313f8d3fcb
This makes sure that shift expressions (not wrapped in parentheses) can appear as part of the index in a valid heap access expression. Only the last operand of a sequence of shift expressions is taken into account when validating the heap access. R=jarin@chromium.org TEST=mjsunit/regress/regress-6700 BUG=v8:6700,chromium:754751 Change-Id: Icc7a71bd64461da4d3daea41b995964e3dfc6dc6 Reviewed-on: https://chromium-review.googlesource.com/623811 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#47497}
91 lines
2.3 KiB
JavaScript
91 lines
2.3 KiB
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
(function TestLeftRight() {
|
|
function Module(stdlib, foreign, heap) {
|
|
"use asm";
|
|
var HEAP32 = new stdlib.Int32Array(heap);
|
|
function f(i) {
|
|
i = i | 0;
|
|
return HEAP32[i << 2 >> 2] | 0;
|
|
}
|
|
return { f:f }
|
|
}
|
|
var buffer = new ArrayBuffer(1024);
|
|
var module = new Module(this, {}, buffer);
|
|
assertTrue(%IsAsmWasmCode(Module));
|
|
new Int32Array(buffer)[42] = 23;
|
|
assertEquals(23, module.f(42));
|
|
})();
|
|
|
|
(function TestRightRight() {
|
|
function Module(stdlib, foreign, heap) {
|
|
"use asm";
|
|
var HEAP32 = new stdlib.Int32Array(heap);
|
|
function f(i) {
|
|
i = i | 0;
|
|
return HEAP32[i >> 2 >> 2] | 0;
|
|
}
|
|
return { f:f }
|
|
}
|
|
var buffer = new ArrayBuffer(1024);
|
|
var module = new Module(this, {}, buffer)
|
|
assertTrue(%IsAsmWasmCode(Module));
|
|
new Int32Array(buffer)[42 >> 4] = 23;
|
|
assertEquals(23, module.f(42));
|
|
})();
|
|
|
|
(function TestRightLeft() {
|
|
function Module(stdlib, foreign, heap) {
|
|
"use asm";
|
|
var HEAP32 = new stdlib.Int32Array(heap);
|
|
function f(i) {
|
|
i = i | 0;
|
|
return HEAP32[i >> 2 << 2] | 0;
|
|
}
|
|
return { f:f }
|
|
}
|
|
var buffer = new ArrayBuffer(1024);
|
|
var module = new Module(this, {}, buffer)
|
|
assertFalse(%IsAsmWasmCode(Module));
|
|
new Int32Array(buffer)[42 & 0xfc] = 23;
|
|
assertEquals(23, module.f(42));
|
|
})();
|
|
|
|
(function TestRightButNotImmediate() {
|
|
function Module(stdlib, foreign, heap) {
|
|
"use asm";
|
|
var HEAP32 = new stdlib.Int32Array(heap);
|
|
function f(i) {
|
|
i = i | 0;
|
|
return HEAP32[i >> 2 + 1] | 0;
|
|
}
|
|
return { f:f }
|
|
}
|
|
var buffer = new ArrayBuffer(1024);
|
|
var module = new Module(this, {}, buffer)
|
|
assertFalse(%IsAsmWasmCode(Module));
|
|
new Int32Array(buffer)[42 >> 3] = 23;
|
|
assertEquals(23, module.f(42));
|
|
})();
|
|
|
|
(function TestLeftOnly() {
|
|
function Module(stdlib, foreign, heap) {
|
|
"use asm";
|
|
var HEAP32 = new stdlib.Int32Array(heap);
|
|
function f(i) {
|
|
i = i | 0;
|
|
return HEAP32[i << 2] | 0;
|
|
}
|
|
return { f:f }
|
|
}
|
|
var buffer = new ArrayBuffer(1024);
|
|
var module = new Module(this, {}, buffer)
|
|
assertFalse(%IsAsmWasmCode(Module));
|
|
new Int32Array(buffer)[42 << 2] = 23;
|
|
assertEquals(23, module.f(42));
|
|
})();
|