v8/test/mjsunit/regress/wasm/regress-10126.js
Andreas Haas 7a31813024 Reland "[wasm] The name of a custom section can cause a validation error"
This is a reland of 03d5a7ba9b

Nothing changed here compared to the original test. The tests on the
blink side were invalid, I fixed them in https://crrev.com/c/2066907.

Original change's description:
> [wasm] The name of a custom section can cause a validation error
>
> The WebAssembly spec defines that the name of a custom section can cause
> a validation error. The streaming decoder, however, used a separate
> Decoder object to decode the name, and thereby avoided a validation
> error. With this CL the streaming decoder uses the main decoder to
> decode the name of the custom section.
>
> In addition this CL removes the test mjsunit/regress/wasm/regress-789952.
> This test defined an invalid WebAssembly module and expected it to
> compile. As it is a regression test, it makes no sense to fix the test.
> The module is invalid because it defines the length of the custom section
> to be '0', so there are no bytes in the custom section for its name.
>
> R=clemensb@chromium.org
> CC=thibaudm@chromium.org
>
> Bug: v8:10126
> Change-Id: I8cfc77c9a5916570d5362d5922e0179a29774da8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2041446
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66348}

Bug: v8:10126
Change-Id: I48aaed8eb9899da1703030fb6809fe46a6e66191
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2069325
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66431}
2020-02-25 15:38:27 +00:00

33 lines
1.1 KiB
JavaScript

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load('test/mjsunit/wasm/wasm-module-builder.js')
let binary = new Binary;
binary.emit_bytes([
kWasmH0, // 0 header
kWasmH1, // 1 -
kWasmH2, // 2 -
kWasmH3, // 3 -
kWasmV0, // 4 version
kWasmV1, // 5 -
kWasmV2, // 6 -
kWasmV3, // 7 -
kUnknownSectionCode, // 8 custom section
0x5, // 9 length
0x6, // 10 invalid name length
'a', // 11 payload
'b', // 12 -
'c', // 13 -
'd', // 14 -
kCodeSectionCode, // 15 code section start
0x1, // 16 code section length
19, // 17 invalid number of functions
]);
const buffer = binary.trunc_buffer();
assertThrowsAsync(
WebAssembly.compile(buffer), WebAssembly.CompileError,
'WebAssembly.compile(): expected 6 bytes, fell off end @+11');