v8/test/mjsunit/regress/wasm/regress-1026680.js
Ng Zhi An ca16eb1d6b [liftoff] Add a regression test for msan failures
This test was generated following instructions in
https://crbug.com/1026680#c4, it seg faults with
https://crrev.com/c/1922489 and passes with the reland
https://crrev.com/c/1925131.

Bug: chromium:1026680
Change-Id: Ia8ef9878c06c50adeaa1a441524b5555b6869f97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1930604
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65128}
2019-11-22 22:21:49 +00:00

32 lines
963 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load('test/mjsunit/wasm/wasm-module-builder.js');
(function() {
const builder = new WasmModuleBuilder();
builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
builder.addType(makeSig([], []));
// Generate function 1 (out of 2).
builder.addFunction(undefined, 0 /* sig */)
.addBodyWithEnd([
// signature: i_iii
// body:
kExprCallFunction, 0x01, // function #1: v_v
kExprI32Const, 0x00,
kExprEnd, // @5
]);
// Generate function 2 (out of 2).
builder.addFunction(undefined, 1 /* sig */)
.addLocals({f32_count: 1}).addLocals({i32_count: 13})
.addBodyWithEnd([
// signature: v_v
// body:
kExprEnd, // @5
]);
builder.addExport('main', 0);
const instance = builder.instantiate();
print(instance.exports.main(1, 2, 3));
})();