OLD | NEW |
(Empty) | |
| 1 // Copyright 2017 the V8 project authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. |
| 4 |
| 5 load("test/mjsunit/wasm/wasm-constants.js"); |
| 6 load("test/mjsunit/wasm/wasm-module-builder.js"); |
| 7 |
| 8 function testGrowMemoryOutOfBoundsOffset() { |
| 9 print("testGrowMemoryOutOfBoundsOffset2"); |
| 10 var builder = new WasmModuleBuilder(); |
| 11 builder.addMemory(16, 128, false); |
| 12 builder.addFunction("main", kSig_v_v) |
| 13 .addBody([ |
| 14 kExprI32Const, 20, |
| 15 kExprI32Const, 29, |
| 16 kExprGrowMemory, kMemoryZero, |
| 17 // Assembly equivalent Move <reg>,0xf5fffff |
| 18 // with wasm memory reference relocation information |
| 19 kExprI32StoreMem, 0, 0xFF, 0xFF, 0xFF, 0x7A |
| 20 ]) |
| 21 .exportAs("main"); |
| 22 var module = builder.instantiate(); |
| 23 assertTraps(kTrapMemOutOfBounds, module.exports.main); |
| 24 } |
| 25 |
| 26 testGrowMemoryOutOfBoundsOffset(); |
OLD | NEW |