add overflow condition

Author: Meghana Gupta

lib/Backend/LowerMDShared.cpp

@@ -283,9 +283,12 @@ LowererMD::LowerWasmMemOp(IR::Instr * instr, IR::Opnd *addrOpnd)
     IR::Opnd *srcOpnd = IR::IndirOpnd::New(arrayBuffer, Js::ArrayBuffer::GetByteLengthOffset(), TyMachReg, m_func);
     IR::RegOpnd *arrayLenOpnd = IR::RegOpnd::New(TyMachReg, m_func);
 
-    // Compare index and array buffer length, and generate RuntimeError if greater
+    // Compare index + memop access length and array buffer length, and generate RuntimeError if greater
     Lowerer::InsertMove(arrayLenOpnd, srcOpnd, helperLabel);
+    Lowerer::InsertAdd(true, indexOpnd, indexOpnd, IR::IntConstOpnd::New(addrOpnd->GetSize(), TyMachReg, m_func), helperLabel);
+    Lowerer::InsertBranch(Js::OpCode::JO, helperLabel, helperLabel);
     m_lowerer->InsertCompareBranch(indexOpnd, arrayLenOpnd, Js::OpCode::BrGe_A, true, helperLabel, helperLabel);
+
     // MGTODO : call RuntimeError once implemented
     m_lowerer->GenerateRuntimeError(loadLabel, JSERR_InvalidTypedArrayIndex, IR::HelperOp_RuntimeRangeError);
     Lowerer::InsertBranch(Js::OpCode::Br, loadLabel, helperLabel);

lib/Runtime/Language/InterpreterStackFrame.cpp

@@ -981,6 +981,25 @@ namespace Js
         &InterpreterStackFrame::OP_LdArr<int32, int64>,
         &InterpreterStackFrame::OP_LdArr<uint32, int64>,
     };
+
+    const int InterpreterStackFrame::TypeToSizeMap[] =
+    {
+        /*int8*/ 1,
+        /*uint8*/ 1,
+        /*int16*/ 2,
+        /*uint16*/ 2,
+        /*int32*/ 4,
+        /*uint32*/ 4,
+        /*float*/ 4,
+        /*double*/ 8,
+        /*int64*/ 8,
+        /*int8*/ 1,
+        /*uint8*/ 1,
+        /*int16*/ 2,
+        /*uint16*/ 2,
+        /*int32*/ 4,
+        /*uint32*/ 4,
+    };
 #endif
 
     Var InterpreterStackFrame::InnerScopeFromRegSlot(RegSlot reg) const
@@ -8304,7 +8323,7 @@ const byte * InterpreterStackFrame::OP_ProfiledLoopBodyStart(const byte * ip)
         CompileAssert(Js::ArrayBufferView::TYPE_COUNT == (sizeof(InterpreterStackFrame::LdArrFunc) / sizeof(InterpreterStackFrame::ArrFunc)));
         JavascriptArrayBuffer* arr = *(JavascriptArrayBuffer**)GetNonVarReg(AsmJsFunctionMemory::ArrayBufferRegister);
         BYTE* buffer = arr->GetBuffer();
-        ArrayType val = index < (arr->GetByteLength()) ? *(ArrayType*)(buffer + index) : GetArrayViewOverflowVal<ArrayType>();
+        ArrayType val = index + sizeof(ArrayType) < (arr->GetByteLength()) ? *(ArrayType*)(buffer + index) : GetArrayViewOverflowVal<ArrayType>();
         SetRegRaw<RegType>(regSlot, (RegType)val);
     }
 #endif
@@ -8341,13 +8360,13 @@ const byte * InterpreterStackFrame::OP_ProfiledLoopBodyStart(const byte * ip)
     void InterpreterStackFrame::OP_LdArrWasm(const unaligned T* playout)
     {
         Assert(playout->ViewType < Js::ArrayBufferView::TYPE_COUNT);
-        const uint32 index = (uint32)GetRegRawInt(playout->SlotIndex);
+        const uint64 index = (uint64)GetRegRawInt(playout->SlotIndex);
         JavascriptArrayBuffer* arr = *(JavascriptArrayBuffer**)GetNonVarReg(AsmJsFunctionMemory::ArrayBufferRegister);
-        if (index >= arr->GetByteLength())
+        if (index >= arr->GetByteLength() || index + TypeToSizeMap[playout->ViewType] > arr->GetByteLength())
         {
             JavascriptError::ThrowRangeError(scriptContext, JSERR_InvalidTypedArrayIndex);
         }
-        (this->*LdArrFunc[playout->ViewType])(index, playout->Value);
+        (this->*LdArrFunc[playout->ViewType])((uint32)index, playout->Value);
     }
     template <class T>
     void InterpreterStackFrame::OP_LdArrConstIndex(const unaligned T* playout)
@@ -8369,7 +8388,7 @@ const byte * InterpreterStackFrame::OP_ProfiledLoopBodyStart(const byte * ip)
         Assert(playout->ViewType < Js::ArrayBufferView::TYPE_COUNT);
         const uint32 index = (uint32)GetRegRawInt(playout->SlotIndex);
         JavascriptArrayBuffer* arr = *(JavascriptArrayBuffer**)GetNonVarReg(AsmJsFunctionMemory::ArrayBufferRegister);
-        if (index >= arr->GetByteLength())
+        if (index >= arr->GetByteLength() || index + TypeToSizeMap[playout->ViewType] > arr->GetByteLength())
         {
             JavascriptError::ThrowRangeError(scriptContext, JSERR_InvalidTypedArrayIndex);
         }

lib/Runtime/Language/InterpreterStackFrame.h

@@ -153,6 +153,7 @@ namespace Js
         typedef void(InterpreterStackFrame::*ArrFunc)(uint32, RegSlot);
         static const ArrFunc StArrFunc[15];
         static const ArrFunc LdArrFunc[15];
+        static const int     TypeToSizeMap[15];
 #endif
 
         //This class must have an empty ctor (otherwise it will break the code in InterpreterStackFrame::InterpreterThunk