f2b9c5005c
This makes sure that the evaluation result of the first expression in for-statements is properly dropped, to leave the stack in a balanced state after the statement. It also makes sure validation failures in said expression are handled correctly. R=clemensh@chromium.org TEST=mjsunit/regress/regress-crbug-721835 BUG=chromium:721835 Change-Id: I7e6cff4cea0bbf5aad6a3459e27a08ea814dbdbe Reviewed-on: https://chromium-review.googlesource.com/506148 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#45299}
32 lines
751 B
JavaScript
32 lines
751 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --validate-asm --allow-natives-syntax
|
|
|
|
(function TestValidationFailureInForStatement() {
|
|
function Module() {
|
|
"use asm"
|
|
function f() {
|
|
var a = 0;
|
|
for (a = b; 0; 0) {};
|
|
return 0;
|
|
}
|
|
return { f:f };
|
|
}
|
|
assertThrows(() => Module().f(), ReferenceError);
|
|
assertFalse(%IsAsmWasmCode(Module));
|
|
})();
|
|
|
|
(function TestForStatementInVoidFunction() {
|
|
function Module() {
|
|
"use asm"
|
|
function f() {
|
|
for (1; 0; 0) {};
|
|
}
|
|
return { f:f };
|
|
}
|
|
assertDoesNotThrow(() => Module().f());
|
|
assertTrue(%IsAsmWasmCode(Module));
|
|
})();
|