f30a86c8d3
This fixes a corner-case with lazy compilation in WebAssembly where native-heap code did not expect to see WASM-to-JS wrappers in tables. R=clemensh@chromium.org TEST=mjsunit/regress/wasm/regress-803788 BUG=chromium:803788 Change-Id: Ie44b5c9efe2b171e1915295bb95d6cb61dfab3dc Reviewed-on: https://chromium-review.googlesource.com/878262 Reviewed-by: Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#50755}
28 lines
838 B
JavaScript
28 lines
838 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --wasm-lazy-compilation
|
|
|
|
load('test/mjsunit/wasm/wasm-constants.js');
|
|
load('test/mjsunit/wasm/wasm-module-builder.js');
|
|
|
|
var builder = new WasmModuleBuilder();
|
|
let q_table = builder.addImportedTable("q", "table")
|
|
let q_base = builder.addImportedGlobal("q", "base", kWasmI32);
|
|
let q_fun = builder.addImport("q", "fun", kSig_v_v);
|
|
builder.addType(kSig_i_ii);
|
|
builder.addFunctionTableInit(q_base, true, [ q_fun ])
|
|
let module = new WebAssembly.Module(builder.toBuffer());
|
|
let table = new WebAssembly.Table({
|
|
element: "anyfunc",
|
|
initial: 10,
|
|
});
|
|
let instance = new WebAssembly.Instance(module, {
|
|
q: {
|
|
base: 0,
|
|
table: table,
|
|
fun: () => (0)
|
|
}
|
|
});
|