diff --git a/src/wasm/function-body-decoder.cc b/src/wasm/function-body-decoder.cc index 2d25f7c3dd..f8e87d0597 100644 --- a/src/wasm/function-body-decoder.cc +++ b/src/wasm/function-body-decoder.cc @@ -1158,6 +1158,7 @@ class WasmFullDecoder : public WasmDecoder { len = DecodeLoadMem(kWasmF64, MachineType::Float64()); break; case kExprS128LoadMem: + CHECK_PROTOTYPE_OPCODE(wasm_simd_prototype); len = DecodeLoadMem(kWasmS128, MachineType::Simd128()); break; case kExprI32StoreMem8: @@ -1188,6 +1189,7 @@ class WasmFullDecoder : public WasmDecoder { len = DecodeStoreMem(kWasmF64, MachineType::Float64()); break; case kExprS128StoreMem: + CHECK_PROTOTYPE_OPCODE(wasm_simd_prototype); len = DecodeStoreMem(kWasmS128, MachineType::Simd128()); break; case kExprGrowMemory: { diff --git a/test/mjsunit/regress/wasm/regression-702460.js b/test/mjsunit/regress/wasm/regression-702460.js new file mode 100644 index 0000000000..25ed5b5061 --- /dev/null +++ b/test/mjsunit/regress/wasm/regression-702460.js @@ -0,0 +1,47 @@ +// Copyright 2017 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +load("test/mjsunit/wasm/wasm-constants.js"); +load("test/mjsunit/wasm/wasm-module-builder.js"); + +(function() { +"use asm"; + var builder = new WasmModuleBuilder(); + builder.addFunction("regression_702460", kSig_i_v) + .addBody([ + kExprI32Const, 0x52, + kExprI32Const, 0x41, + kExprI32Const, 0x3c, + kExprI32Const, 0xdc, 0x01, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprSetLocal, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprGrowMemory, 0x00, + kExprS128LoadMem, 0x00, 0x40, + kExprUnreachable, + kExprGrowMemory, 0x00 + ]).exportFunc(); + assertThrows(() => builder.instantiate()); +})(); diff --git a/test/mjsunit/wasm/wasm-constants.js b/test/mjsunit/wasm/wasm-constants.js index c71242a62c..e224c8562b 100644 --- a/test/mjsunit/wasm/wasm-constants.js +++ b/test/mjsunit/wasm/wasm-constants.js @@ -315,6 +315,7 @@ let kExprI32ReinterpretF32 = 0xbc; let kExprI64ReinterpretF64 = 0xbd; let kExprF32ReinterpretI32 = 0xbe; let kExprF64ReinterpretI64 = 0xbf; +let kExprS128LoadMem = 0xc0; let kTrapUnreachable = 0; let kTrapMemOutOfBounds = 1;