| OLD | NEW | 
|---|
| 1 // Copyright 2016 the V8 project authors. All rights reserved. | 1 // Copyright 2016 the V8 project authors. All rights reserved. | 
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be | 
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. | 
| 4 | 4 | 
| 5 // Flags: --expose-wasm --stress-compaction | 5 // Flags: --expose-wasm --expose-gc --stress-compaction | 
| 6 | 6 | 
| 7 load("test/mjsunit/wasm/wasm-constants.js"); | 7 load("test/mjsunit/wasm/wasm-constants.js"); | 
| 8 load("test/mjsunit/wasm/wasm-module-builder.js"); | 8 load("test/mjsunit/wasm/wasm-module-builder.js"); | 
| 9 | 9 | 
| 10 var kPageSize = 0x10000; | 10 var kPageSize = 0x10000; | 
| 11 | 11 | 
| 12 function genGrowMemoryBuilder() { | 12 function genGrowMemoryBuilder() { | 
| 13   var builder = new WasmModuleBuilder(); | 13   var builder = new WasmModuleBuilder(); | 
| 14   builder.addFunction("grow_memory", kSig_i_i) | 14   builder.addFunction("grow_memory", kSig_i_i) | 
| 15       .addBody([kExprGetLocal, 0, kExprGrowMemory]) | 15       .addBody([kExprGetLocal, 0, kExprGrowMemory]) | 
| (...skipping 335 matching lines...) Expand 10 before | Expand all | Expand 10 after  Loading... | 
| 351     poke(0xaced); | 351     poke(0xaced); | 
| 352     assertEquals(0xaced, peek()); | 352     assertEquals(0xaced, peek()); | 
| 353   } | 353   } | 
| 354 | 354 | 
| 355   for (offset = 4*kPageSize - 3; offset <= 4*kPageSize + 4; offset++) { | 355   for (offset = 4*kPageSize - 3; offset <= 4*kPageSize + 4; offset++) { | 
| 356     assertTraps(kTrapMemOutOfBounds, poke); | 356     assertTraps(kTrapMemOutOfBounds, poke); | 
| 357   } | 357   } | 
| 358 } | 358 } | 
| 359 | 359 | 
| 360 testGrowMemoryOutOfBoundsOffset(); | 360 testGrowMemoryOutOfBoundsOffset(); | 
| 361 |  | 
| 362 |  | 
| 363 function testGrowMemoryOutOfBoundsOffset2() { |  | 
| 364   var builder = new WasmModuleBuilder(); |  | 
| 365   builder.addMemory(16, 128, false); |  | 
| 366   builder.addFunction("main", kSig_v_v) |  | 
| 367     .addBody([ |  | 
| 368       kExprI32Const, 20, |  | 
| 369       kExprI32Const, 29, |  | 
| 370       kExprGrowMemory, |  | 
| 371       kExprI32StoreMem, 0, 0xFF, 0xFF, 0xFF, 0x3a |  | 
| 372     ]) |  | 
| 373     .exportAs("main"); |  | 
| 374 |  | 
| 375   var module = builder.instantiate(); |  | 
| 376   try { |  | 
| 377     module.exports.main(); |  | 
| 378     assertFalse(true); |  | 
| 379   } catch (e) { |  | 
| 380     // should throw OOB |  | 
| 381   } |  | 
| 382 } |  | 
| 383 |  | 
| 384 testGrowMemoryOutOfBoundsOffset2(); |  | 
| OLD | NEW | 
|---|