nodejs/deps/v8/test/mjsunit/regress/wasm/regress-346505953.js
Michaël Zasso 9d7cd9b864
deps: update V8 to 12.8.374.13
PR-URL: https://github.com/nodejs/node/pull/54077
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
2024-08-16 16:03:01 +02:00

27 lines
909 B
JavaScript

// Copyright 2024 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
const builder = new WasmModuleBuilder();
let array = builder.addArray(kWasmI64, true);
builder.addFunction("createArray", makeSig([], [kWasmAnyRef])).exportFunc()
.addBody([
kExprI32Const, 10, // size
kGCPrefix, kExprArrayNewDefault, array,
]);
builder.addFunction("main", makeSig([wasmRefNullType(array)], [kWasmI64]))
.addLocals(wasmRefNullType(array), 1)
.addBody([
kExprLocalGet, 0,
...wasmI32Const(0xffffffe),
kGCPrefix, kExprArrayGet, array,
]).exportFunc();
let wasm = builder.instantiate().exports;
assertThrows(() => wasm.main(wasm.createArray()), WebAssembly.RuntimeError,
"array element access out of bounds");