v8/test/mjsunit/regress/wasm/regress-873600.js
Ben L. Titzer 5d69010e26 [asmjs] Properly validate asm.js heap sizes
Enforce both engine limitations and spec (http://asmjs.org/spec/latest/)
limitations on the size of asm.js heaps.

R=clemensh@chromium.org
CC=​mstarzinger@chromium.org

Bug: chromium:873600
Change-Id: I104c23bbd0a9a7c494f97f8f9e83ac5a37496dfd
Reviewed-on: https://chromium-review.googlesource.com/1174411
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55163}
2018-08-16 14:02:02 +00:00

51 lines
1.2 KiB
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function DoTest() {
var stdlib = this;
try {
var buffer = new ArrayBuffer((2097120) * 1024);
} catch (e) {
// Out of memory: soft pass because 2GiB is actually a lot!
print("OOM: soft pass");
return;
}
var foreign = {}
var m = (function Module(stdlib, foreign, heap) {
"use asm";
var MEM16 = new stdlib.Int16Array(heap);
function load(i) {
i = i|0;
i = MEM16[i >> 1]|0;
return i | 0;
}
function store(i, v) {
i = i|0;
v = v|0;
MEM16[i >> 1] = v;
}
function load8(i) {
i = i|0;
i = MEM16[i + 8 >> 1]|0;
return i | 0;
}
function store8(i, v) {
i = i|0;
v = v|0;
MEM16[i + 8 >> 1] = v;
}
return { load: load, store: store, load8: load8, store8: store8 };
})(stdlib, foreign, buffer);
assertEquals(0, m.load(-8));
assertEquals(0, m.load8(-16));
m.store(2014, 2, 30, 1, 0);
assertEquals(0, m.load8(-8));
m.store8(-8, 99);
assertEquals(99, m.load(0));
assertEquals(99, m.load8(-8));
})();