()
| 5 | d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js"); |
| 6 | |
| 7 | function testMemoryGrowOutOfBoundsOffset() { |
| 8 | print("testMemoryGrowOutOfBoundsOffset2"); |
| 9 | var builder = new WasmModuleBuilder(); |
| 10 | builder.addMemory(16, 128); |
| 11 | builder.addFunction("main", kSig_v_v) |
| 12 | .addBody([ |
| 13 | kExprI32Const, 20, |
| 14 | kExprI32Const, 29, |
| 15 | kExprMemoryGrow, kMemoryZero, |
| 16 | // Assembly equivalent Move <reg>,0xf5fffff |
| 17 | // with wasm memory reference relocation information |
| 18 | kExprI32StoreMem, 0, 0xFF, 0xFF, 0xFF, 0x7A |
| 19 | ]) |
| 20 | .exportAs("main"); |
| 21 | var module = builder.instantiate(); |
| 22 | assertTraps(kTrapMemOutOfBounds, module.exports.main); |
| 23 | } |
| 24 | |
| 25 | testMemoryGrowOutOfBoundsOffset(); |
no test coverage detected
searching dependent graphs…