v8/test/mjsunit/regress/wasm/regress-10126.js

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

33 lines
1.1 KiB
JavaScript
Raw Normal View History

Reland "[wasm] The name of a custom section can cause a validation error" This is a reland of 03d5a7ba9b576b76e0757061e1dca2d6e3064117 Nothing changed here compared to the original test. The tests on the blink side were invalid, I fixed them in https://crrev.com/c/2066907. Original change's description: > [wasm] The name of a custom section can cause a validation error > > The WebAssembly spec defines that the name of a custom section can cause > a validation error. The streaming decoder, however, used a separate > Decoder object to decode the name, and thereby avoided a validation > error. With this CL the streaming decoder uses the main decoder to > decode the name of the custom section. > > In addition this CL removes the test mjsunit/regress/wasm/regress-789952. > This test defined an invalid WebAssembly module and expected it to > compile. As it is a regression test, it makes no sense to fix the test. > The module is invalid because it defines the length of the custom section > to be '0', so there are no bytes in the custom section for its name. > > R=clemensb@chromium.org > CC=thibaudm@chromium.org > > Bug: v8:10126 > Change-Id: I8cfc77c9a5916570d5362d5922e0179a29774da8 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2041446 > Commit-Queue: Andreas Haas <ahaas@chromium.org> > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/master@{#66348} Bug: v8:10126 Change-Id: I48aaed8eb9899da1703030fb6809fe46a6e66191 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2069325 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#66431}
2020-02-25 14:41:13 +00:00
// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load('test/mjsunit/wasm/wasm-module-builder.js')
let binary = new Binary;
binary.emit_bytes([
kWasmH0, // 0 header
kWasmH1, // 1 -
kWasmH2, // 2 -
kWasmH3, // 3 -
kWasmV0, // 4 version
kWasmV1, // 5 -
kWasmV2, // 6 -
kWasmV3, // 7 -
kUnknownSectionCode, // 8 custom section
0x5, // 9 length
0x6, // 10 invalid name length
'a', // 11 payload
'b', // 12 -
'c', // 13 -
'd', // 14 -
kCodeSectionCode, // 15 code section start
0x1, // 16 code section length
19, // 17 invalid number of functions
]);
const buffer = binary.trunc_buffer();
assertThrowsAsync(
WebAssembly.compile(buffer), WebAssembly.CompileError,
'WebAssembly.compile(): expected 6 bytes, fell off end @+11');