nodejs/deps/v8/test/mjsunit/regress/wasm/regress-1239954.js
Michaël Zasso 09a8440b45
deps: update V8 to 12.2.281.27
PR-URL: https://github.com/nodejs/node/pull/51362
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
2024-03-31 15:36:07 +02:00

35 lines
1.0 KiB
JavaScript

// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
var builder = new WasmModuleBuilder();
let array_index = builder.addArray(kWasmI64, true);
let sig_index = builder.addType(kSig_v_v);
let main = builder.addFunction("main", kSig_v_i);
let other = builder.addFunction("other", sig_index).addBody([]);
let table = builder.addTable(kWasmAnyFunc, 1, 1);
builder.addActiveElementSegment(
0, // table
wasmI32Const(0), // offset
[1]); // values
main.addBody([
kExprI64Const, 0x33,
kExprLocalGet, 0,
kGCPrefix, kExprArrayNew, array_index,
kExprDrop,
kExprI32Const, 0,
kExprCallIndirect, sig_index, table.index,
]).exportFunc();
var instance = builder.instantiate();
assertThrows(
() => instance.exports.main(1<<29), WebAssembly.RuntimeError,
'requested new array is too large');