v8/test/mjsunit/regress/regress-crbug-715455.js

26 lines
730 B
JavaScript
Raw Normal View History

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function MODULE() {
"use asm";
function f() {
bogus_function_table[0 & LIMIT]();
}
return { f:f };
}
var bogus_function_table = [ Object ];
var test_set = [ 0x3fffffff, 0x7fffffff, 0xffffffff ];
for (var i = 0; i < test_set.length; ++i) {
bogus_function_table[i] = Object;
var src = MODULE.toString();
src = src.replace(/MODULE/g, "Module" + i);
src = src.replace(/LIMIT/g, test_set[i]);
var module = eval("(" + src + ")");
assertDoesNotThrow(module(this).f());
assertFalse(%IsAsmWasmCode(module));
}