// Copyright 2017 the V8 project authors. All rights reserved.// Use of this source code is governed by a BSD-style license that can be// found in the LICENSE file.load('test/mjsunit/wasm/wasm-module-builder.js');varname='regression_684858';functionpatchNameLength(buffer){varcount=0;varview=newUint8Array(buffer);
varsubs=String.fromCharCode.apply(null,view.slice(i,i+name.length));if(subs!=name)continue;++count;// One byte before this name, its length is encoded.// Patch this to 127, making it out of bounds.if(view.length>=127)throwError('cannot patch reliably');if(view[i-1]!=name.length)throwError('unexpected length');view[i-1]=0x7f;}if(count!=1)throwError('did not find name');}varbuilder=newWasmModuleBuilder();builder.addFunction(name,kSig_i_v).addBody([kExprI32Const,2,kExprI32Const,0,kExprI32DivU]).exportAs('main');varbuffer=builder.toBuffer();patchNameLength(buffer);varmodule=newWebAssembly.Module(buffer);varinstance=newWebAssembly.Instance(module);assertThrows(()=>instance.exports.main(),WebAssembly.RuntimeError);