v8/test/mjsunit/regress/wasm/regression-708714.js
Clemens Hammacher 88e169dc62 [wasm] Stop decoding sections once an error occured
We went on decoding the next section, which happened to be the start
section. But since the function section had an error, the signature
pointer was not still {nullptr} on the start function, leading to a
segfault.

Drive-by fix: Improve decoder trace output.

R=ahaas@chromium.org
BUG=chromium:708714, chromium:708787

Change-Id: I5ae2adb32764b9d154f1ca878019f26ac31839b4
Reviewed-on: https://chromium-review.googlesource.com/472847
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44521}
2017-04-10 13:00:50 +00:00

24 lines
618 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load("test/mjsunit/wasm/wasm-constants.js");
load("test/mjsunit/wasm/wasm-module-builder.js");
var builder = new WasmModuleBuilder();
builder.addExplicitSection([kFunctionSectionCode,
// length
7,
// functions count
1,
// signature index (invalid LEB)
0xff, 0xff, 0xff, 0xff, 0xff]);
builder.addExplicitSection([kStartSectionCode,
// length
1,
// index
0]);
assertThrows(() => builder.instantiate(), WebAssembly.CompileError);