v8/test/mjsunit/wasm/bounds-check-turbofan.js
Alessandro Pignotti 5f6b780374 OwnedByAddressingOperand should also allow uses by ProtectedLoad
ProtectedLoad/ProtectedStore opcodes are used in WebAssembly to represent memory
accesses. Since they are not part of the allowed opcodes in OwnedByAddressingOperand
it is not possible to take advantage of addressing modes to encode common patterns
for the pointer input value.

R=jarin@chromium.org

Bug: v8:8508
Change-Id: Ic62bf13fed7b1d86afb112d9aa59cd7073a28e72
Reviewed-on: https://chromium-review.googlesource.com/c/1354458
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58237}
2018-12-14 09:39:55 +00:00

25 lines
843 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
load("test/mjsunit/wasm/wasm-constants.js");
load("test/mjsunit/wasm/wasm-module-builder.js");
const builder = new WasmModuleBuilder();
builder.addMemory(1, undefined, false);
builder.addFunction('load', kSig_i_i)
.addBody([
kExprGetLocal, 0,
kExprI32LoadMem, 0, 100])
.exportFunc();
const module = builder.instantiate();
%WasmTierUpFunction(module, 0);
// 100 is added as part of the load instruction above
// Last valid address (64k - 100 - 4)
assertEquals(0, module.exports.load(0x10000 - 100 - 4));
// First invalid address (64k - 100)
assertTraps(kTrapMemOutOfBounds, _ => { module.exports.load(0x10000 - 100);});