54818a635f
This fixes propagation of validation failures that happen during the
validation of a heap access expression in {ValidateHeapAccess}.
R=clemensh@chromium.org
TEST=mjsunit/regress/regress-crbug-714971
BUG=chromium:714971
Change-Id: I8f91ac1da34ae50fdde2938f61b6468cdac92b6e
Reviewed-on: https://chromium-review.googlesource.com/486801
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44851}
20 lines
509 B
JavaScript
20 lines
509 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function Module(stdlib, foreign, heap) {
|
|
"use asm";
|
|
var a = new stdlib.Int16Array(heap);
|
|
function f() {
|
|
return a[23 >> -1];
|
|
}
|
|
return { f:f };
|
|
}
|
|
var b = new ArrayBuffer(1024);
|
|
var m = Module(this, {}, b);
|
|
new Int16Array(b)[0] = 42;
|
|
assertEquals(42, m.f());
|
|
assertFalse(%IsAsmWasmCode(Module));
|