OLD | NEW |
1 // Copyright 2016 the V8 project authors. All rights reserved. | 1 // Copyright 2016 the V8 project authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // Flags: --expose-wasm --stress-compaction | 5 // Flags: --expose-wasm --expose-gc --stress-compaction |
6 | 6 |
7 load("test/mjsunit/wasm/wasm-constants.js"); | 7 load("test/mjsunit/wasm/wasm-constants.js"); |
8 load("test/mjsunit/wasm/wasm-module-builder.js"); | 8 load("test/mjsunit/wasm/wasm-module-builder.js"); |
9 | 9 |
10 var kPageSize = 0x10000; | 10 var kPageSize = 0x10000; |
11 | 11 |
12 function genGrowMemoryBuilder() { | 12 function genGrowMemoryBuilder() { |
13 var builder = new WasmModuleBuilder(); | 13 var builder = new WasmModuleBuilder(); |
14 builder.addFunction("grow_memory", kSig_i_i) | 14 builder.addFunction("grow_memory", kSig_i_i) |
15 .addBody([kExprGetLocal, 0, kExprGrowMemory]) | 15 .addBody([kExprGetLocal, 0, kExprGrowMemory]) |
(...skipping 335 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
351 poke(0xaced); | 351 poke(0xaced); |
352 assertEquals(0xaced, peek()); | 352 assertEquals(0xaced, peek()); |
353 } | 353 } |
354 | 354 |
355 for (offset = 4*kPageSize - 3; offset <= 4*kPageSize + 4; offset++) { | 355 for (offset = 4*kPageSize - 3; offset <= 4*kPageSize + 4; offset++) { |
356 assertTraps(kTrapMemOutOfBounds, poke); | 356 assertTraps(kTrapMemOutOfBounds, poke); |
357 } | 357 } |
358 } | 358 } |
359 | 359 |
360 testGrowMemoryOutOfBoundsOffset(); | 360 testGrowMemoryOutOfBoundsOffset(); |
361 | |
362 | |
363 function testGrowMemoryOutOfBoundsOffset2() { | |
364 var builder = new WasmModuleBuilder(); | |
365 builder.addMemory(16, 128, false); | |
366 builder.addFunction("main", kSig_v_v) | |
367 .addBody([ | |
368 kExprI32Const, 20, | |
369 kExprI32Const, 29, | |
370 kExprGrowMemory, | |
371 kExprI32StoreMem, 0, 0xFF, 0xFF, 0xFF, 0x3a | |
372 ]) | |
373 .exportAs("main"); | |
374 | |
375 var module = builder.instantiate(); | |
376 try { | |
377 module.exports.main(); | |
378 assertFalse(true); | |
379 } catch (e) { | |
380 // should throw OOB | |
381 } | |
382 } | |
383 | |
384 testGrowMemoryOutOfBoundsOffset2(); | |
OLD | NEW |