instance_data->module();

const wasm::WasmMemory& memory = module->memories[memory_index];

bool is_wasm_module = module->origin == wasm::kWasmOrigin;

bool use_trap_handler = memory.bounds_checks == wasm::kTrapHandler;

// Asm.js does not use trap handling.

CHECK_IMPLIES(use_trap_handler, is_wasm_module);

// ArrayBuffers allocated for Wasm do always have a BackingStore.

std::shared_ptr<BackingStore> backing_store = buffer->GetBackingStore();

CHECK_IMPLIES(is_wasm_module, backing_store);

CHECK_IMPLIES(is_wasm_module, backing_store->is_wasm_memory());

// Wasm modules compiled to use the trap handler don't have bounds checks,

// so they must have a memory that has guard regions.

// Note: This CHECK can fail when in-sandbox corruption modified a

// WasmMemoryObject. We currently believe that this would at worst

// corrupt the contents of other Wasm memories or ArrayBuffers, but having

// this CHECK in release mode is nice as an additional layer of defense.

CHECK_IMPLIES(use_trap_handler, backing_store->has_guard_regions());

// We checked this before, but a malicious worker thread with an in-sandbox

// corruption primitive could have modified it since then.

size_t byte_length = buffer->GetByteLength();

SBXCHECK_GE(byte_length, memory.min_memory_size);

trusted_instance_data->SetRawMemory(

memory_index, reinterpret_cast<uint8_t*>(buffer->backing_store()),

byte_length);

#if V8_ENABLE_DRUMBRAKE

if (v8_flags.wasm_jitless &&

trusted_instance_data->has_interpreter_object()) {

AllowHeapAllocation allow_heap;

Isolate* isolate = Isolate::Current();

HandleScope scope(isolate);

wasm::WasmInterpreterRuntime::UpdateMemoryAddress(

direct_handle(trusted_instance_data->instance_object(), isolate));

}

#endif // V8_ENABLE_DRUMBRAKE

}

} // namespace

DirectHandle<WasmMemoryObject> WasmMemoryObject::New(

Isolate* isolate, DirectHandle<JSArrayBuffer> buffer, int maximum,

wasm::AddressType address_type) {

DirectHandle<JSFunction> memory_ctor(

isolate->native_context()->wasm_memory_constructor(), isolate);

auto memory_object = Cast<WasmMemoryObject>(

isolate->factory()->NewJSObject(memory_ctor, AllocationType::kOld));

memory_object->set_array_buffer(*buffer);

memory_object->set_maximum_pages(maximum);

memory_object->set_address_type(address_type);

memory_object->set_padding_for_address_type_0(0);

memory_object->set_padding_for_address_type_1(0);

#if TAGGED_SIZE_8_BYTES

memory_object->set_padding_for_address_type_2(0);

#endif

memory_object->set_instances(ReadOnlyRoots{isolate}.empty_weak_array_list());

if (buffer->is_resizable_by_js()) {

memory_object->FixUpResizableArrayBuffer(*buffer);

}

std::shared_ptr<BackingStore> backing_store = buffer->GetBackingStore();

if (buffer->is_shared()) {

// Only Wasm memory can be shared (in contrast to asm.js memory).

CHECK(backing_store && backing_store->is_wasm_memory());

backing_store->AttachSharedWasmMemoryObject(isolate, memory_object);

} else if (backing_store) {

CHECK(!backing_store->is_shared());

}

// Memorize a link from the JSArrayBuffer to its owning WasmMemoryObject

// instance.

DirectHandle<Symbol> symbol =

isolate->factory()->array_buffer_wasm_memory_symbol();

Object::SetProperty(isolate, buffer, symbol, memory_object).Check();

return memory_object;

}

MaybeDirectHandle<WasmMemoryObject> WasmMemoryObject::New(

Isolate* isolate, int initial, int maximum, SharedFlag shared,

wasm::AddressType address_type) {

bool has_maximum = maximum != kNoMaximum;

int engine_maximum = address_type == wasm::AddressType::kI64

? static_cast<int>(wasm::max_mem64_pages())

: static_cast<int>(wasm::max_mem32_pages());

if (initial > engine_maximum) return {};

#ifdef V8_TARGET_ARCH_32_BIT

// On 32-bit platforms we need an heuristic here to balance overall memory

// and address space consumption.

constexpr int kGBPages = 1024 * 1024 * 1024 / wasm::kWasmPageSize;

// We allocate the smallest of the following sizes, but at least the initial

// size:

// 1) the module-defined maximum;

// 2) 1GB;

// 3) the engine maximum;

int allocation_maximum = std::min(kGBPages, engine_maximum);

int heuristic_maximum;

if (initial > kGBPages) {

// We always allocate at least the initial size.

heuristic_maximum = initial;

} else if (has_maximum) {

// We try to reserve the maximum, but at most the allocation_maximum to

// avoid OOMs.

heuristic_maximum = std::min(maximum, allocation_maximum);

} else if (shared == SharedFlag::kShared) {

// If shared memory has no maximum, we use the allocation_maximum as an

// implicit maximum.

heuristic_maximum = allocation_maximum;

} else {

// If non-shared memory has no maximum, we only allocate the initial size

// and then grow with realloc.

heuristic_maximum = initial;

}

#else

int heuristic_maximum =

has_maximum ? std::min(engine_maximum, maximum) : engine_maximum;

#endif

std::unique_ptr<BackingStore> backing_store =

BackingStore::AllocateWasmMemory(isolate, initial, heuristic_maximum,

address_type == wasm::AddressType::kI32

? WasmMemoryFlag::kWasmMemory32

: WasmMemoryFlag::kWasmMemory64,

shared);