From 36d22d82aa202bb199967e9512281e9a53db42c9 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 21:33:14 +0200 Subject: Adding upstream version 115.7.0esr. Signed-off-by: Daniel Baumann --- js/src/jit-test/tests/wasm/regress/ion-many-results.js | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 js/src/jit-test/tests/wasm/regress/ion-many-results.js (limited to 'js/src/jit-test/tests/wasm/regress/ion-many-results.js') diff --git a/js/src/jit-test/tests/wasm/regress/ion-many-results.js b/js/src/jit-test/tests/wasm/regress/ion-many-results.js new file mode 100644 index 0000000000..bc4df59e20 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/ion-many-results.js @@ -0,0 +1,17 @@ +// This provokes a crash in ion if its tempalloc reservation logic is not +// up to snuff, bug 1675844. + +for ( let i=100; i < 300; i++ ) { + let xs = new Array(i).fill(1); + + // Should not crash the compiler but should fail validation + assertErrorMessage(() => new WebAssembly.Module(wasmTextToBinary(` +(module + (func $f (result ${xs.map(_ => 'i32 ').join(' ')}) + ${xs.map((_) => '(i32.const 1)').join(' ')}) + (func $g + (call $f)))`)), + WebAssembly.CompileError, + /(unused values not explicitly dropped)|(values remaining on stack)/); + +} -- cgit v1.2.3