nodejs/deps/v8/test/mjsunit/regress/wasm/regress-326260438.js

38 lines
1.3 KiB
JavaScript
Raw Permalink Normal View History

// Copyright 2024 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --wasm-staging
d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
const builder = new WasmModuleBuilder();
builder.startRecGroup();
let i8array = builder.addArray(kWasmI8, true, kNoSuperType, true);
builder.endRecGroup();
let kSig_e_aii = builder.addType(
makeSig([wasmRefNullType(i8array), kWasmI32, kWasmI32], [wasmRefType(kWasmExternRef)]));
let kStringFromUtf8Array = builder.addImport(
'wasm:text-decoder', 'decodeStringFromUTF8Array', kSig_e_aii);
let $data0 = builder.addPassiveDataSegment([97, 98, 99]);
builder.addFunction("main", makeSig([], [kWasmExternRef])).exportFunc()
.addBody([
kExprI32Const, 0, // offset.
kExprI32Const, 3, // length.
kGCPrefix, kExprArrayNewData, i8array, $data0,
kExprI32Const, 0x5, // start (OOB)
kExprI32Const, 0x7, // length
kExprCallFunction, kStringFromUtf8Array,
kExprDrop, // Despite the string being unused, we have to trap.
kExprRefNull, kExternRefCode,
]);
let kBuiltins = { builtins: ['text-decoder'] };
const instance = builder.instantiate({}, kBuiltins);
assertThrows(() => instance.exports.main(), WebAssembly.RuntimeError,
"array element access out of bounds");