v8/test/mjsunit/regress/wasm/regress-6931.js
Sven Sauleau 5bdb13297f [wasm] merge js constants file in module-builder
We noticed that almost every call site were loading both files,
the split isn't necessary anymore.

In some message tests, removed the absolute line number to allow future
changes.

Bug: v8:8726
Change-Id: I8527f0a1ecfa685aa01a5e2f5f47ddf1cb13a545
Reviewed-on: https://chromium-review.googlesource.com/c/1446452
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59220}
2019-01-30 22:10:34 +00:00

30 lines
962 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load('test/mjsunit/wasm/wasm-module-builder.js');
// This test checks for accidental sign extension. The Wasm spec says we do
// arbitrary precision unsigned arithmetic to compute the memory address,
// meaning this test should do 0xfffffffc + 8, which is 0x100000004 and out of
// bounds. However, if we interpret 0xfffffffc as -4, then the result is 4 and
// succeeds erroneously.
(function() {
let builder = new WasmModuleBuilder();
builder.addMemory(1, 1, false);
builder.addFunction('test', kSig_v_v)
.addBody([
kExprI32Const, 0x7c, // address = -4
kExprI32Const, 0,
kExprI32StoreMem, 0, 8, // align = 0, offset = 8
])
.exportFunc();
let module = builder.instantiate();
assertTraps(kTrapMemOutOfBounds, module.exports.test);
})();