v8/test/mjsunit/regress/wasm/regress-834619.js
Ben L. Titzer 903d87312e [wasm] Fix target instance for indirect calls to imports
In the case of an indirect call to an imported function, the target
instance stored in the IFT was actually wrong.

Bug: chromium:834619
Change-Id: Id2ac4158335ecf2b58e1983ce37df852a9ebd1b2
Reviewed-on: https://chromium-review.googlesource.com/1030174
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52831}
2018-04-27 08:27:56 +00:00

50 lines
1.4 KiB
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --wasm-lazy-compilation
load("test/mjsunit/wasm/wasm-constants.js");
load("test/mjsunit/wasm/wasm-module-builder.js");
(function ExportedFunctionsImportedOrder() {
print(arguments.callee.name);
let i1 = (() => {
let builder = new WasmModuleBuilder();
builder.addFunction("f1", kSig_i_v)
.addBody(
[kExprI32Const, 1])
.exportFunc();
builder.addFunction("f2", kSig_i_v)
.addBody(
[kExprI32Const, 2])
.exportFunc();
return builder.instantiate();
})();
let i2 = (() => {
let builder = new WasmModuleBuilder();
builder.addImport("q", "f2", kSig_i_v);
builder.addImport("q", "f1", kSig_i_v);
builder.addFunction("main", kSig_i_i)
.addBody([
kExprGetLocal, 0,
kExprCallIndirect, 0, kTableZero
])
.exportFunc();
builder.addFunctionTableInit(0, false, [0, 1, 1, 0]);
return builder.instantiate({q: {f2: i1.exports.f2, f1: i1.exports.f1}});
})();
print("--->calling 0");
assertEquals(2, i2.exports.main(0));
print("--->calling 1");
assertEquals(1, i2.exports.main(1));
print("--->calling 2");
assertEquals(1, i2.exports.main(2));
print("--->calling 3");
assertEquals(2, i2.exports.main(3));
})();