The tracking of committed code space is broken on windows, resulting in the counters for committed code space and remaining uncomitted code space to be broken. This can lead to OOM issues because we use more than kMaxWasmCodeMemory bytes of code space. It also has security implications if this limit can be bypassed.

This is the buggy code (in wasm-code-manager.cc):

 708   if (commit_start < commit_end) {
 709 #if V8_OS_WIN
[...]
 715     for (auto& vmem : base::Reversed(owned_code_space_)) {
[...]
 727       if (commit_start == start) commit_start = end;
 728       if (commit_end == end) commit_end = start;
 729       if (commit_start >= commit_end) break;
 730     }
[...]
 738 #endif                                                                           
 739     committed_code_space_.fetch_add(commit_end - commit_start);                  


Since commit_start and commit_end are updated in the loop, the fetch_add will not add a correct number. In fact, commit_end might be smaller than commit_start at that point.